docker-compose.production.yml

version: '3.8'

services:
  # PostgreSQL Database
  db:
    image: postgres:15-alpine
    container_name: notevault-postgres
    environment:
      POSTGRES_DB: notevault
      POSTGRES_USER: notevault
      POSTGRES_PASSWORD: ${DB_PASSWORD:-secure_db_password}
      POSTGRES_INITDB_ARGS: "--auth-host=scram-sha-256 --auth-local=scram-sha-256"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./docker/postgres/init:/docker-entrypoint-initdb.d
    ports:
      - "5432:5432"
    networks:
      - notevault-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U notevault -d notevault"]
      interval: 10s
      timeout: 5s
      retries: 5
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Redis for session storage and caching
  redis:
    image: redis:7-alpine
    container_name: notevault-redis
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-secure_redis_password}
    volumes:
      - redis_data:/data
      - ./docker/redis/redis.conf:/usr/local/etc/redis/redis.conf:ro
    ports:
      - "6379:6379"
    networks:
      - notevault-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Backend API Server
  backend:
    build:
      context: ./server
      dockerfile: Dockerfile.production
      args:
        NODE_ENV: production
    container_name: notevault-backend
    environment:
      NODE_ENV: production
      PORT: 3001
      DATABASE_URL: postgresql://notevault:${DB_PASSWORD:-secure_db_password}@db:5432/notevault
      REDIS_URL: redis://:${REDIS_PASSWORD:-secure_redis_password}@redis:6379
      JWT_SECRET: ${JWT_SECRET:-your-super-secret-jwt-key-change-this-in-production-min-256-bits}
      SESSION_SECRET: ${SESSION_SECRET:-another-super-secret-key-for-sessions-change-this-too}
      CSRF_SECRET: ${CSRF_SECRET:-csrf-secret-key-change-this-in-production}
      CORS_ORIGIN: ${FRONTEND_URL:-http://localhost:3000}
      BASE_URL: ${BACKEND_URL:-http://localhost:3001}
      
      # Email configuration
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_SECURE: ${SMTP_SECURE:-false}
      SMTP_USER: ${SMTP_USER}
      SMTP_PASS: ${SMTP_PASS}
      FROM_EMAIL: ${FROM_EMAIL}
      FROM_NAME: ${FROM_NAME:-NoteVault}
      
      # Cloud storage
      STORAGE_TYPE: ${STORAGE_TYPE:-local}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      AWS_REGION: ${AWS_REGION:-us-east-1}
      AWS_S3_BUCKET: ${AWS_S3_BUCKET}
      
      # OAuth providers
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET}
      DISCORD_CLIENT_ID: ${DISCORD_CLIENT_ID}
      DISCORD_CLIENT_SECRET: ${DISCORD_CLIENT_SECRET}
      
      # Integration APIs
      SLACK_BOT_TOKEN: ${SLACK_BOT_TOKEN}
      SLACK_SIGNING_SECRET: ${SLACK_SIGNING_SECRET}
      SLACK_WEBHOOK_URL: ${SLACK_WEBHOOK_URL}
      DISCORD_BOT_TOKEN: ${DISCORD_BOT_TOKEN}
      DISCORD_WEBHOOK_URL: ${DISCORD_WEBHOOK_URL}
      
      # Calendar Integration
      GOOGLE_CALENDAR_ENABLED: ${GOOGLE_CALENDAR_ENABLED:-false}
      OUTLOOK_CLIENT_ID: ${OUTLOOK_CLIENT_ID}
      OUTLOOK_CLIENT_SECRET: ${OUTLOOK_CLIENT_SECRET}
      
      # Cloud Sync
      GOOGLE_DRIVE_ENABLED: ${GOOGLE_DRIVE_ENABLED:-false}
      DROPBOX_CLIENT_ID: ${DROPBOX_CLIENT_ID}
      DROPBOX_CLIENT_SECRET: ${DROPBOX_CLIENT_SECRET}
      
      # Git Integration
      GITHUB_INTEGRATION_ENABLED: ${GITHUB_INTEGRATION_ENABLED:-false}
      GITHUB_WEBHOOK_SECRET: ${GITHUB_WEBHOOK_SECRET}
      GITLAB_CLIENT_ID: ${GITLAB_CLIENT_ID}
      GITLAB_CLIENT_SECRET: ${GITLAB_CLIENT_SECRET}
      
