docker-compose.prod.yml

# Production Docker Compose configuration
# This extends docker-compose.yml with production-specific settings

version: '3.8'

services:
  llm-latency-lens:
    image: llm-devops/llm-latency-lens:latest
    restart: always

    # Production environment variables
    environment:
      - RUST_LOG=info
      - RUST_BACKTRACE=0
      - PROMETHEUS_HOST=0.0.0.0
      - PROMETHEUS_PORT=9090

    # Use secrets instead of environment variables for sensitive data
    secrets:
      - openai_api_key
      - anthropic_api_key
      - google_api_key

    # Security hardening
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

    # Read-only root filesystem
    read_only: true
    tmpfs:
      - /tmp:size=10M,mode=1777

    # Production resource limits
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 2G
          pids: 100
        reservations:
          cpus: '1'
          memory: 512M

      # Restart policy
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s

    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"
        compress: "true"

  prometheus:
    image: prom/prometheus:v2.48.0
    restart: always

    # Prometheus production configuration
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=90d'
      - '--storage.tsdb.retention.size=50GB'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
      - '--web.enable-lifecycle'

    # Security hardening
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

    # Production resource limits
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 4G
        reservations:
          cpus: '0.5'
          memory: 1G

    # Logging
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"
        compress: "true"

  grafana:
    image: grafana/grafana:10.2.2
    restart: always

    # Production Grafana configuration
    environment:
      - GF_SECURITY_ADMIN_USER=${GF_ADMIN_USER}
      - GF_SECURITY_ADMIN_PASSWORD=${GF_ADMIN_PASSWORD}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_AUTH_ANONYMOUS_ENABLED=false
      - GF_SERVER_ROOT_URL=${GF_ROOT_URL}
      - GF_SECURITY_COOKIE_SECURE=true
      - GF_SECURITY_STRICT_TRANSPORT_SECURITY=true
      - GF_LOG_MODE=console
      - GF_LOG_LEVEL=info

    # Security hardening
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

    # Production resource limits
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M

    # Logging
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"
        compress: "true"

  alertmanager:
    image: prom/alertmanager:v0.26.0
    restart: always

    # Security hardening
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

    # Production resource limits
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M

    # Logging
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"
        compress: "true"

  # Reverse proxy for TLS termination
  traefik:
    image: traefik:v2.10
    container_name: traefik
    restart: always

    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"

    ports:
      - "80:80"
      - "443:443"

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certs:/letsencrypt

    networks:
      - llm-monitoring

    security_opt:
      - no-new-privileges:true

    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"

networks:
  llm-monitoring:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16
    driver_opts:
      com.docker.network.bridge.name: llm-monitoring

volumes:
  prometheus-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /data/prometheus

  grafana-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /data/grafana

  alertmanager-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /data/alertmanager

  traefik-certs:
    driver: local

secrets:
  openai_api_key:
    external: true
  anthropic_api_key:
    external: true
  google_api_key:
    external: true