docker-compose.prod.yml

# Production "app" stack: redis, backend, and the two frontends.
# PostgreSQL and Caddy/fail2ban live in their own files on purpose (so routine
# app work here never has the DB/proxy config in view) — always run all
# three together:
#   aws ecr get-login-password --region ${AWS_REGION:-ap-south-1} | docker login --username AWS --password-stdin ${ECR_REGISTRY}
#   docker compose -f docker-compose.prod.yml -f docker-compose.postgres.yml -f docker-compose.caddy.yml pull
#   docker compose -f docker-compose.prod.yml -f docker-compose.postgres.yml -f docker-compose.caddy.yml up -d
#
# Images are built and pushed to ECR by .github/workflows/deploy-production.yml
# on every push to the `production` branch, tagged `<service>-<git-sha>` and
# `<service>-latest`. Set IMAGE_TAG to a git sha in .env to pin a specific
# build instead of always pulling latest.
# ECR_REGISTRY / ECR_REPOSITORY default to the tgl/attendix repo below;
# override in .env only if the registry ever changes.

x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "20m"
    max-file: "3"

services:

  redis:
    image: valkey/valkey:8-alpine
    container_name: attendance-redis
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - SETGID
      - SETUID
    logging: *default-logging
    command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in .env}
    expose:
      - "6379"
    volumes:
      # Named `valkey_data`, not `redis_data`: this switched from redis:7-alpine
      # to valkey/valkey:8-alpine, and Valkey can't read an RDB file written by
      # a newer Redis (seen locally: "Can't handle RDB format version 12",
      # which crash-loops the container on boot). Giving Valkey its own volume
      # means this deploy never touches whatever the old `redis_data` volume
      # contains — no manual migration/cleanup step to remember on the prod
      # host. The old volume is orphaned but harmless (only rate-limit/
      # session/deny-list cache, nothing durable) and can be removed manually
      # later with `docker volume rm`.
      - valkey_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s
    networks:
      - db-net

  
  backend:
    image: ${ECR_REGISTRY:-559444199242.dkr.ecr.ap-south-1.amazonaws.com}/${ECR_REPOSITORY:-tgl/attendix}:backend-${IMAGE_TAG:-latest}
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging: *default-logging
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      # Exact origins only; the backend rejects `*` and refuses to start on an
      # unparseable entry rather than falling back to allow-any.
      - CORS_ORIGIN=${CORS_ORIGIN}
      # Origin a student's browser reaches the site on, used to build
      # shareable short links. NOT the same as WEBAUTHN_ORIGIN (the RP
      # origin) — links used to be built from that and pointed at :5000.
      - PUBLIC_BASE_URL=${PUBLIC_BASE_URL}
      # Subnet of the reverse proxy, so X-Forwarded-For can be trusted for
      # rate-limit keying. Empty means the socket peer is always used.
      - TRUSTED_PROXIES=${TRUSTED_PROXIES:-}
      # Bearer token Prometheus presents to scrape /metrics.
      - METRICS_TOKEN=${METRICS_TOKEN:-}
      - PORT=5000
      - DATABASE_URL=postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env}@postgres:5432/${POSTGRES_DB:-attendance_geotag}
      - TIMESCALE_DATABASE_URL=postgres://${TIMESCALE_USER:-attendix_telemetry}:${TIMESCALE_PASSWORD:?TIMESCALE_PASSWORD must be set in .env}@timescaledb:5432/${TIMESCALE_DB:-attendix_telemetry}
      - REDIS_URL=redis://:${REDIS_PASSWORD:?REDIS_PASSWORD must be set in .env}@redis:6379
      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET must be set in .env — run scripts/generate-secrets.sh}
      - JWT_EXPIRE=7d
      - ADMIN_SECRET=${ADMIN_SECRET:?ADMIN_SECRET must be set in .env — run scripts/generate-secrets.sh}
      # Only s3 is implemented as a StorageProvider (backend-rust/src/storage) — no Cloudinary support.
      - STORAGE_PROVIDER=s3
      # AWS S3
      - AWS_S3_BUCKET=${AWS_S3_BUCKET}
      - AWS_REGION=${AWS_REGION:-us-east-1}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
      # WebAuthn
      - WEBAUTHN_RP_NAME=${WEBAUTHN_RP_NAME:-Attendix Attendance System}
      # Must match the domain Caddyfile.prod actually serves (RP ID has to be
      # a registrable domain suffix of the origin, or passkey ceremonies are
      # silently rejected by the browser) — these defaults exist only so a
      # deploy without an explicit .env override still matches that domain
      # instead of an unrelated one.
      - WEBAUTHN_RP_ID=${WEBAUTHN_RP_ID:-attendixv2.talenciaglobal.com}
      - WEBAUTHN_ORIGIN=${WEBAUTHN_ORIGIN:-https://attendixv2.talenciaglobal.com}
      # Database Pool (names must match backend-rust/src/config/mod.rs::AppConfig::from_env)
      # 30 per replica x 3 replicas = 90 cluster-wide, comfortably under
      # postgres's max_connections=200 (docker-compose.postgres.yml) with
      # headroom for psql/backup-sidecar/admin connections. Connections are
      # only held for query duration, not for the extension's 15-30s batch
      # interval, so this doesn't need to scale with concurrent students.
      - PG_MAX_POOL_SIZE=${PG_MAX_POOL_SIZE:-30}
      - PG_MIN_POOL_SIZE=${PG_MIN_POOL_SIZE:-5}
      - DEV_BYPASS_ALL=${DEV_BYPASS_ALL:-false}
    # See docker-compose.yml's backend service for why .cache needs to be
    # writable too, not just /tmp.
    read_only: true
    tmpfs:
      - /tmp
      - /home/appuser/.cache:uid=1001,gid=1001,mode=0755
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '1.5'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - db-net
      - web-net


  admin-frontend:
    image: ${ECR_REGISTRY:-559444199242.dkr.ecr.ap-south-1.amazonaws.com}/${ECR_REPOSITORY:-tgl/attendix}:admin-frontend-${IMAGE_TAG:-latest}
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    # nginx-unprivileged (see frontend/admin/Dockerfile) runs as the `nginx`
    # user from the start and listens on 8080, not 80 — no capabilities
    # needed at all anymore.
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /var/cache/nginx
      - /var/run
    logging: *default-logging
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    depends_on:
      - backend
    networks:
      - web-net


  mentor-frontend:
    image: ${ECR_REGISTRY:-559444199242.dkr.ecr.ap-south-1.amazonaws.com}/${ECR_REPOSITORY:-tgl/attendix}:mentor-frontend-${IMAGE_TAG:-latest}
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /var/cache/nginx
      - /var/run
    logging: *default-logging
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    depends_on:
      - backend
    networks:
      - web-net


  student-frontend:
    image: ${ECR_REGISTRY:-559444199242.dkr.ecr.ap-south-1.amazonaws.com}/${ECR_REPOSITORY:-tgl/attendix}:student-frontend-${IMAGE_TAG:-latest}
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /var/cache/nginx
      - /var/run
    logging: *default-logging
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    depends_on:
      - backend
    networks:
      - web-net


  home-frontend:
    image: ${ECR_REGISTRY:-559444199242.dkr.ecr.ap-south-1.amazonaws.com}/${ECR_REPOSITORY:-tgl/attendix}:home-frontend-${IMAGE_TAG:-latest}
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    logging: *default-logging
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    networks:
      - web-net

volumes:
  valkey_data:

networks:
  db-net:
    driver: bridge
  web-net:
    driver: bridge