docker-compose.yml

name: boilerplate-saas

networks:
  boilerplate-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16
          gateway: 172.20.0.1

secrets:
  postgres_password:
    file: ./secrets/postgres_password.txt
  better_auth_secret:
    file: ./secrets/better_auth_secret.txt
  grafana_admin_password:
    file: ./secrets/grafana_admin_password.txt
  grafana_secret_key:
    file: ./secrets/grafana_secret_key.txt
  google_ai_api_key:
    file: ./secrets/google_ai_api_key.txt
  polar_access_token:
    file: ./secrets/polar_access_token.txt
  backup_encryption_key:
    file: ./secrets/backup_encryption_key.txt

services:
  # PostgreSQL Database with Multi-Tenant Optimizations
  postgres:
    image: postgres:16-alpine
    container_name: boilerplate-postgres
    environment:
      POSTGRES_DB: boilerplate
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      # Multi-tenancy optimizations for 10,000+ concurrent tenants
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=en_US.UTF-8 --lc-ctype=en_US.UTF-8"
    secrets:
      - postgres_password
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      - boilerplate_postgres_data:/var/lib/postgresql/data
      - ./apps/server/init-db:/docker-entrypoint-initdb.d
    networks:
      - boilerplate-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 4G
        reservations:
          cpus: '1.0'
          memory: 2G
    command:
      - "postgres"
      # Multi-tenancy performance optimizations for sub-100ms queries
      - "-c"
      - "max_connections=2000"
      - "-c"
      - "shared_buffers=1GB"
      - "-c"
      - "effective_cache_size=3GB"
      - "-c"
      - "maintenance_work_mem=256MB"
      - "-c"
      - "checkpoint_completion_target=0.9"
      - "-c"
      - "wal_buffers=64MB"
      - "-c"
      - "default_statistics_target=500"
      - "-c"
      - "random_page_cost=1.1"
      - "-c"
      - "effective_io_concurrency=200"
      - "-c"
      - "work_mem=16MB"
      - "-c"
      - "min_wal_size=1GB"
      - "-c"
      - "max_wal_size=4GB"
      - "-c"
      - "max_worker_processes=8"
      - "-c"
      - "max_parallel_workers_per_gather=4"
      - "-c"
      - "max_parallel_workers=8"
      - "-c"
      - "max_parallel_maintenance_workers=4"
      # SOC2 compliance - comprehensive audit logging
      - "-c"
      - "log_statement=all"
      - "-c"
      - "log_min_duration_statement=1000"
      - "-c"
      - "log_connections=on"
      - "-c"
      - "log_disconnections=on"
      - "-c"
      - "log_lock_waits=on"
      - "-c"
      - "log_temp_files=0"
      - "-c"
      - "log_autovacuum_min_duration=0"
      # Security and SSL configuration
      - "-c"
      - "ssl=on"
      - "-c"
      - "ssl_cert_file=/var/lib/postgresql/server.crt"
      - "-c"
      - "ssl_key_file=/var/lib/postgresql/server.key"

  # PgBouncer for connection pooling - optimized for 10,000+ tenants
  pgbouncer:
    image: pgbouncer/pgbouncer:1.22
    container_name: boilerplate-pgbouncer
    environment:
      DATABASES_HOST: postgres
      DATABASES_PORT: 5432
      DATABASES_USER: postgres
      DATABASES_PASSWORD_FILE: /run/secrets/postgres_password
      DATABASES_DB: boilerplate
      PGBOUNCER_POOL_MODE: transaction
      PGBOUNCER_MAX_CLIENT_CONN: 2000
      PGBOUNCER_DEFAULT_POOL_SIZE: 50
      PGBOUNCER_MIN_POOL_SIZE: 10
      PGBOUNCER_RESERVE_POOL_SIZE: 10
      PGBOUNCER_RESERVE_POOL_TIMEOUT: 5
      PGBOUNCER_MAX_DB_CONNECTIONS: 200
      PGBOUNCER_SERVER_IDLE_TIMEOUT: 600
      PGBOUNCER_SERVER_LIFETIME: 3600
      PGBOUNCER_SERVER_CONNECT_TIMEOUT: 15
      PGBOUNCER_SERVER_LOGIN_RETRY: 3
    secrets:
      - postgres_password
    ports:
      - "127.0.0.1:6432:6432"
    networks:
      - boilerplate-network
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h localhost -p 6432 -U postgres"]
      interval: 15s
      timeout: 5s
      retries: 3
    restart: unless-stopped
    volumes:
      - ./apps/server/pgbouncer:/etc/pgbouncer
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  # Redis for caching and session management - optimized for multi-tenancy
  redis:
    image: redis:7-alpine
    container_name: boilerplate-redis
    command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru --save 60 1000
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - boilerplate_redis_data:/data
    networks:
      - boilerplate-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  # Backend API Service (Node.js + tRPC + Prisma)
  backend:
    build:
      context: ./apps/server
      dockerfile: Dockerfile
    container_name: boilerplate-backend
    env_file:
      - .env
    environment:
      # Core application settings
      - NODE_ENV=${NODE_ENV:-production}
      - PORT=${PORT:-3000}
      - ENVIRONMENT=${ENVIRONMENT:-production}

