docker-compose.yml

services:
  # ------------------- Docker socket proxy -------------------
  # Traefik needs to read container labels to build its routing config, but it doesn't
  # need the full Docker API. This proxy holds the real socket and exposes only the
  # read-only paths Traefik's docker provider actually calls (container list/inspect,
  # network inspect, the events stream for live updates), with no write methods allowed
  # at all — so a compromised Traefik container can't use the socket to escalate into
  # full Docker control on the host.
  #
  # tecnativa/docker-socket-proxy is NOT used here: its proxy denies every request that
  # isn't GET or POST, including the HEAD /_ping handshake Traefik >=3.6.1 sends first —
  # that HEAD gets denied, Traefik silently falls back to a stale Docker API version, its
  # docker provider then discovers zero routers, and every request 404s ("page not
  # found" is Traefik's own fallback response when nothing matches). wollomatic/socket-proxy
  # explicitly supports allowing that HEAD request.
  docker-socket-proxy:
    image: wollomatic/socket-proxy:1
    container_name: docker-socket-proxy
    restart: unless-stopped
    # The image defaults to USER 65534:65534 (nobody), which can't read a root-owned
    # docker.sock. The project's own docs work around that with a host-specific docker
    # group GID, but that GID varies per host (and doesn't apply the same way on Docker
    # Desktop) — not something a self-hosted installer can discover reliably across
    # arbitrary machines. Running as root matches the socket's owning uid everywhere,
    # no host-specific lookup needed. cap_drop + no-new-privileges below still hold, so
    # this isn't the same exposure as the old direct-mount-into-Traefik setup.
    user: "0:0"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges
    command:
      - "-loglevel=info"
      - "-listenip=0.0.0.0"
      - "-proxyport=2375"
      - "-allowfrom=traefik"
      - "-allowGET=/v[0-9.]+/(version|containers/.*|networks.*|events.*)"
      - "-allowHEAD=/_ping"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - internal
    deploy:
      resources:
        limits: { memory: 64M }
        reservations: { memory: 16M }
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }

  # ------------------- Traefik (Reverse Proxy) -------------------
  traefik:
    image: traefik:v3.6
    container_name: traefik
    restart: always
    depends_on:
      - docker-socket-proxy
    deploy:
      resources:
        limits: { memory: 256M }
        reservations: { memory: 64M }
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }
    # Client IP: Node APIs use TRUST_PROXY=1 to honor X-Forwarded-For / X-Real-Ip from Traefik.
    # Production behind CDN/LB: add entrypoint forwardedHeaders.trustedIPs (Traefik: Forwarded headers), not insecure.
    command:
      - "--api.insecure=false"
      - "--providers.docker=true"
      - "--providers.docker.endpoint=tcp://docker-socket-proxy:2375"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.allowEmptyServices=true"
      - "--serversTransport.forwardingTimeouts.responseHeaderTimeout=0"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      # Remove Traefik's default 60s read timeout so long-running requests
      # (e.g. /company/createdatabase SQL import) are not cut off mid-flight.
      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
      - "--entrypoints.web.transport.respondingTimeouts.readTimeout=0"
      - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true"
      - "--certificatesresolvers.mytlschallenge.acme.email=${SSL_EMAIL}"
      - "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json"
      # Defaults to Let's Encrypt production. Set ACME_CASERVER in .env to the LE staging
      # directory when reinstalling/testing often, to avoid hitting production rate limits.
      - "--certificatesresolvers.mytlschallenge.acme.caserver=${ACME_CASERVER:-https://acme-v02.api.letsencrypt.org/directory}"
    ports:
      - "0.0.0.0:80:80"
      - "0.0.0.0:443:443"
    volumes:
      - traefik_data:/letsencrypt
    networks:
      - frontend
      - internal

  # Main app → https://self.plumoai.com (DOMAIN_NAME) — low priority so /api/* goes to auth/company
  main-app:
    image: plumoai/plumoai-app:${PLUMOAI_VERSION:-v1.0.4}
    container_name: main-app
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits: { memory: 512M }
        reservations: { memory: 128M }
    networks:
      - internal
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.main.service=main"
      - "traefik.http.middlewares.sec-headers.headers.forceSTSHeader=true"
      - "traefik.http.middlewares.sec-headers.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.sec-headers.headers.stsPreload=true"
      - "traefik.http.middlewares.sec-headers.headers.customFrameOptionsValue=SAMEORIGIN"
      - "traefik.http.middlewares.sec-headers.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.sec-headers.headers.browserXssFilter=true"
      - "traefik.http.middlewares.ratelimit.ratelimit.average=200"
      - "traefik.http.middlewares.ratelimit.ratelimit.burst=100"
      - "traefik.http.routers.main.rule=Host(`${DOMAIN_NAME}`)"
      - "traefik.http.routers.main.entrypoints=websecure"
      - "traefik.http.routers.main.tls.certresolver=mytlschallenge"
      - "traefik.http.routers.main.priority=1"
      - "traefik.http.routers.main.middlewares=sec-headers,ratelimit"
      - "traefik.http.services.main.loadbalancer.server.port=80"

