docker-compose.prod.yml

name: flowsint-prod

services:
  postgres:
    image: postgres:15-alpine
    container_name: flowsint-postgres-prod
    restart: always
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-flowsint}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-flowsint}
      POSTGRES_DB: ${POSTGRES_DB:-flowsint}
    ports:
      # Bound to localhost: host-only debugging access, never exposed to the network.
      - "127.0.0.1:5433:5432"
    volumes:
      - pg_data_prod:/var/lib/postgresql/data
    networks:
      - flowsint_network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-flowsint}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    container_name: flowsint-redis-prod
    restart: always
    ports:
      - "127.0.0.1:6379:6379"
    networks:
      - flowsint_network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  neo4j:
    image: neo4j:5
    container_name: flowsint-neo4j-prod
    restart: always
    ports:
      - "127.0.0.1:7474:7474"
      - "127.0.0.1:7687:7687"
    environment:
      - NEO4J_AUTH=${NEO4J_USERNAME}/${NEO4J_PASSWORD}
      - NEO4J_PLUGINS=["apoc"]
      - NEO4J_apoc_export_file_enabled=true
      - NEO4J_apoc_import_file_enabled=true
      - NEO4J_apoc_import_file_use__neo4j__config=true
    volumes:
      - neo4j_data_prod:/data
      - neo4j_logs_prod:/logs
      - neo4j_import_prod:/var/lib/neo4j/import
      - neo4j_plugins_prod:/plugins
    networks:
      - flowsint_network
    healthcheck:
      test: cypher-shell -u ${NEO4J_USERNAME} -p ${NEO4J_PASSWORD} "RETURN 1"
      interval: 5s
      timeout: 5s
      retries: 10

  api:
    image: ghcr.io/reconurge/flowsint-api:${FLOWSINT_VERSION:-latest}
    container_name: flowsint-api-prod
    restart: always
    ports:
      # The frontend's nginx proxies /api/ to this service over the Docker
      # network — direct access is host-only, for debugging.
      - "127.0.0.1:5001:5001"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - DATABASE_URL=postgresql://${POSTGRES_USER:-flowsint}:${POSTGRES_PASSWORD:-flowsint}@postgres:5432/${POSTGRES_DB:-flowsint}
      - NEO4J_URI_BOLT=bolt://neo4j:7687
      - NEO4J_USERNAME=${NEO4J_USERNAME}
      - NEO4J_PASSWORD=${NEO4J_PASSWORD}
      - AUTH_SECRET=${AUTH_SECRET}
      - MASTER_VAULT_KEY_V1=${MASTER_VAULT_KEY_V1}
      - REDIS_URL=redis://redis:6379/0
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      neo4j:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:5001/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - flowsint_network

  celery:
    image: ghcr.io/reconurge/flowsint-api:${FLOWSINT_VERSION:-latest}
    container_name: flowsint-celery-prod
    restart: always
    command:
      [
        "celery",
        "-A",
        "flowsint_core.core.celery",
        "worker",
        "--loglevel=info",
        "--pool=threads",
        "--concurrency=10",
      ]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - DATABASE_URL=postgresql://${POSTGRES_USER:-flowsint}:${POSTGRES_PASSWORD:-flowsint}@postgres:5432/${POSTGRES_DB:-flowsint}
      - NEO4J_URI_BOLT=bolt://neo4j:7687
      - NEO4J_USERNAME=${NEO4J_USERNAME}
      - NEO4J_PASSWORD=${NEO4J_PASSWORD}
      - MASTER_VAULT_KEY_V1=${MASTER_VAULT_KEY_V1}
      - REDIS_URL=redis://redis:6379/0
      - SKIP_MIGRATIONS=true
      - AUTH_SECRET=${AUTH_SECRET}
    healthcheck:
      # Celery has no HTTP server — Dockerfile's curl-based healthcheck always fails.
      # Use celery's own ping primitive instead.
      test: ["CMD-SHELL", "celery -A flowsint_core.core.celery inspect ping -d celery@$$HOSTNAME || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      neo4j:
        condition: service_healthy
      api:
        condition: service_healthy
    networks:
      - flowsint_network

  app:
    # Frontend bundle uses same-origin relative URLs; nginx inside the image
    # proxies /api/ to the "api" service. No VITE_API_URL needed.
    image: ghcr.io/reconurge/flowsint-app:${FLOWSINT_VERSION:-latest}
    container_name: flowsint-app-prod
    restart: always
    ports:
      # The only network-facing port. Serves the UI and proxies /api/ to the API.
      - "5173:8080"
    volumes:
      # Override the baked-in nginx.conf to use system resolver (Podman-compatible).
      - ./flowsint-app/nginx.conf:/etc/nginx/nginx.conf:ro
    networks:
      - flowsint_network
    depends_on:
      api:
        condition: service_healthy

networks:
  flowsint_network:
    name: flowsint_network_prod
    driver: bridge

volumes:
  pg_data_prod:
  neo4j_data_prod:
  neo4j_logs_prod:
  neo4j_import_prod:
  neo4j_plugins_prod: