docker-compose.yml

networks:
  teachlink:
    driver: bridge

volumes:
  postgres-data:
  redis-data:
  elasticsearch-data:
  prometheus-data:
  alertmanager-data:
  grafana-data:
  kibana-data:

services:
  app:
    build:
      context: ../..
      dockerfile: Dockerfile
      target: production
    container_name: teachlink-app
    restart: unless-stopped
    ports:
      - '${APP_PORT:-3000}:3000'
    env_file:
      - ../../.env
    environment:
      DATABASE_HOST: postgres
      DATABASE_PORT: 5432
      REDIS_HOST: redis
      REDIS_PORT: 6379
      ELASTICSEARCH_NODE: http://elasticsearch:9200
      NODE_ENV: production
      JAEGER_AGENT_HOST: jaeger
      JAEGER_AGENT_PORT: 6831
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      jaeger:
        condition: service_started
    networks:
      - teachlink
    # ── Runtime security hardening ──────────────────────────────────────────
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /app/tmp:size=64m,mode=1777
      - /tmp:size=32m,mode=1777
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--tries=1', '--spider', 'http://localhost:3000/health']
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  # ─── Jaeger Tracing ─────────────────────────────────────────────────────────
  jaeger:
    image: jaegertracing/all-in-one:1.48
    container_name: teachlink-jaeger
    restart: unless-stopped
    ports:
      - '6831:6831/udp'
      - '16686:16686'
    networks:
      - teachlink
    environment:
      COLLECTOR_ZIPKIN_HTTP_PORT: 9411
    healthcheck:
      test: ['CMD-SHELL', 'curl -f http://localhost:16686/jaeger/api/v1/services || exit 1']
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 15s
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 128M
        reservations:
          cpus: '0.05'
          memory: 32M

  postgres:
    image: postgres:16-alpine
    container_name: teachlink-postgres
    restart: unless-stopped
    ports:
      - '${DATABASE_PORT:-5432}:5432'
    environment:
      POSTGRES_USER: ${DATABASE_USER:-postgres}
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-postgres}
      POSTGRES_DB: ${DATABASE_NAME:-teachlink}
      PGDATA: /var/lib/postgresql/data/pgdata
    networks:
      - teachlink
    volumes:
      - postgres-data:/var/lib/postgresql/data
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - FOWNER
      - SETUID
      - SETGID
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${DATABASE_USER:-postgres} -d ${DATABASE_NAME:-teachlink}']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  redis:
    image: redis:7-alpine
    container_name: teachlink-redis
    restart: unless-stopped
    ports:
      - '${REDIS_PORT:-6379}:6379'
    command: >
      redis-server
      --appendonly yes
      --appendfsync everysec
      --maxmemory 256mb
      --maxmemory-policy allkeys-lru
    networks:
      - teachlink
    volumes:
      - redis-data:/data
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s

  elasticsearch:
    image: elasticsearch:8.13.4
    container_name: teachlink-elasticsearch
    restart: unless-stopped
    ports:
      - '9200:9200'
    environment:
      discovery.type: single-node
      xpack.security.enabled: 'false'
      ES_JAVA_OPTS: '-Xms512m -Xmx512m'
      cluster.name: teachlink-cluster
    networks:
      - teachlink
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 512M
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'curl -s http://localhost:9200/_cluster/health | grep -qv "\"status\":\"red\""',
        ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  prometheus:
    image: prom/prometheus:latest
    container_name: teachlink-prometheus
    restart: unless-stopped
    ports:
      - '9090:9090'
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.retention.time=15d
      - --web.enable-lifecycle
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    networks:
      - teachlink
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./alerts.yml:/etc/prometheus/alerts.yml:ro
      - prometheus-data:/prometheus
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--tries=1', '--spider', 'http://localhost:9090/-/healthy']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  alertmanager:
    image: prom/alertmanager:latest
    container_name: teachlink-alertmanager
    restart: unless-stopped
    ports:
      - '9093:9093'
    command:
      - --config.file=/etc/alertmanager/alertmanager.yml
      - --storage.path=/alertmanager
    networks:
      - teachlink
    volumes:
      - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - alertmanager-data:/alertmanager
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 128M
        reservations:
          cpus: '0.05'
          memory: 32M
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--tries=1', '--spider', 'http://localhost:9093/-/healthy']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  grafana:
    image: grafana/grafana:latest
    container_name: teachlink-grafana
    restart: unless-stopped
    ports:
      - '3001:3000'
    environment:
      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admin}
      - GF_USERS_ALLOW_SIGN_UP=false
    networks:
      - teachlink
    volumes:
      - grafana-data:/var/lib/grafana
      - ./provisioning:/etc/grafana/provisioning:ro
    depends_on:
      prometheus:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--tries=1', '--spider', 'http://localhost:3000/api/health']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  redis_exporter:
    image: oliver006/redis_exporter:latest
    container_name: teachlink-redis-exporter
    restart: unless-stopped
    ports:
      - '9121:9121'
    environment:
      REDIS_ADDR: 'redis://redis:6379'
    networks:
      - teachlink
    depends_on:
      redis:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          cpus: '0.1'
          memory: 64M

  postgres_exporter:
    image: prometheuscommunity/postgres-exporter:latest
    container_name: teachlink-postgres-exporter
    restart: unless-stopped
    ports:
      - '9187:9187'
    environment:
      DATA_SOURCE_NAME: 'postgresql://${DATABASE_USER:-postgres}:${DATABASE_PASSWORD:-postgres}@postgres:5432/${DATABASE_NAME:-teachlink}?sslmode=disable'
    networks:
      - teachlink
    depends_on:
      postgres:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          cpus: '0.1'
          memory: 64M

  # ─── Log Search UI ──────────────────────────────────────────────────────────
  kibana:
    image: kibana:${KIBANA_VERSION:-8.13.4}
    container_name: teachlink-kibana
    restart: unless-stopped
    ports:
      - '${KIBANA_PORT:-5601}:5601'
    environment:
      ELASTICSEARCH_HOSTS: 'http://elasticsearch:9200'
      TELEMETRY_ENABLED: 'false'
      SERVER_NAME: 'teachlink-kibana'
    networks:
      - teachlink
    volumes:
      - kibana-data:/usr/share/kibana/data
    depends_on:
      elasticsearch:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.1'
          memory: 128M
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'curl -s http://localhost:5601/api/status | grep -q "\"overall\":{\"level\":\"available\""',
        ]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 120s

  # ─── Log Shipper (container stdout → Elasticsearch) ─────────────────────────
  filebeat:
    image: elastic/filebeat:${FILEBEAT_VERSION:-8.13.4}
    container_name: teachlink-filebeat
    restart: unless-stopped
    user: root
    networks:
      - teachlink
    volumes:
      - ../../logging/shipper/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on:
      elasticsearch:
        condition: service_healthy
    environment:
      ELASTICSEARCH_NODE: 'http://elasticsearch:9200'
      ELASTICSEARCH_USERNAME: '${ELASTICSEARCH_USERNAME:-}'
      ELASTICSEARCH_PASSWORD: '${ELASTICSEARCH_PASSWORD:-}'
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - DAC_READ_SEARCH
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 128M
        reservations:
          cpus: '0.05'
          memory: 32M