      # Database configuration
      - DATABASE_URL=${DATABASE_URL:-postgresql://postgres:postgres@pgbouncer:6432/boilerplate?schema=public&connection_limit=50&pool_timeout=20&pgbouncer=true&connect_timeout=15}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379}

      # Domain and CORS configuration
      - CORS_ORIGIN=${CORS_ORIGIN:-https://localhost}
      - BETTER_AUTH_URL=${BETTER_AUTH_URL:-https://localhost:3000}
      - POLAR_SUCCESS_URL=${POLAR_SUCCESS_URL:-https://localhost/success}

      # Security secrets (loaded from Docker secrets)
      - BETTER_AUTH_SECRET_FILE=/run/secrets/better_auth_secret
      - GOOGLE_GENERATIVE_AI_API_KEY_FILE=/run/secrets/google_ai_api_key
      - POLAR_ACCESS_TOKEN_FILE=/run/secrets/polar_access_token

      # Performance monitoring
      - PROMETHEUS_URL=${PROMETHEUS_URL:-http://prometheus:9090}
      - GRAFANA_URL=${GRAFANA_URL:-http://grafana:3000}

      # Multi-tenancy configuration
      - MAX_TENANTS_PER_CONNECTION=${MAX_TENANTS_PER_CONNECTION:-100}
      - TENANT_ISOLATION_ENABLED=${TENANT_ISOLATION_ENABLED:-true}
      - CROSS_TENANT_QUERIES_ENABLED=${CROSS_TENANT_QUERIES_ENABLED:-false}

      # Performance optimization
      - DATABASE_POOL_MIN=${DATABASE_POOL_MIN:-10}
      - DATABASE_POOL_MAX=${DATABASE_POOL_MAX:-50}
      - DATABASE_POOL_TIMEOUT=${DATABASE_POOL_TIMEOUT:-20}
      - DATABASE_POOL_IDLE_TIMEOUT=${DATABASE_POOL_IDLE_TIMEOUT:-300}

      # Caching configuration
      - CACHE_ENABLED=${CACHE_ENABLED:-true}
      - CACHE_TTL=${CACHE_TTL:-3600}
      - CACHE_MAX_SIZE=${CACHE_MAX_SIZE:-1GB}

      # Security configuration
      - SESSION_COOKIE_SECURE=${SESSION_COOKIE_SECURE:-true}
      - SESSION_COOKIE_SAME_SITE=${SESSION_COOKIE_SAME_SITE:-strict}
      - RATE_LIMIT_WINDOW_MS=${RATE_LIMIT_WINDOW_MS:-900000}
      - RATE_LIMIT_MAX_REQUESTS=${RATE_LIMIT_MAX_REQUESTS:-1000}

      # Audit and compliance
      - ENABLE_AUDIT_LOGGING=${ENABLE_AUDIT_LOGGING:-true}
      - AUDIT_LOG_RETENTION_DAYS=${AUDIT_LOG_RETENTION_DAYS:-2555}
      - SOC2_COMPLIANCE_ENABLED=${SOC2_COMPLIANCE_ENABLED:-true}

      # Feature flags
      - FEATURE_TENANT_ANALYTICS=${FEATURE_TENANT_ANALYTICS:-true}
      - FEATURE_ADVANCED_REPORTING=${FEATURE_ADVANCED_REPORTING:-true}
      - FEATURE_API_RATE_LIMITING=${FEATURE_API_RATE_LIMITING:-true}
      - FEATURE_AUDIT_LOGGING=${FEATURE_AUDIT_LOGGING:-true}
      - FEATURE_MULTI_TENANCY=${FEATURE_MULTI_TENANCY:-true}
      - FEATURE_PERFORMANCE_OPTIMIZATION=${FEATURE_PERFORMANCE_OPTIMIZATION:-true}
    secrets:
      - better_auth_secret
      - google_ai_api_key
      - polar_access_token
    ports:
      - "127.0.0.1:3000:3000"
    networks:
      - boilerplate-network
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/health', (res) => { process.exit(res.statusCode === 200 ? 0 : 1) })"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M

  # Frontend Service (React + Vite + Nginx)
  frontend:
    build:
      context: ./apps/web
      dockerfile: Dockerfile
    container_name: boilerplate-frontend
    env_file:
      - .env
    environment:
      # Core application settings
      - NODE_ENV=${NODE_ENV:-production}
      - ENVIRONMENT=${ENVIRONMENT:-production}