  # Auth API → https://self.plumoai.com/api/auth (priority so path wins over main)
  # internal = reach MySQL (hostname "mysql"); frontend = outbound internet (e.g. api.plumoai.com)
  # Secrets are mounted read-only at /run/secrets/<name>.
  auth:
    image: plumoai/authservice:${PLUMOAI_VERSION:-v1.0.4}
    container_name: auth-service
    restart: unless-stopped
    depends_on:
      mysql:
        condition: service_healthy
    healthcheck:
      # Image has no curl; use Node to check port 3000.
      # interval 30s (not 15s) to avoid cold-starting a full Node process
      # every 15 seconds, which causes CPU spikes on constrained hosts.
      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3000/', r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))\""]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.50"      # prevent runaway CPU; auth is I/O-bound, 0.5 core is ample
        reservations:
          memory: 128M
          cpus: "0.10"
    networks:
      - frontend
      - internal
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }
    volumes:
      - ./service-providers:/opt/plumoai/service-providers:ro
    environment:
      SERVICE_PROVIDERS_LOCAL_PATH: /opt/plumoai/service-providers
      # Public base URL of this app (e.g. http://localhost:7861 or https://your-domain.com),
      # used to build absolute links back to the app (e.g. email verification/reset links).
      APP_HOST: ${APP_HOST}
      NODE_ENV: production   # enables V8 opts, disables dev middleware, reduces CPU/RAM
      # One reverse proxy (Traefik) in front → Express/Nest req.ip / forwarded headers
      TRUST_PROXY: ${TRUST_PROXY:-1}
      DB_HOST: ${DB_HOST:-mysql}
      DB_PORT: ${DB_PORT:-3306}
      # Outbound mail (auth): ses | smtp | disabled (false/0/off/no/none/disabled in app)
      EMAIL_PROVIDER: ${EMAIL_PROVIDER:-}
      MAIL_FROM: ${MAIL_FROM:-}
      ACCESSKEYID: ${ACCESSKEYID:-}
      SECRETACCESSKEY: ${SECRETACCESSKEY:-}
      REGION: ${REGION:-}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASS: ${SMTP_PASS:-}
      SMTP_SECURE: ${SMTP_SECURE:-}
      AUTH_BASE_ROUTE : /api/auth
    secrets:
      - mysql_db
      - mysql_user
      - mysql_password
      - app_secret
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.auth.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/api/auth`)"
      - "traefik.http.routers.auth.entrypoints=websecure"
      - "traefik.http.routers.auth.tls.certresolver=mytlschallenge"
      - "traefik.http.routers.auth.priority=200"
      - "traefik.http.routers.auth.service=auth"
      - "traefik.http.services.auth.loadbalancer.server.port=3000"
      - "traefik.http.middlewares.auth-strip.stripprefix.prefixes=/api/auth"
      - "traefik.http.routers.auth.middlewares=auth-strip,sec-headers,ratelimit"

