docker-compose.prod.yml

# ============================================
# LLARS Production Docker Compose Override
# ============================================
# This file contains production-specific configurations
# Usage: docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
# Or use start_llars.sh which handles this automatically

services:
  # ============================================
  # Nginx - HTTPS/SSL Enabled
  # ============================================
  nginx-service:
    environment:
      - TZ=Europe/Berlin
      - PROJECT_STATE=production
    ports:
      # HTTPS (primary)
      - "443:443"
      # HTTP (redirect to HTTPS)
      - "80:80"
    volumes:
      # SSL certificates (nginx.conf selection handled by entrypoint based on PROJECT_STATE)
      - ./docker/nginx/certs:/etc/nginx/certs:ro
    restart: unless-stopped

  # ============================================
  # Flask Backend - Production Mode
  # ============================================
  backend-flask-service:
    environment:
      - TZ=Europe/Berlin
      - FLASK_ENV=production
      - FLASK_DEBUG=False
      # Disable Chroma telemetry (avoids noisy posthog signature errors and external telemetry calls)
      - ANONYMIZED_TELEMETRY=False
      # Stricter CORS for production
      - ALLOWED_ORIGINS=${PROJECT_URL:-https://${PROJECT_HOST}}
    # Production volumes (no code hot-reload, but persistent RAG data)
    volumes:
      - rag_storage:/app/storage
      - rag_docs:/app/rag_docs
      # Offline Anonymize Ressourcen (großes NER-Modell wird von Host gemountet)
      - ./docs/docs/projekte/anonymize/models/ner-german-large:/app/models/anonymize/ner-german-large:ro
      - ./docs/docs/projekte/anonymize/models/recommender_system:/app/models/anonymize/recommender_system:ro
      - ./docs/docs/projekte/anonymize/database:/app/data/anonymize:ro
      # OnCoCo model (large, mounted to keep image slim)
      - ./app/models/oncoco:/app/models/oncoco:ro
      # Docker monitor (admin): needs access to Docker Engine
      - /var/run/docker.sock:/var/run/docker.sock
    # No expose of port to host (only internal)
    ports: []
    restart: unless-stopped
    # Production healthcheck (stricter)
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      start_period: 60s
      interval: 30s
      timeout: 10s
      retries: 3

  # ============================================
  # Frontend - Production Build (nginx serves static files)
  # ============================================
  frontend-vue-service:
    build:
      context: .
      dockerfile: docker/vue/Dockerfile-vue-production
      args:
        - VITE_API_BASE_URL=${PROJECT_URL:-https://llars.e-beratungsinstitut.de}
        - VITE_PROJECT_STATE=production
        - VITE_MKDOCS_URL=${PROJECT_URL:-https://llars.e-beratungsinstitut.de}/mkdocs
        - VITE_KEYCLOAK_URL=${PROJECT_URL:-https://llars.e-beratungsinstitut.de}/authentik
        - VITE_KEYCLOAK_CLIENT_ID=${AUTHENTIK_FRONTEND_CLIENT_ID:-llars-frontend}
        - VITE_KEYCLOAK_REALM=llars
        - VITE_SOCKETIO_ENABLE_WEBSOCKET=${VITE_SOCKETIO_ENABLE_WEBSOCKET:-false}
    environment:
      - TZ=Europe/Berlin
    # No volume mounts in production - static files baked into image
    volumes: []
    develop: {}
    # No expose of port to host
    ports: []
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:5173/health || exit 1"]
      start_period: 15s
      interval: 30s
      timeout: 5s
      retries: 3

  # ============================================
  # Supervisor - Production Mode
  # ============================================
  backend-supervisor-service:
    restart: unless-stopped

  # ============================================
  # MariaDB - Production Hardening
  # ============================================
  db-maria-service:
    # Remove external port exposure (only internal access)
    ports: []
    restart: unless-stopped
    # Production healthcheck
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      start_period: 30s
      interval: 30s
      timeout: 10s
      retries: 3