      # Webhooks
      WEBHOOKS_ENABLED: ${WEBHOOKS_ENABLED:-true}
      
      # Monitoring and backups
      BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-30}
      GDPR_EXPORT_PATH: /app/exports
      BACKUP_PATH: /app/backups
      SENTRY_DSN: ${SENTRY_DSN}
      PROMETHEUS_ENABLED: ${PROMETHEUS_ENABLED:-true}
    volumes:
      - backend_uploads:/app/uploads
      - backend_backups:/app/backups
      - backend_exports:/app/exports
      - backend_logs:/app/logs
    ports:
      - "3001:3001"
    networks:
      - notevault-network
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"

  # Frontend Application
  frontend:
    build:
      context: .
      dockerfile: Dockerfile.frontend
      args:
        VITE_API_URL: ${BACKEND_URL:-http://localhost:3001}/api
    container_name: notevault-frontend
    environment:
      NODE_ENV: production
    ports:
      - "3000:3000"
    networks:
      - notevault-network
    depends_on:
      - backend
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000"]
      interval: 30s
      timeout: 10s
      retries: 3
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Nginx Reverse Proxy
  nginx:
    image: nginx:alpine
    container_name: notevault-nginx
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - nginx_logs:/var/log/nginx
      - backend_uploads:/var/www/uploads:ro
    ports:
      - "80:80"
      - "443:443"
    networks:
      - notevault-network
    depends_on:
      - frontend
      - backend
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 30s
      timeout: 10s
      retries: 3
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"

  # Prometheus Monitoring
  prometheus:
    image: prom/prometheus:latest
    container_name: notevault-prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=200h'
      - '--web.enable-lifecycle'
    volumes:
      - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"
    networks:
      - notevault-network
    restart: unless-stopped
    profiles:
      - monitoring

  # Grafana Dashboard
  grafana:
    image: grafana/grafana:latest
    container_name: notevault-grafana
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-admin123}
      GF_USERS_ALLOW_SIGN_UP: false
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources:ro
    ports:
      - "3002:3000"
    networks:
      - notevault-network
    depends_on:
      - prometheus
    restart: unless-stopped
    profiles:
      - monitoring

  # Node Exporter for system metrics
  node-exporter:
    image: prom/node-exporter:latest
    container_name: notevault-node-exporter
    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    ports:
      - "9100:9100"
    networks:
      - notevault-network
    restart: unless-stopped
    profiles:
      - monitoring

  # cAdvisor for container metrics
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.47.0
    container_name: notevault-cadvisor
    privileged: true
    devices:
      - /dev/kmsg:/dev/kmsg
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
      - /cgroup:/cgroup:ro
    ports:
      - "8080:8080"
    networks:
      - notevault-network
    restart: unless-stopped
    profiles:
      - monitoring

  # Elasticsearch for logging
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    container_name: notevault-elasticsearch
    environment:
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - xpack.security.enabled=false
      - xpack.security.enrollment.enabled=false
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"
    networks:
      - notevault-network
    restart: unless-stopped
    profiles:
      - logging

  # Logstash for log processing
  logstash:
    image: docker.elastic.co/logstash/logstash:8.11.0
    container_name: notevault-logstash
    volumes:
      - ./docker/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
      - ./docker/logstash/pipeline:/usr/share/logstash/pipeline:ro
      - backend_logs:/logs:ro
      - nginx_logs:/nginx-logs:ro
    ports:
      - "5044:5044"
      - "5000:5000/tcp"
      - "5000:5000/udp"
      - "9600:9600"
    networks:
      - notevault-network
    depends_on:
      - elasticsearch
    restart: unless-stopped
    profiles:
      - logging

  # Kibana for log visualization
  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    container_name: notevault-kibana
    environment:
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200
    ports:
      - "5601:5601"
    networks:
      - notevault-network
    depends_on:
      - elasticsearch
    restart: unless-stopped
    profiles:
      - logging

  # Backup Service
  backup:
    build:
      context: ./docker/backup
      dockerfile: Dockerfile
    container_name: notevault-backup
    environment:
      BACKUP_SCHEDULE: ${BACKUP_SCHEDULE:-0 2 * * *}
      POSTGRES_HOST: db
      POSTGRES_DB: notevault
      POSTGRES_USER: notevault
      POSTGRES_PASSWORD: ${DB_PASSWORD:-secure_db_password}
      S3_BUCKET: ${BACKUP_S3_BUCKET}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      AWS_REGION: ${AWS_REGION:-us-east-1}
    volumes:
      - backend_backups:/backups
      - backend_uploads:/uploads:ro
      - postgres_data:/postgres-data:ro
    networks:
      - notevault-network
    depends_on:
      - db
      - backend
    restart: unless-stopped
    profiles:
      - backup

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  backend_uploads:
    driver: local
  backend_backups:
    driver: local
  backend_exports:
    driver: local
  backend_logs:
    driver: local
  nginx_logs:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  elasticsearch_data:
    driver: local

networks:
  notevault-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16