  # ------------------- PlumoAI API (company-api + public-api + websocket-api, single container) -------------------
  # Was three containers behind separate Traefik routers. Now one image
  # (plumoai/plumoai-api) runs all three apps + an internal nginx on :8080,
  # routed by path prefix. Traefik's existing routing still works unmodified:
  #   /api/company/* -> stripped by Traefik  -> nginx "/" catch-all       -> company-api
  #   /api/v1/*      -> kept by Traefik      -> nginx "/api/" location    -> public-api
  #   /ws/*          -> kept by Traefik      -> nginx "/ws/" location     -> websocket-api (WebSocket upgrade)
  plumoai-api:
    image: plumoai/plumoai-api:${PLUMOAI_VERSION:-v1.0.4}
    container_name: plumoai-api
    restart: unless-stopped
    depends_on:
      mysql:
        condition: service_healthy
      mongodb:
        condition: service_healthy
    healthcheck:
      # Image has no curl; use Node to check nginx (port 8080) -> company-api's /health.
      # interval 30s to avoid cold-starting Node every 15s (CPU spike).
      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:8080/health', r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))\""]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 1G       # hosts company-api + public-api + websocket-api + nginx in one container
          cpus: "1.0"
        reservations:
          memory: 256M
          cpus: "0.15"
    networks:
      - frontend
      - internal
    ports:
      # Host access: http://localhost:3010/api/v1/... (direct to public-api, bypassing nginx/Traefik — same as before)
      - "3010:3010"
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }
    volumes:
      - ./ai-agents:/opt/plumoai/ai-agents:ro
      - ./storage:/opt/plumoai/storage
      - ./ai-employees:/opt/plumoai/ai-employees
    environment:
      # ---- company-api ----
      PLUMOAI_AI_AGENTS_APPS_PATH: /opt/plumoai/ai-agents
      LOCAL_STORAGE_PATH: /opt/plumoai/storage
      AI_EMPLOYEES_PATH: /opt/plumoai/ai-employees
      NODE_ENV: production
      APP_HOST: ${APP_HOST}
      # One reverse proxy (Traefik) in front → Express/Nest req.ip / forwarded headers
      TRUST_PROXY: ${TRUST_PROXY:-1}
      DB_HOST: ${DB_HOST:-mysql}
      DB_PORT: ${DB_PORT:-3306}
      MONGODB_HOST: ${MONGODB_HOST:-mongodb}
      MONGODB_PORT: ${MONGODB_PORT:-27017}
      Auth_URL: ${Auth_URL:-http://auth:3000}
      PLUMOAI_DIGITAL_EMPLOYEE_API_URL: ${PLUMOAI_DIGITAL_EMPLOYEE_API_URL:-http://ai:3002}
      # OpenAI key used by the company/api service for knowledgebase embeddings (optional)
      OPENAI_API_KEY_KNOWLEDGEBASE: ${OPENAI_API_KEY_KNOWLEDGEBASE:-}
      STORAGE_BACKEND: ${STORAGE_BACKEND:-local}
      AWS_S3_BUCKET:  ${AWS_S3_BUCKET}
      AWS_REGION: ${AWS_REGION}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      LOG_LEVEL: info
      # company-api calls public-api's /internal/v1/* (e.g. records/convert-ids) —
      # same container now, so loopback on public-api's own port (:3010).
      PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:3010}
      # ---- public-api ----
      AUTH_API_BASE_URL: ${AUTH_API_BASE_URL:-http://auth:3000}
      # company-api is now the SAME container (loopback on :3001), not a separate "company" host
      COMPANY_API_BASE_URL: ${COMPANY_API_BASE_URL:-http://localhost:3001}
      # No fallback on purpose: installers generate a random per-deployment key into
      # secrets/app_secret.txt (same pattern as the DB passwords) and copy it into .env
      # here. An unset value is a misconfiguration, not something to paper over with a
      # shared default.
      ENCRYPTION_KEY: ${PLUMOAI_PUBLIC_API_ENCRYPTION_KEY:?PLUMOAI_PUBLIC_API_ENCRYPTION_KEY is not set — run install.sh/install.ps1, or set it in .env}
      # ---- websocket-api ----
      # AI employee workflow execution events call the ai service directly (same URL
      # company-api uses above); Auth_URL is already set for the whole container.
      PROJECT_AI_ASSISTANT_API_URL: ${PROJECT_AI_ASSISTANT_API_URL:-http://ai:3002}
      # Stored-procedure calls (project/document saves) go to company-api, now the
      # SAME container (loopback), not a separate host.
      PLUMO_API_BASE_URL: ${PLUMO_API_BASE_URL:-http://localhost:3001}
    secrets:
      - mysql_db
      - mysql_user
      - mysql_password
      - mongo_db
      - mongo_user
      - mongo_password
    labels:
      - "traefik.enable=true"

      # company-api routes: /api/company/* (Traefik strips the prefix before forwarding)
      - "traefik.http.routers.api.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/api/company`)"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=mytlschallenge"
      - "traefik.http.routers.api.priority=100"
      - "traefik.http.routers.api.service=api"
      - "traefik.http.services.api.loadbalancer.server.port=8080"
      - "traefik.http.middlewares.api-strip.stripprefix.prefixes=/api/company"
      - "traefik.http.routers.api.middlewares=api-strip,sec-headers,ratelimit"

