docker-compose.prod.yml

# Production Docker Compose - No Source Code Exposure
# Usage: docker compose -f docker-compose.prod.yml up -d
#
# Prerequisites:
# - Build images first using: .\scripts\build-production.ps1
# - Or pull from Docker Hub if images are published
#
# Image Source Configuration:
# - Set DOCKER_IMAGE_PREFIX environment variable to choose image source:
#   - Unset or empty: Use local images (kasapro-backend:latest)
#   - Set to "sofyansolutions/kasapro": Use Docker Hub images (sofyansolutions/kasapro-backend:${ERP_VERSION})
#   Example: export DOCKER_IMAGE_PREFIX=sofyansolutions/kasapro
#   Example: export ERP_VERSION=v1.0.0
#
# IMPORTANT - SSL/HTTPS Access:
# - Nginx uses HTTPS on port 9443 (default)
# - ALWAYS use https:// protocol when accessing: https://localhost:9443
# - DO NOT use http:// - it will cause "400 Bad Request" errors
# - Self-signed certificates are generated automatically on first start
# - To trust the certificate:
#   1. Access https://localhost:9443/ca.crt to download CA certificate
#   2. Install ca.crt in your browser/OS trusted certificate store
#   3. Restart browser after installing certificate
#
# Security Notes:
# - Database migrations are automatically run by the backend service on startup.
#   Migrations are embedded in the backend binary for security.
# - All images are pre-built (local or from Docker Hub). No build context exposure.
# - SSL certificates are generated at runtime and stored in Docker volume.
#   No certificates in image or build context.
# - All images use unified versioning via ERP_VERSION environment variable.

services:
  backend:
    image: ${DOCKER_IMAGE_PREFIX:-kasapro}-backend:${ERP_VERSION:-latest}  # Pre-built production image (local or Docker Hub)
    container_name: kasapro-backend-prod
    restart: unless-stopped
    ports:
      - "${BACKEND_PORT:-8100}:8100"
    environment:
      - APP_ENV=production
      - PORT=8100
      # DATABASE_URL format: postgres://username:password@host:port/database_name?sslmode=disable
      # IMPORTANT: database_name must be 'pos_db', NOT 'pos_user' (pos_user is the username)
      - DATABASE_URL=${DATABASE_URL:-postgres://pos_user:pos_pass@postgres:5432/pos_db?sslmode=disable}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379/0}
      - CORS_ALLOW_ORIGIN=${CORS_ALLOW_ORIGIN:-https://localhost}
      # JWT Secrets - MUST be set in production! Using defaults for development/testing only
      # Generate secure secrets: openssl rand -base64 32
      - JWT_ACCESS_SECRET=${JWT_ACCESS_SECRET:-dev-access-secret-change-in-production-min-32-chars}
      - JWT_REFRESH_SECRET=${JWT_REFRESH_SECRET:-dev-refresh-secret-change-in-production-min-32-chars}
      - JWT_ISSUER=${JWT_ISSUER:-kasapro-backend}
      - JWT_AUDIENCE=${JWT_AUDIENCE:-kasapro-frontend}
      - DEPLOYMENT_MODEL=${DEPLOYMENT_MODEL:-self-hosted}
    # NO VOLUME MOUNTS - Source code not accessible
    # Backend runs migrations automatically on startup (embedded in binary)
    # Migrations are executed before the server starts
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    networks:
      - default
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8100/healthz"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s  # Give backend more time to start and run migrations

  frontend:
    image: ${DOCKER_IMAGE_PREFIX:-kasapro}-frontend:${ERP_VERSION:-latest}  # Pre-built production image (local or Docker Hub)
    container_name: kasapro-frontend-prod
    restart: unless-stopped
    ports:
      - "${FRONTEND_PORT:-3100}:3100"
    environment:
      - NODE_ENV=production
      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-https://localhost:9443/api}
      - NEXT_TELEMETRY_DISABLED=1
    # NO VOLUME MOUNTS - Source code not accessible
    depends_on:
      - backend
    networks:
      - default
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3100"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  postgres:
    image: postgres:14-alpine
    container_name: kasapro-postgres-prod
    restart: unless-stopped
    ports:
      - "${POSTGRES_PORT:-5544}:5432"  # External:Internal - Change POSTGRES_PORT if 5544 is in use
    environment:
      - POSTGRES_DB=${POSTGRES_DB:-pos_db}
      - POSTGRES_USER=${POSTGRES_USER:-pos_user}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-pos_pass}
    volumes:
      - kasapro_postgres_data_prod:/var/lib/postgresql/data
    networks:
      - default
    healthcheck:
      # Use explicit database name to avoid connection issues
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-pos_user} -d ${POSTGRES_DB:-pos_db}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    container_name: kasapro-redis-prod
    restart: unless-stopped
    ports:
      - "${REDIS_PORT:-6381}:6379"  # External:Internal - Change REDIS_PORT if 6381 is in use
    volumes:
      - kasapro_redis_data_prod:/data
    networks:
      - default
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  nginx:
    image: ${DOCKER_IMAGE_PREFIX:-kasapro}-nginx:${ERP_VERSION:-latest}  # Pre-built production image (local or Docker Hub)
    container_name: kasapro-nginx-prod
    restart: unless-stopped
    ports:
      - "${NGINX_HTTP_PORT:-9444}:80"   # HTTP port for redirect to HTTPS
      - "${NGINX_PORT:-9443}:443"        # HTTPS port - MUST use https:// protocol
    volumes:
      # SSL certificates are generated at runtime and stored in volume
      # Volume mount allows certificates to persist and be accessible from host if needed
      - nginx_ssl_data:/etc/nginx/ssl
    depends_on:
      - frontend
      - backend
    networks:
      - default
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/healthz"]
      interval: 30s
      timeout: 10s
      retries: 3

volumes:
  kasapro_postgres_data_prod:
  kasapro_redis_data_prod:
  nginx_ssl_data:
    # SSL certificates are stored in this volume
    # Certificates are generated at runtime by nginx container
    # No sensitive data in image or build context

networks:
  default:
    name: kasapro-network-prod