docker-compose.yml

name: pec-erp
services:
  postgres:
    image: postgres:16-alpine
    container_name: pec_postgres
    restart: always
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-pec}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
    ports:
      - 5432:5432
    command: ["postgres", "-c", "statement_timeout=5000", "-c", "autovacuum_vacuum_scale_factor=0.05", "-c", "autovacuum_analyze_scale_factor=0.02", "-c", "wal_level=logical"]
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - pec-network
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1024M
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready -U postgres -d pec
      interval: 10s
      timeout: 5s
      retries: 5
  pgbouncer:
    image: edoburu/pgbouncer:latest
    container_name: pec_pgbouncer
    environment:
      AUTH_TYPE: scram-sha-256
      DB_USER: ${POSTGRES_USER:-postgres}
      DB_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      DB_HOST: postgres
      DB_NAME: ${POSTGRES_DB:-pec}
      POOL_MODE: transaction
      MAX_CLIENT_CONN: "1000"
      DEFAULT_POOL_SIZE: "20"
      IGNORE_STARTUP_PARAMETERS: extra_float_digits
    ports:
      - 6432:5432
    depends_on:
      - postgres
    networks:
      - pec-network
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1024M
  db_migrator:
    build:
      context: .
      dockerfile: apps/server/Dockerfile
    container_name: pec_db_migrator
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@pgbouncer:5432/${POSTGRES_DB:-pec}?pgbouncer=true
      DIRECT_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-pec}
    depends_on:
      postgres:
        condition: service_healthy
      pgbouncer:
        condition: service_started
    command: ["npx", "prisma", "migrate", "deploy", "--schema=node_modules/@pec/database/prisma/schema.prisma"]
    networks:
      - pec-network

  backend:
    build:
      context: .
      dockerfile: apps/server/Dockerfile
    container_name: pec_backend
    restart: always
    ports:
      # Port 4000 intentionally not exposed to host — Nginx is the entry point.
      # Uncomment below only for direct debug access:
      # - 4000:4000
      - 50051:50051  # keep exposed if any internal tooling needs direct gRPC
    environment:
      JWT_SECRET: ${JWT_SECRET:-pec_secret_key_2026}
      PORT: "4000"
      NODE_ENV: production
      DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@pgbouncer:5432/${POSTGRES_DB:-pec}?pgbouncer=true
      REPLICA_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@pgbouncer:5432/${POSTGRES_DB:-pec}?pgbouncer=true
      DIRECT_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-pec}
      REDIS_URL: redis://redis:6379
    depends_on:
      postgres:
        condition: service_healthy
      qdrant:
        condition: service_started
    healthcheck:
      test:
        - CMD
        - wget
        - -qO-
        - http://localhost:4000/api
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - pec-network
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1024M
  # Envoy removed — frontend uses REST + Socket.IO only (no gRPC-Web).

  frontend:
    build:
      context: .
      dockerfile: apps/frontend/Dockerfile
    container_name: pec_frontend
    restart: always
    ports:
      # Port 3001 not exposed to host — Nginx handles all traffic.
      - "3001:3001"
    environment:
      NEXT_PUBLIC_API_URL: /api
      INTERNAL_API_URL: ${INTERNAL_API_URL:-http://backend:4000/api}
      NODE_ENV: production
      PORT: "3001"
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - pec-network
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1024M
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - "require('http').get('http://localhost:3001/', (r) => process.exit(r.statusCode < 500 ? 0 : 1)).on('error', () => process.exit(1))"
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 60s

  nginx:
    image: nginx:1.27-alpine
    container_name: pec_nginx
    restart: always
    ports:
      - "80:80"
      # - "443:443"  # uncomment when SSL cert is configured
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/conf.d/pec.prod.conf:/etc/nginx/conf.d/default.conf:ro
      # - ./nginx/ssl:/etc/nginx/ssl:ro  # uncomment when cert is available
    depends_on:
      backend:
        condition: service_healthy
      frontend:
        condition: service_healthy
    networks:
      - pec-network
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 30s
      timeout: 5s
      retries: 3
  redis:
    image: redis:7-alpine
    container_name: pec_redis
    restart: always
    ports:
      - 6379:6379
    networks:
      - pec-network
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1024M
    healthcheck:
      test:
        - CMD
        - redis-cli
        - ping
      interval: 10s
      timeout: 5s
      retries: 5
  rabbitmq:
    image: rabbitmq:3-management
    container_name: pec_rabbitmq
    restart: always
    ports:
      - 5672:5672
      - 15672:15672
    networks:
      - pec-network
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1024M
    healthcheck:
      test:
        - CMD
        - rabbitmq-diagnostics
        - check_port_connectivity
      interval: 10s
      timeout: 5s
      retries: 5
  qdrant:
    image: qdrant/qdrant
    container_name: pec_qdrant
    restart: always
    ports:
      - "6333:6333"
      - "6334:6334"
    volumes:
      - qdrant_data:/qdrant/storage
    networks:
      - pec-network
#  frontend:
#    build:
#      context: .
#      dockerfile: apps/frontend/Dockerfile
#    container_name: pec_frontend
#    restart: always
#    ports:
#      - 3000:3001
#    environment:
#      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000/api}
#      INTERNAL_API_URL: ${INTERNAL_API_URL:-http://backend:4000/api}
#      NODE_ENV: production
#    depends_on:
#      - backend
#    networks:
#      - pec-network
#    logging:
#      driver: json-file
#      options:
#        max-size: 10m
#        max-file: "3"
#    deploy:
#      resources:
#        limits:
#          cpus: "1.0"
#          memory: 1024M
  dev_worker:
    build:
      context: .
      dockerfile: apps/server/Dockerfile
    container_name: pec_dev_worker
    working_dir: /app
    environment:
      REDIS_URL: redis://redis:6379
      DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@pgbouncer:5432/${POSTGRES_DB:-pec}?pgbouncer=true
      REPLICA_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@pgbouncer:5432/${POSTGRES_DB:-pec}?pgbouncer=true
      DIRECT_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-pec}
      NODE_ENV: production
    depends_on:
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
    command: ["node", "dist/src/background-jobs/worker.js"]
    networks:
      - pec-network
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1024M

  prometheus:
    image: prom/prometheus:latest
    container_name: pec_prometheus
    restart: always
    ports:
      - "9090:9090"
    volumes:
      - ./infra/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    networks:
      - pec-network

  grafana:
    image: grafana/grafana:latest
    container_name: pec_grafana
    restart: always
    ports:
      - "3000:3000"
    networks:
      - pec-network
    depends_on:
      - prometheus
      - loki

  loki:
    image: grafana/loki:latest
    container_name: pec_loki
    restart: always
    ports:
      - "3100:3100"
    command: -config.file=/etc/loki/local-config.yaml
    networks:
      - pec-network

  promtail:
    image: grafana/promtail:latest
    container_name: pec_promtail
    restart: always
    volumes:
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./infra/promtail-config.yml:/etc/promtail/promtail-config.yml:ro
    command: -config.file=/etc/promtail/promtail-config.yml
    networks:
      - pec-network

volumes:
  postgres_data:
  qdrant_data:
networks:
  pec-network:
    driver: bridge