docker-compose.prod.yml

# Production overrides — use with: docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
# Requires .env file with DB_PASSWORD, JWT_SECRET, and optionally SENTRY_DSN

services:
  db:
    # No external port in production — only accessible inside Docker network
    ports: []
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: '1.0'
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-lattice_policy}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  cache:
    ports: []
    deploy:
      resources:
        limits:
          memory: 256m

  server:
    environment:
      NODE_ENV: production
    ports:
      # Not exposed directly — nginx proxy handles routing
      - "127.0.0.1:3300:3000"
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: '1.0'
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3000/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 30s

  frontend:
    ports: []
    deploy:
      resources:
        limits:
          memory: 64m

  # Reverse proxy — TLS termination + routing
  nginx:
    image: nginx:alpine
    container_name: policy-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.prod.conf:/etc/nginx/conf.d/default.conf:ro
      - ./nginx/certs:/etc/nginx/certs:ro
    depends_on:
      - server
      - frontend
    deploy:
      resources:
        limits:
          memory: 64m