docker-compose.prod.yml

# APIbase.pro — Docker Compose Production Overlay (§12.194)
# 10 monitoring/ops containers. Extends docker-compose.yml (6 base containers).
# Usage: docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d

services:
  # ---------------------------------------------------------------------------
  # prometheus — Metrics TSDB (§12.194, §12.197, §12.245 port 9090)
  # ---------------------------------------------------------------------------
  prometheus:
    image: prom/prometheus:v2.51.0
    restart: unless-stopped
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=15d"
      - "--web.enable-lifecycle"
    ports:
      - "127.0.0.1:9090:9090"
    volumes:
      - prometheus_data:/prometheus
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./prometheus/rules:/etc/prometheus/rules:ro
    depends_on:
      api:
        condition: service_healthy
    networks:
      - app
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:9090/-/healthy || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: "1.0"
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

  # ---------------------------------------------------------------------------
  # grafana — Dashboards (§12.194, §12.206, §12.245 port 3000)
  # ---------------------------------------------------------------------------
  grafana:
    image: grafana/grafana:10.4.0
    restart: unless-stopped
    ports:
      - "127.0.0.1:3940:3000"
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: ${GF_ADMIN_PASSWORD:?GF_ADMIN_PASSWORD required}
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      GF_SERVER_ROOT_URL: "http://localhost:3940"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
    depends_on:
      prometheus:
        condition: service_healthy
      loki:
        condition: service_healthy
    networks:
      - app
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:3000/api/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "0.5"
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

  # ---------------------------------------------------------------------------
  # loki — Log aggregation (§12.194, §12.197, §12.245 port 3100)
  # ---------------------------------------------------------------------------
  loki:
    image: grafana/loki:2.9.0
    restart: unless-stopped
    command: ["-config.file=/etc/loki/local-config.yaml"]
    user: "0:0"
    volumes:
      - loki_data:/loki
      - ./loki/config.yml:/etc/loki/local-config.yaml:ro
    networks:
      - app
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:3100/ready || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: "1.0"
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
    tmpfs:
      - /tmp
      - /wal
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

  # ---------------------------------------------------------------------------
  # promtail — Log collection (§12.194, §12.197, §12.245 port 9080)
  # ---------------------------------------------------------------------------
  promtail:
    image: grafana/promtail:2.9.0
    restart: unless-stopped
    command: ["-config.file=/etc/promtail/config.yml"]
    volumes:
      - ./promtail/config.yml:/etc/promtail/config.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on:
      loki:
        condition: service_healthy
    networks:
      - app
    healthcheck:
      test: ["CMD-SHELL", "echo OK"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.25"
    cap_drop:
      - ALL
    cap_add:
      - DAC_READ_SEARCH
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

  # ---------------------------------------------------------------------------
  # alertmanager — Alert routing (§12.194, §12.207, §12.245 port 9093)
  # ---------------------------------------------------------------------------
  alertmanager:
    image: prom/alertmanager:v0.27.0
    restart: unless-stopped
    command:
      - "--config.file=/etc/alertmanager/alertmanager.yml"
    volumes:
      - ./alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
    networks:
      - app
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:9093/-/healthy || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.25"
    read_only: true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

  # ---------------------------------------------------------------------------
  # postgres_exporter — PG metrics (§12.194, §12.205, §12.245 port 9187)
  # ---------------------------------------------------------------------------
  postgres_exporter:
    image: quay.io/prometheuscommunity/postgres-exporter:v0.15.0
    restart: unless-stopped
    environment:
      DATA_SOURCE_NAME: "postgresql://${POSTGRES_USER:-apibase}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-apibase}?sslmode=disable"
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - app
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:9187/metrics || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: "0.1"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

  # ---------------------------------------------------------------------------
  # redis_exporter — Redis metrics (§12.194, §12.210, §12.245 port 9121)
  # ---------------------------------------------------------------------------
  redis_exporter:
    image: oliver006/redis_exporter:v1.58.0
    restart: unless-stopped
    environment:
      REDIS_ADDR: "redis://redis:6379"
    depends_on:
      redis:
        condition: service_healthy
    networks:
      - app
    healthcheck:
      test: ["CMD", "/redis_exporter", "--version"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: "0.1"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

  # ---------------------------------------------------------------------------
  # nginx_exporter — Nginx metrics (§12.194, §12.245 port 9113)
  # ---------------------------------------------------------------------------
  nginx_exporter:
    image: nginx/nginx-prometheus-exporter:1.1.0
    restart: unless-stopped
    command: ["--nginx.scrape-uri=http://nginx:8080/stub_status"]
    depends_on:
      nginx:
        condition: service_healthy
    networks:
      - app
    healthcheck:
      test: ["CMD", "/usr/bin/nginx-prometheus-exporter", "--version"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 64M
          cpus: "0.1"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

  # ---------------------------------------------------------------------------
  # postgres_backup — Daily PG backup (§12.194, §12.245 port 8080)
  # ---------------------------------------------------------------------------
  postgres_backup:
    image: prodrigestivill/postgres-backup-local:16
    restart: unless-stopped
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_DB: ${POSTGRES_DB:-apibase}
      POSTGRES_USER: ${POSTGRES_USER:-apibase}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      SCHEDULE: "0 3 * * *"
      BACKUP_KEEP_DAYS: "7"
      BACKUP_KEEP_WEEKS: "4"
      BACKUP_KEEP_MONTHS: "6"
      HEALTHCHECK_PORT: "8080"
    volumes:
      - ./backups:/backups
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - app
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://127.0.0.1:8080/ || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.25"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

  # ---------------------------------------------------------------------------
  # node_exporter — Host metrics (§12.194, §12.245 port 9100)
  # ---------------------------------------------------------------------------
  node_exporter:
    image: prom/node-exporter:v1.7.0
    restart: unless-stopped
    command:
      - "--path.rootfs=/host"
      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
    volumes:
      - /:/host:ro,rslave
    networks:
      - app
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:9100/metrics || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: "0.1"
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - SYS_TIME
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s

# ---------------------------------------------------------------------------
# Volumes — named only (§12.203)
# ---------------------------------------------------------------------------
volumes:
  prometheus_data:
  grafana_data:
  loki_data: