docker-compose.prod.yml

# AgentGate Production Docker Compose Configuration
# Enterprise-grade setup with security hardening, health checks, and resource management
#
# Prerequisites:
# 1. Create .env.production file with required secrets
# 2. Configure reverse proxy (nginx/traefik) for SSL termination
# 3. Set up external backup strategy for volumes
#
# Usage:
#   docker compose -f docker-compose.prod.yml up -d
#   docker compose -f docker-compose.prod.yml logs -f
#   docker compose -f docker-compose.prod.yml down

services:
  # PostgreSQL Database - Hardened for production
  db:
    image: postgres:16-bookworm
    container_name: agentgate-db-prod
    restart: always
    environment:
      POSTGRES_USER: "${POSTGRES_USER:?POSTGRES_USER must be set}"
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
      POSTGRES_DB: "${POSTGRES_DB:-agentgate}"
      POSTGRES_SHARED_BUFFERS: "${POSTGRES_SHARED_BUFFERS:-256MB}"
      POSTGRES_EFFECTIVE_CACHE_SIZE: "${POSTGRES_EFFECTIVE_CACHE_SIZE:-1GB}"
      POSTGRES_MAX_CONNECTIONS: "${POSTGRES_MAX_CONNECTIONS:-100}"
    secrets:
      - db_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
      # PostgreSQL configuration for production
      - ./docker/postgres/postgresql.conf:/etc/postgresql/postgresql.conf:ro
      # Initialization scripts
      - ./docker/postgres/init:/docker-entrypoint-initdb.d:ro
    networks:
      - backend
    ports:
      # Only expose on localhost for admin access
      - "127.0.0.1:5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-agentgate} -d ${POSTGRES_DB:-agentgate}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /var/run/postgresql
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Redis - Distributed rate limiting and caching
  redis:
    image: redis:7-alpine
    container_name: agentgate-redis-prod
    restart: always
    command: >
      redis-server
      --appendonly yes
      --appendfsync everysec
      --maxmemory "${REDIS_MAX_MEMORY:-256mb}"
      --maxmemory-policy allkeys-lru
      --requirepass "${REDIS_PASSWORD:?REDIS_PASSWORD must be set}"
      --bind 0.0.0.0
      --protected-mode yes
    volumes:
      - redis_data:/data
      # Redis configuration
      - ./docker/redis/redis.conf:/usr/local/etc/redis/redis.conf:ro
    networks:
      - backend
    ports:
      # Only expose on localhost
      - "127.0.0.1:6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 5s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # FastAPI Backend - Production deployment
  server:
    build:
      context: .
      dockerfile: Dockerfile.server
      args:
        - BUILD_DATE=${BUILD_DATE:-$(date -u +'%Y-%m-%dT%H:%M:%SZ')}
        - VCS_REF=${VCS_REF:-$(git rev-parse --short HEAD)}
        - VERSION=${VERSION:-0.4.0}
      target: production
    image: agentgate-server:${VERSION:-latest}
    restart: always
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-agentgate}:${POSTGRES_PASSWORD}@db/${POSTGRES_DB:-agentgate}"
      SECRET_KEY_FILE: /run/secrets/api_secret_key
      NEXTAUTH_SECRET_FILE: /run/secrets/nextauth_secret
      AGENTGATE_ENV: production
      ALLOWED_ORIGINS: "${ALLOWED_ORIGINS:?ALLOWED_ORIGINS must be set}"
      REDIS_URL: "redis://:${REDIS_PASSWORD}@redis:6379/0"
      WORKERS: "${UVICORN_WORKERS:-4}"
      LOG_LEVEL: "${LOG_LEVEL:-info}"
      LOG_FORMAT: json
      ENABLE_METRICS: "${ENABLE_METRICS:-true}"
      METRICS_PORT: 9090

      # Security headers
      ENABLE_CORS: "true"
      ENABLE_CSRF: "true"

      # Rate limiting
      ENABLE_RATE_LIMITING: "true"
      AGENTGATE_STATE_DIR: /app/state

    secrets:
      - api_secret_key
      - nextauth_secret
      - db_password
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - backend
      - frontend
    ports:
      - "8000:8000"
      # Metrics endpoint (internal only)
      - "127.0.0.1:9090:9090"
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health').read()"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3
    deploy:
      replicas: ${SERVER_REPLICAS:-2}
      resources:
        limits:
          cpus: '4.0'
          memory: 2G
        reservations:
          cpus: '1.0'
          memory: 512M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /app/.cache
    volumes:
      - server_state:/app/state
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"

  # Next.js Dashboard - Production deployment
  dashboard:
    build:
      context: ./dashboard
      dockerfile: Dockerfile
      args:
        - NODE_ENV=production
        - BUILD_DATE=${BUILD_DATE:-$(date -u +'%Y-%m-%dT%H:%M:%SZ')}
        - VERSION=${VERSION:-0.4.0}
      target: runner
    image: agentgate-dashboard:${VERSION:-latest}
    restart: always
    environment:
      NODE_ENV: production
      NEXT_TELEMETRY_DISABLED: 1

      NEXTAUTH_URL: "${NEXTAUTH_URL:?NEXTAUTH_URL must be set}"
      NEXTAUTH_SECRET_FILE: /run/secrets/nextauth_secret
      API_URL: "http://server:8000"
      NEXT_PUBLIC_API_URL: "${NEXT_PUBLIC_API_URL:?NEXT_PUBLIC_API_URL must be set}"

      # Performance
      PORT: 3000
      HOSTNAME: "0.0.0.0"
    secrets:
      - nextauth_secret
    depends_on:
      server:
        condition: service_healthy
    networks:
      - frontend
    ports:
      - "3000:3000"
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/', (r) => {if(r.statusCode !== 200) throw new Error(r.statusCode)})"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3
    deploy:
      replicas: ${DASHBOARD_REPLICAS:-2}
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 256M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /app/.next/cache
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"

  # Nginx Reverse Proxy - SSL termination and load balancing
  nginx:
    image: nginx:1.25-alpine
    container_name: agentgate-nginx-prod
    restart: always
    volumes:
      - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./docker/nginx/conf.d:/etc/nginx/conf.d:ro
      - ./docker/nginx/ssl:/etc/nginx/ssl:ro
      - nginx_cache:/var/cache/nginx
      - nginx_logs:/var/log/nginx
    networks:
      - frontend
    ports:
      - "80:80"
      - "443:443"
    depends_on:
      - server
      - dashboard
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:80/"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    security_opt:
      - no-new-privileges:true
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "10"

networks:
  frontend:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16
  backend:
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.21.0.0/16

volumes:
  postgres_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${POSTGRES_DATA_PATH:-./data/postgres}
  redis_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${REDIS_DATA_PATH:-./data/redis}
  nginx_cache:
    driver: local
  nginx_logs:
    driver: local
  server_state:
    driver: local

secrets:
  db_password:
    file: ${POSTGRES_PASSWORD_FILE:-./secrets/db_password.txt}
  api_secret_key:
    file: ${API_SECRET_KEY_FILE:-./secrets/api_secret_key.txt}
  nextauth_secret:
    file: ${NEXTAUTH_SECRET_FILE:-./secrets/nextauth_secret.txt}