docker-compose.prod.yml

###############################################################
# docker-compose.prod.yml — Production hardening overlay
#
# Usage: docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
#
# Changes from dev compose:
#   - Removes all exposed ports (except gateway:8222 and grafana:3000)
#   - Adds resource limits per container type
#   - Adds log rotation (json-file, max 10m, 3 files)
#   - Sets restart: unless-stopped for all services
#   - Adds read_only + tmpfs for stateless app containers
#   - Removes MailHog (use real SMTP in prod)
#   - Fails fast on missing secrets: every sensitive env var is overridden with the
#     ${VAR:?message} form, so `config`/`up` refuse to run unless a real value is set.
#     Dev (base compose) keeps the ${VAR:-default} fallbacks and is unaffected.
#     Required vars are listed in .env.example. Verify with:
#       pwsh scripts/verify-prod-secrets-failfast.ps1
###############################################################

services:

  # ============================================================
  # INFRASTRUCTURE — secrets, messaging, cache, databases
  # ============================================================

  vault:
    environment:
      # Fail-fast: no committed dev token in production
      VAULT_DEV_ROOT_TOKEN_ID: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []        # remove 8200 exposure in prod
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512m
          cpus: "0.5"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  kafka:
    ports: !reset []        # remove 9092 exposure; services use kafka:29092 on infra-net
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2g
          cpus: "2.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  redis:
    ports: !reset []        # remove 6379 exposure
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512m
          cpus: "0.5"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  postgres-order:
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2g
          cpus: "2.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  postgres-product:
    environment:
      POSTGRES_USER: ${POSTGRES_USERNAME:?POSTGRES_USERNAME must be set in production}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in production}
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2g
          cpus: "2.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  postgres-payment:
    environment:
      POSTGRES_USER: ${POSTGRES_USERNAME:?POSTGRES_USERNAME must be set in production}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in production}
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2g
          cpus: "2.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  postgres-auth:
    environment:
      POSTGRES_USER: ${POSTGRES_USERNAME:?POSTGRES_USERNAME must be set in production}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in production}
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2g
          cpus: "2.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  postgres-tenant:
    environment:
      POSTGRES_USER: ${POSTGRES_USERNAME:?POSTGRES_USERNAME must be set in production}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in production}
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2g
          cpus: "2.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  mongodb:
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_USERNAME:?MONGO_USERNAME must be set in production}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD:?MONGO_PASSWORD must be set in production}
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2g
          cpus: "2.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  # ============================================================
  # OBSERVABILITY
  # ============================================================

  zipkin:
    ports: !reset []        # remove 9411 — access through monitoring-net only
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512m
          cpus: "0.5"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  prometheus:
    ports: !reset []        # internal only in prod
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  alertmanager:
    ports: !reset []
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 256m
          cpus: "0.25"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  loki:
    ports: !reset []
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512m
          cpus: "0.5"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  promtail:
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 256m
          cpus: "0.25"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  grafana:
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:?GRAFANA_PASSWORD must be set in production}
    # Keep :3000 for dashboards — accessible only through VPN/firewall rule in prod
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512m
          cpus: "0.5"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  # MailHog removed in production — use real SMTP (set MAIL_HOST, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD)
  mailhog:
    deploy:
      replicas: 0

  # ============================================================
  # SPRING CLOUD INFRASTRUCTURE
  # ============================================================

  config-service:
    environment:
      CONFIG_SERVER_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []        # internal only — services access via service name
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  discovery-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    healthcheck:
      # Override base healthcheck: base hardcodes eureka-secret-2024 in the URL, which
      # breaks in prod with a real EUREKA_PASSWORD. Interpolate the real creds instead.
      test: [ "CMD-SHELL", "wget -qO- 'http://${EUREKA_USERNAME:-eureka}:${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}@localhost:8761/actuator/health' | grep -q '\"status\":\"UP\"' || exit 1" ]
    ports: !reset []
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  # ============================================================
  # APPLICATION SERVICES — stateless, read_only + tmpfs
  # ============================================================

  gateway-api-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in production}
      SPRING_DATA_REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in production}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    # Keep :8222 — external entry point
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  authentication-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:?POSTGRES_USERNAME must be set in production}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in production}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in production}
      APP_ADMIN_PASSWORD: ${APP_ADMIN_PASSWORD:?APP_ADMIN_PASSWORD must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  tenant-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:?POSTGRES_USERNAME must be set in production}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in production}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  customer-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      MONGO_USERNAME: ${MONGO_USERNAME:?MONGO_USERNAME must be set in production}
      MONGO_PASSWORD: ${MONGO_PASSWORD:?MONGO_PASSWORD must be set in production}
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in production}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  product-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:?POSTGRES_USERNAME must be set in production}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in production}
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in production}
      KAFKA_PASSWORD: ${KAFKA_PASSWORD:?KAFKA_PASSWORD must be set in production}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in production}
      INTERNAL_SERVICE_TOKEN: ${INTERNAL_SERVICE_TOKEN:?INTERNAL_SERVICE_TOKEN must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  order-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:?POSTGRES_USERNAME must be set in production}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in production}
      KAFKA_PASSWORD: ${KAFKA_PASSWORD:?KAFKA_PASSWORD must be set in production}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in production}
      INTERNAL_SERVICE_TOKEN: ${INTERNAL_SERVICE_TOKEN:?INTERNAL_SERVICE_TOKEN must be set in production}
      # Optional, and intentionally NOT using `:?` — set only during a secret rotation, to keep the
      # outgoing value accepted while callers roll onto the new one. Clear it once they have.
      INTERNAL_SERVICE_TOKEN_PREVIOUS: ${INTERNAL_SERVICE_TOKEN_PREVIOUS:-}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  payment-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:?POSTGRES_USERNAME must be set in production}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in production}
      KAFKA_PASSWORD: ${KAFKA_PASSWORD:?KAFKA_PASSWORD must be set in production}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  cart-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in production}
      SPRING_DATA_REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in production}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  notification-service:
    environment:
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:?CONFIG_SERVER_PASSWORD must be set in production}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:?EUREKA_PASSWORD must be set in production}
      MONGO_USERNAME: ${MONGO_USERNAME:?MONGO_USERNAME must be set in production}
      MONGO_PASSWORD: ${MONGO_PASSWORD:?MONGO_PASSWORD must be set in production}
      KAFKA_PASSWORD: ${KAFKA_PASSWORD:?KAFKA_PASSWORD must be set in production}
      MAIL_PASSWORD: ${MAIL_PASSWORD:?MAIL_PASSWORD must be set in production}
      VAULT_TOKEN: ${VAULT_TOKEN:?VAULT_TOKEN must be set in production}
    ports: !reset []
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: "1.0"
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"