docker-compose.production.yml

# Security defaults applied to all services
x-security-opts: &security-opts
  security_opt:
    - no-new-privileges:true
  read_only: true
  tmpfs:
    - /tmp
    - /var/tmp
  cap_drop:
    - ALL
  cap_add:
    - NET_BIND_SERVICE

# Common environment variables
x-otel-environment: &otel-environment
  OTEL_SERVICE_NAME: vcf-agent
  OTEL_ENVIRONMENT: ${ENVIRONMENT:-production}
  OTEL_RESOURCE_ATTRIBUTES: service.name=vcf-agent,service.version=${VERSION:-latest},deployment.environment=${ENVIRONMENT:-production}
  OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4317
  OTEL_EXPORTER_OTLP_PROTOCOL: grpc
  OTEL_TRACES_SAMPLER: parentbased_traceidratio
  OTEL_TRACES_SAMPLER_ARG: ${OTEL_SAMPLING_RATE:-0.1}

services:
  # Main VCF Agent Application
  vcf-agent:
    image: vcf-agent:${VERSION:-latest}
    build:
      context: .
      dockerfile: docker/Dockerfile.production
      target: production
      args:
        PYTHON_VERSION: 3.11
    <<: *security-opts
    environment:
      <<: *otel-environment
      # Application configuration
      VCF_AGENT_LOG_LEVEL: ${LOG_LEVEL:-INFO}
      VCF_AGENT_PORT: 8080
      # Database configuration
      LANCEDB_PATH: /app/data/lancedb
      # AI provider configuration (secrets loaded from external files)
      OPENAI_API_KEY_FILE: /run/secrets/openai_api_key
      ANTHROPIC_API_KEY_FILE: /run/secrets/anthropic_api_key
    ports:
      - "8080:8080"
    volumes:
      - vcf_data:/app/data
      - vcf_logs:/app/logs:rw
    networks:
      - app-network
      - observability
    secrets:
      - openai_api_key
      - anthropic_api_key
      - otel_credentials
    depends_on:
      otel-collector:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: '1.0'
        reservations:
          memory: 1G
          cpus: '0.5'

  # OpenTelemetry Collector
  otel-collector:
    image: otel/opentelemetry-collector-contrib:${OTEL_COLLECTOR_VERSION:-latest}
    command: ["--config=/etc/otel/config.yaml"]
    environment:
      - ENVIRONMENT=${ENVIRONMENT:-production}
      - JAEGER_ENDPOINT=${JAEGER_ENDPOINT:-http://jaeger:14268/api/traces}
      - PROMETHEUS_ENDPOINT=${PROMETHEUS_ENDPOINT:-http://prometheus:9090/api/v1/write}
    volumes:
      - ./config/otel:/etc/otel:ro
    networks:
      - observability
    ports:
      - "4317:4317"   # OTLP gRPC receiver
      - "4318:4318"   # OTLP HTTP receiver
      - "8888:8888"   # Prometheus metrics
    depends_on:
      - jaeger
      - prometheus
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:13133/"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '0.5'

  # Jaeger for distributed tracing
  jaeger:
    image: jaegertracing/all-in-one:${JAEGER_VERSION:-latest}
    environment:
      - COLLECTOR_OTLP_ENABLED=true
      - COLLECTOR_OTLP_GRPC_HOST_PORT=0.0.0.0:14250
      - COLLECTOR_OTLP_HTTP_HOST_PORT=0.0.0.0:14268
    ports:
      - "16686:16686"  # Jaeger UI
      - "14250:14250"  # OTLP gRPC
      - "14268:14268"  # OTLP HTTP
    networks:
      - observability
    volumes:
      - jaeger_data:/badger
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:16686/"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  # Prometheus for metrics collection
  prometheus:
    image: prom/prometheus:${PROMETHEUS_VERSION:-latest}
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--web.enable-lifecycle'
      - '--web.enable-admin-api'
      - '--storage.tsdb.retention.time=30d'
    ports:
      - "9090:9090"
    volumes:
      - ./config/prometheus:/etc/prometheus:ro
      - prometheus_data:/prometheus
    networks:
      - observability
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9090/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  # Grafana for visualization
  grafana:
    image: grafana/grafana:${GRAFANA_VERSION:-latest}
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SECURITY_ALLOW_EMBEDDING=true
      - GF_AUTH_ANONYMOUS_ENABLED=false
      - GF_INSTALL_PLUGINS=grafana-piechart-panel
    ports:
      - "3000:3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./config/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./config/grafana/datasources:/etc/grafana/provisioning/datasources:ro
    networks:
      - observability
    depends_on:
      - prometheus
      - jaeger
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

# Networks
networks:
  app-network:
    driver: bridge
    internal: false
  observability:
    driver: bridge
    internal: false

# Volumes
volumes:
  vcf_data:
    driver: local
  vcf_logs:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  jaeger_data:
    driver: local

# Secrets (in production, these should be managed by orchestrator)
secrets:
  openai_api_key:
    file: ${OPENAI_API_KEY_FILE:-./secrets/openai_api_key.txt}
  anthropic_api_key:
    file: ${ANTHROPIC_API_KEY_FILE:-./secrets/anthropic_api_key.txt}
  otel_credentials:
    file: ${OTEL_CREDENTIALS_FILE:-./secrets/otel_credentials.txt}