      # public-api routes: /api/v1/* (prefix kept, forwarded as-is)
      - "traefik.http.routers.plumoai-public-api.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/api/v1`)"
      - "traefik.http.routers.plumoai-public-api.entrypoints=websecure"
      - "traefik.http.routers.plumoai-public-api.tls.certresolver=mytlschallenge"
      - "traefik.http.routers.plumoai-public-api.priority=150"
      - "traefik.http.routers.plumoai-public-api.service=plumoai-public-api"
      - "traefik.http.services.plumoai-public-api.loadbalancer.server.port=8080"
      - "traefik.http.routers.plumoai-public-api.middlewares=sec-headers,ratelimit"

      # websocket-api routes: external /api/websocket/* -> stripped to /* -> nginx's
      # existing /ws/ location, so clients hit /api/websocket/ws/doc,
      # /api/websocket/ws/project, /api/websocket/ws/ai_employee/workflow/execution.
      # Its /internal/* HTTP routes are deliberately NOT exposed here — they're
      # same-server-only (see websocket-api's internal-auth.middleware.ts),
      # reachable only from inside the Docker network.
      - "traefik.http.routers.plumoai-websocket-api.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/api/websocket`)"
      - "traefik.http.routers.plumoai-websocket-api.entrypoints=websecure"
      - "traefik.http.routers.plumoai-websocket-api.tls.certresolver=mytlschallenge"
      - "traefik.http.routers.plumoai-websocket-api.priority=175"
      - "traefik.http.routers.plumoai-websocket-api.service=plumoai-websocket-api"
      - "traefik.http.services.plumoai-websocket-api.loadbalancer.server.port=8080"
      - "traefik.http.middlewares.websocket-strip.stripprefix.prefixes=/api/websocket"
      - "traefik.http.routers.plumoai-websocket-api.middlewares=websocket-strip,sec-headers,ratelimit"

  # ------------------- AI Service (internal only — no exposed URL) -------------------
  # Other services call it by hostname: http://ai:<port> (e.g. http://ai:3000)
  # platform: linux/amd64 ensures the AMD64 image is used on ARM hosts (Windows/Linux ARM).
  # On native AMD64 hosts this is a no-op. Requires QEMU binfmt_misc on ARM hosts:
  #   docker run --privileged --rm tonistiigi/binfmt --install all
  ai:
    image: plumoai/ai-service:${PLUMOAI_VERSION:-v1.0.4}
    platform: linux/amd64
    container_name: ai-service
    restart: unless-stopped
    healthcheck:
      # Python image: use python urllib to check the port; reads PORT env var dynamically
      test: ["CMD-SHELL", "python -c \"import urllib.request,os; urllib.request.urlopen('http://localhost:'+os.environ.get('PORT','3002')+'/', timeout=5)\" 2>/dev/null && exit 0 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    deploy:
      resources:
        limits: { memory: 1G }
        reservations: { memory: 256M }
    volumes:
      # Writable so stdio MCP servers (e.g. plumoai-mcp) can run `npm ci` at runtime when needed.
      - ./ai-agents:/opt/plumoai/ai_agents
      - ./nodes:/opt/plumoai/nodes
      - ./service-providers:/opt/plumoai/service-providers:ro
    environment:
      PLUMOAI_AI_AGENTS_EXTERNAL_DIR: /opt/plumoai/ai_agents
      PLUMOAI_NODES_EXTERNAL_DIR: /opt/plumoai/nodes
      PLUMOAI_SERVICE_PROVIDERS_EXTERNAL_DIR: /opt/plumoai/service-providers
      AUTH_URL: ${AUTH_URL:-http://auth:3000}
      # company-api now lives in the merged plumoai-api container (was its own "company" host)
      COMPANY_URL: ${COMPANY_URL:-http://plumoai-api:3001}
      # websocket-api's /internal/* HTTP endpoints only accept same-server callers
      # (TCP peer 127.0.0.1/::1 — see internal-auth.middleware.ts, no token check).
      # A direct call from this container's own IP would get 403'd, so this MUST
      # go through nginx on :8080 (same container as websocket-api, loopback to
      # it) rather than websocket-api's own port 2999 directly.
      WEBSOCKET_URL: ${WEBSOCKET_URL:-http://plumoai-api:8080}
      PORT: ${PORT:-3002}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      AGENT_VERSION: v2
      # Default LLM configuration — if AI_PROVIDER is unset/invalid, the AI service
      # auto-picks whichever provider below actually has a key configured.
      AI_PROVIDER: ${AI_PROVIDER:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      OPENROUTER_MODEL: ${OPENROUTER_MODEL:-openai/gpt-4o-mini}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      OPENAI_MODEL: ${OPENAI_MODEL:-gpt-4o-mini}
    networks:
      - internal   # talk to auth/company/db services
      - frontend   # reach external APIs (OpenRouter, OpenAI, etc.)
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }
    # No Traefik labels — not exposed to the internet