  # ============================================
  # YJS Server - Production Mode
  # ============================================
  yjs-service:
    environment:
      - TZ=Europe/Berlin
      - BASE_URL=${PROJECT_URL:-https://${PROJECT_HOST}}
      - NODE_ENV=production
      - PORT=8082
      - MYSQL_HOST=db-maria-service
      - MYSQL_PORT=3306
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
    # Remove volume mounts and develop mode
    volumes: []
    develop: {}
    restart: unless-stopped

  # ============================================
  # MkDocs - Production Mode (Static Build)
  # ============================================
  mkdocs-service:
    environment:
      - TZ=Europe/Berlin
      - PROJECT_STATE=production
      - MKDOCS_BIND_ADDR=0.0.0.0:8000
    # Remove volume mounts and develop mode for production
    volumes: []
    develop: {}
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      start_period: 10s
      interval: 30s
      timeout: 5s
      retries: 3

  # ============================================
  # Matomo Analytics (self-hosted)
  # ============================================
  matomo-service:
    restart: unless-stopped

  matomo-db-service:
    ports: []
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      start_period: 30s
      interval: 30s
      timeout: 10s
      retries: 3

  matomo-init:
    restart: "no"

  matomo-archiver:
    restart: unless-stopped

  # ============================================
  # Authentik Stack (OIDC Provider)
  # ============================================
  authentik-db:
    restart: unless-stopped
    environment:
      - POSTGRES_DB=${AUTHENTIK_DB_NAME}
      - POSTGRES_USER=${AUTHENTIK_DB_USER}
      - POSTGRES_PASSWORD=${AUTHENTIK_DB_PASSWORD}
    volumes:
      - authentikdb:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${AUTHENTIK_DB_USER}"]
      start_period: 15s
      interval: 30s
      timeout: 10s
      retries: 3

  authentik-redis:
    image: public.ecr.aws/docker/library/redis:7-alpine
    command: ["redis-server", "--save", "", "--appendonly", "no"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  authentik-server:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2025.2.4}
    command: server
    environment:
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_POSTGRESql__HOST=authentik-db
      - AUTHENTIK_POSTGRESql__USER=${AUTHENTIK_DB_USER}
      - AUTHENTIK_POSTGRESql__NAME=${AUTHENTIK_DB_NAME}
      - AUTHENTIK_POSTGRESql__PASSWORD=${AUTHENTIK_DB_PASSWORD}
      - AUTHENTIK_REDIS__HOST=authentik-redis
      - AUTHENTIK_LISTEN__PORT=9000
      - AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS=0.0.0.0/0,::/0
      - AUTHENTIK_ERROR_REPORTING__ENABLED=false
      - AUTHENTIK_BOOTSTRAP_EMAIL=${AUTHENTIK_BOOTSTRAP_EMAIL}
      - AUTHENTIK_BOOTSTRAP_PASSWORD=${AUTHENTIK_BOOTSTRAP_PASSWORD}
    ports: []  # exposed via nginx
    restart: unless-stopped
    depends_on:
      authentik-db:
        condition: service_healthy
      authentik-redis:
        condition: service_started
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:9000/-/health/live/')\" || exit 1"]
      start_period: 60s
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - authentik_media:/media

  authentik-worker:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2025.2.4}
    command: worker
    environment:
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_POSTGRESql__HOST=authentik-db
      - AUTHENTIK_POSTGRESql__USER=${AUTHENTIK_DB_USER}
      - AUTHENTIK_POSTGRESql__NAME=${AUTHENTIK_DB_NAME}
      - AUTHENTIK_POSTGRESql__PASSWORD=${AUTHENTIK_DB_PASSWORD}
      - AUTHENTIK_REDIS__HOST=authentik-redis
      - AUTHENTIK_LISTEN__PORT=9000
    restart: unless-stopped
    depends_on:
      authentik-db:
        condition: service_healthy
      authentik-redis:
        condition: service_started
    volumes:
      - authentik_media:/media

volumes:
  rag_storage:
    name: llars_rag_storage
  rag_docs:
    name: llars_rag_docs
  authentikdb:
    name: llars_authentikdb
  authentik_media:
    name: llars_authentik_media