      # API configuration
      - VITE_SERVER_URL=${VITE_SERVER_URL:-http://backend:3000/api/trpc}
      - VITE_API_TIMEOUT=${API_TIMEOUT:-10000}
      - VITE_MAX_RETRIES=${API_MAX_RETRIES:-3}
      - VITE_RETRY_DELAY=${API_RETRY_DELAY:-1000}

      # Application metadata
      - VITE_APP_NAME=${VITE_APP_NAME:-Boilerplate SaaS}
      - VITE_APP_VERSION=${VITE_APP_VERSION:-1.0.0}

      # Feature flags
      - VITE_ENABLE_ANALYTICS=${ENABLE_ANALYTICS:-true}
      - VITE_ENABLE_ERROR_REPORTING=${ENABLE_ERROR_REPORTING:-true}
      - VITE_ENABLE_PERFORMANCE_MONITORING=${ENABLE_PERFORMANCE_MONITORING:-true}

      # Security settings
      - VITE_HSTS_ENABLED=${HSTS_ENABLED:-true}
      - VITE_CSP_ENABLED=${CSP_ENABLED:-true}

      # Development settings
      - VITE_DEV_TOOLS_ENABLED=${DEV_TOOLS_ENABLED:-false}
      - VITE_DEBUG=${DEBUG:-false}
    ports:
      - "127.0.0.1:3001:80"
    networks:
      - boilerplate-network
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  # Prometheus for metrics collection
  prometheus:
    image: prom/prometheus:latest
    container_name: boilerplate-prometheus
    ports:
      - "127.0.0.1:9090:9090"
    networks:
      - boilerplate-network
    volumes:
      - ./apps/server/monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=200h'
      - '--web.enable-lifecycle'
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  # Grafana for visualization and alerting
  grafana:
    image: grafana/grafana:latest
    container_name: boilerplate-grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD_FILE=/run/secrets/grafana_admin_password
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_INSTALL_PLUGINS=grafana-postgresql-datasource
      - GF_SERVER_HTTP_PORT=3000
    secrets:
      - grafana_admin_password
    ports:
      - "127.0.0.1:3002:3000"
    networks:
      - boilerplate-network
    volumes:
      - grafana_data:/var/lib/grafana
      - ./apps/server/monitoring/grafana/provisioning:/etc/grafana/provisioning
      - ./apps/server/monitoring/grafana/dashboards:/var/lib/grafana/dashboards
    depends_on:
      - prometheus
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  # PostgreSQL Exporter for Prometheus metrics
  postgres-exporter:
    image: prometheuscommunity/postgres-exporter:latest
    container_name: boilerplate-postgres-exporter
    environment:
      - DATA_SOURCE_NAME=postgresql://postgres:postgres@postgres:5432/boilerplate?sslmode=disable
    ports:
      - "127.0.0.1:9187:9187"
    networks:
      - boilerplate-network
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 128M

  # Automated backup service
  backup:
    image: postgres:16-alpine
    container_name: boilerplate-backup
    environment:
      - POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
      - BACKUP_RETENTION_DAYS=30
      - BACKUP_SCHEDULE=0 2 * * *
    secrets:
      - postgres_password
    volumes:
      - boilerplate_postgres_data:/backup/data:ro
      - ./apps/server/backup:/backup/scripts
      - backup_archives:/backup/archives
    networks:
      - boilerplate-network
    depends_on:
      postgres:
        condition: service_healthy
    command: |
      sh -c "
        apk add --no-cache cron dcron &&
        echo '$$BACKUP_SCHEDULE /backup/scripts/backup.sh' > /etc/crontabs/root &&
        chmod +x /backup/scripts/backup.sh &&
        crond -f -d 8
      "
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  # Log aggregation service (Optional - for production)
  loki:
    image: grafana/loki:latest
    container_name: boilerplate-loki
    ports:
      - "127.0.0.1:3100:3100"
    networks:
      - boilerplate-network
    volumes:
      - loki_data:/loki
    command: -config.file=/etc/loki/local-config.yaml
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  # Promtail for log shipping to Loki (Optional - for production)
  promtail:
    image: grafana/promtail:latest
    container_name: boilerplate-promtail
    networks:
      - boilerplate-network
    volumes:
      - ./monitoring/promtail-config.yml:/etc/promtail/config.yml
      - /var/log:/var/log
    command: -config.file=/etc/promtail/config.yml
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 128M

volumes:
  boilerplate_postgres_data:
    driver: local
  boilerplate_redis_data:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  backup_archives:
    driver: local
  loki_data:
    driver: local