  # ------------------- MySQL Database -------------------
  mysql:
    image: mysql:8.0
    container_name: plumoai-mysql
    restart: unless-stopped
    # /bin/sh + path avoids broken shebang when bind-mounted files have Windows CRLF ("no such file or directory")
    entrypoint: ["/bin/sh", "/scripts/mysql-root-secrets-entrypoint.sh"]
    healthcheck:
      # Verify authenticated readiness instead of treating "access denied" as healthy.
      # On Windows / WSL and slow disks, first boot can still take several minutes.
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -uroot -p\"$$(cat /run/secrets/mysql_root_password)\" --silent"]
      interval: 20s
      timeout: 15s
      retries: 8
      start_period: 180s
    command:
      - --default-authentication-plugin=mysql_native_password
      - --log-bin-trust-function-creators=1
      - --lower_case_table_names=1
    environment:
      MYSQL_DATABASE_FILE: /run/secrets/mysql_db
      MYSQL_USER_FILE: /run/secrets/mysql_user
      MYSQL_PASSWORD_FILE: /run/secrets/mysql_password
      MYSQL_ROOT_HOST: "%"
    secrets:
      - mysql_db
      - mysql_user
      - mysql_password
      - mysql_root_password
    volumes:
      - mysql_data:/var/lib/mysql
      - ./scripts/mysql-root-secrets-entrypoint.sh:/scripts/mysql-root-secrets-entrypoint.sh:ro
      - ./init-privileges.sql:/docker-entrypoint-initdb.d/01-init-privileges.sql:ro
    networks:
      - internal
    deploy:
      resources:
        limits: { memory: 1G }
        reservations: { memory: 256M }
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  # ------------------- MongoDB (own secrets: mongo_db, mongo_user, mongo_password) -------------------
  mongodb:
    image: mongo:7
    container_name: plumoai-mongodb
    restart: unless-stopped
    healthcheck:
      # mongosh is relatively heavy in containers and can briefly stall on Windows/WSL
      # under I/O pressure, so keep the check lightweight and allow more time.
      test: ["CMD-SHELL", "mongosh --quiet --eval \"quit(db.adminCommand({ ping: 1 }).ok ? 0 : 2)\""]
      interval: 45s
      timeout: 20s
      retries: 8
      start_period: 90s
    # WiredTiger cache = ~50% of container memory limit.
    # 512M cap starves the cache (only ~256MB), causing heavy I/O and slow
    # serverStatus/health-check responses. Raise to 1G to match MySQL.
    command: ["--wiredTigerCacheSizeGB", "0.5"]
    entrypoint: ["/bin/sh", "/scripts/mongo-secrets-entrypoint.sh"]
    volumes:
      - ./scripts/mongo-secrets-entrypoint.sh:/scripts/mongo-secrets-entrypoint.sh:ro
      - ./scripts/init-mongo-user.sh:/docker-entrypoint-initdb.d/init-mongo-user.sh:ro
      - mongo_data:/data/db
    # Explicitly set secret file mode so the Mongo image (non-root) can read them.
    # Some Docker/Compose combinations mount secrets as 0400 root by default, which breaks init scripts.
    secrets:
      - source: mongo_db
        target: mongo_db
        mode: 0444
      - source: mongo_user
        target: mongo_user
        mode: 0444
      - source: mongo_password
        target: mongo_password
        mode: 0444
    networks:
      - internal
    deploy:
      resources:
        limits: { memory: 1G }
        reservations: { memory: 256M }
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

# ------------------- Networks -------------------
# frontend: normal network so Traefik gets host port bindings (80, 443)
# internal: isolated (no outbound); backends + Traefik for backend access
networks:
  frontend:
  internal:
    internal: true

# ------------------- Volumes -------------------
volumes:
  traefik_data:
  mysql_data:
  mongo_data:

# ------------------- Secrets -------------------
secrets:
  mysql_db:
    file: ./secrets/mysql_db.txt
  mysql_user:
    file: ./secrets/mysql_user.txt
  mysql_password:
    file: ./secrets/mysql_password.txt
  mysql_root_password:
    file: ./secrets/mysql_root_password.txt
  mongo_db:
    file: ./secrets/mongo_db.txt
  mongo_user:
    file: ./secrets/mongo_user.txt
  mongo_password:
    file: ./secrets/mongo_password.txt
  app_secret:
    file: ./secrets/app_secret.txt