docker-compose.production.yml

version: '3.8'

services:
  # NEXUS Application (Production)
  nexus-app:
    build:
      context: .
      dockerfile: Dockerfile.production
    container_name: nexus-app-production
    restart: unless-stopped
    ports:
      - "3000:3000"
    env_file:
      - ./config/production.env
    environment:
      - NODE_ENV=production
    volumes:
      - ./logs:/var/log/nexus
      - ./uploads:/var/uploads/nexus
      - ./reports:/var/log/nexus/reports
    depends_on:
      - mongodb
      - redis
      - prometheus
    networks:
      - nexus-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # MongoDB Database (Production)
  mongodb:
    image: mongo:6.0
    container_name: nexus-mongodb-production
    restart: unless-stopped
    ports:
      - "27017:27017"
    environment:
      - MONGO_INITDB_ROOT_USERNAME=admin
      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_ROOT_PASSWORD}
      - MONGO_INITDB_DATABASE=nexus-production
    volumes:
      - mongodb-data:/data/db
      - mongodb-config:/data/configdb
      - ./scripts/mongo-init.js:/docker-entrypoint-initdb.d/mongo-init.js:ro
    networks:
      - nexus-network
    command: mongod --auth --bind_ip_all

  # Redis Cache (Production)
  redis:
    image: redis:7-alpine
    container_name: nexus-redis-production
    restart: unless-stopped
    ports:
      - "6379:6379"
    environment:
      - REDIS_PASSWORD=${REDIS_PASSWORD}
    volumes:
      - redis-data:/data
      - ./config/redis.conf:/usr/local/etc/redis/redis.conf:ro
    networks:
      - nexus-network
    command: redis-server /usr/local/etc/redis/redis.conf
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Prometheus (Production)
  prometheus:
    image: prom/prometheus:v2.40.0
    container_name: nexus-prometheus-production
    restart: unless-stopped
    ports:
      - "9090:9090"
    environment:
      - PROMETHEUS_CONFIG_FILE=/etc/prometheus/prometheus.yml
    volumes:
      - ./monitoring/prometheus/production.yml:/etc/prometheus/prometheus.yml:ro
      - ./monitoring/prometheus/rules:/etc/prometheus/rules:ro
      - prometheus-data:/prometheus
      - ./logs:/var/log/nexus:ro
    networks:
      - nexus-network
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=30d'
      - '--storage.tsdb.retention.size=50GB'
      - '--web.enable-lifecycle'
      - '--web.enable-admin-api'
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9090/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Grafana (Production)
  grafana:
    image: grafana/grafana:9.3.0
    container_name: nexus-grafana-production
    restart: unless-stopped
    ports:
      - "3001:3000"
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GF_SECURITY_SECRET_KEY=${GRAFANA_SECRET_KEY}
      - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource,grafana-piechart-panel
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_USERS_ALLOW_ORG_CREATE=false
      - GF_AUTH_ANONYMOUS_ENABLED=false
      - GF_SECURITY_DISABLE_GRAVATAR=true
      - GF_SECURITY_COOKIE_SECURE=true
      - GF_SECURITY_COOKIE_SAMESITE=strict
      - GF_SECURITY_CONTENT_TYPE_PROTECTION=true
      - GF_SECURITY_X_CONTENT_TYPE_OPTIONS=nosniff
      - GF_SECURITY_X_XSS_PROTECTION=1; mode=block
    volumes:
      - grafana-data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
    networks:
      - nexus-network
    depends_on:
      - prometheus
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3000/api/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

  # AlertManager (Production)
  alertmanager:
    image: prom/alertmanager:v0.25.0
    container_name: nexus-alertmanager-production
    restart: unless-stopped
    ports:
      - "9093:9093"
    environment:
      - AM_CONFIG_FILE=/etc/alertmanager/alertmanager.yml
    volumes:
      - ./monitoring/alertmanager/production.yml:/etc/alertmanager/alertmanager.yml:ro
      - alertmanager-data:/alertmanager
      - ./monitoring/alertmanager/templates:/etc/alertmanager/templates:ro
    networks:
      - nexus-network
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
      - '--web.external-url=http://localhost:9093'
      - '--web.route-prefix=/'
      - '--log.level=info'
      - '--cluster.listen-address=0.0.0.0:9094'
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9093/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Node Exporter (Production)
  node-exporter:
    image: prom/node-exporter:v1.5.0
    container_name: nexus-node-exporter-production
    restart: unless-stopped
    ports:
      - "9100:9100"
    environment:
      - NODE_ID=node-exporter-prod
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    networks:
      - nexus-network
    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9100/metrics"]
      interval: 30s
      timeout: 10s
      retries: 3

  # MongoDB Exporter (Production)
  mongodb-exporter:
    image: percona/mongodb_exporter:0.37.0
    container_name: nexus-mongodb-exporter-production
    restart: unless-stopped
    ports:
      - "9216:9216"
    environment:
      - MONGODB_URI=mongodb://admin:${MONGO_ROOT_PASSWORD}@mongodb:27017
      - MONGODB_EXPORTER_WEB_LISTEN_ADDRESS=:9216
      - MONGODB_EXPORTER_LOG_LEVEL=info
    networks:
      - nexus-network
    depends_on:
      - mongodb
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9216/metrics"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Nginx Reverse Proxy (Production)
  nginx:
    image: nginx:1.23-alpine
    container_name: nexus-nginx-production
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./ssl:/etc/nginx/ssl:ro
      - ./logs/nginx:/var/log/nginx
    networks:
      - nexus-network
    depends_on:
      - nexus-app
      - grafana
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Log Management (ELK Stack)
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.5.0
    container_name: nexus-elasticsearch-production
    restart: unless-stopped
    environment:
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms512m -Xmx512m
      - xpack.security.enabled=false
      - xpack.monitoring.collection.enabled=false
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    networks:
      - nexus-network
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:9200/_cluster/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

  logstash:
    image: docker.elastic.co/logstash/logstash:8.5.0
    container_name: nexus-logstash-production
    restart: unless-stopped
    environment:
      - "LS_JAVA_OPTS=-Xmx256m -Xms256m"
    volumes:
      - ./monitoring/logstash/pipeline:/usr/share/logstash/pipeline:ro
      - ./monitoring/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
      - ./logs:/var/log/nexus:ro
    networks:
      - nexus-network
    depends_on:
      - elasticsearch
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:9600 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

  kibana:
    image: docker.elastic.co/kibana/kibana:8.5.0
    container_name: nexus-kibana-production
    restart: unless-stopped
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    networks:
      - nexus-network
    depends_on:
      - elasticsearch
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:5601/api/status || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Backup Service
  backup:
    image: alpine:3.17
    container_name: nexus-backup-production
    restart: unless-stopped
    environment:
      - BACKUP_SCHEDULE=${BACKUP_SCHEDULE:-0 2 * * *}
      - BACKUP_RETENTION_DAYS=${BACKUP_RETENTION_DAYS:-30}
    volumes:
      - ./scripts/backup.sh:/backup.sh:ro
      - ./backups:/backups
      - mongodb-data:/data/mongodb:ro
      - grafana-data:/data/grafana:ro
      - prometheus-data:/data/prometheus:ro
    networks:
      - nexus-network
    command: >
      sh -c "
        apk add --no-cache curl mongodb-tools &&
        echo '${BACKUP_SCHEDULE} /backup.sh' | crontab - &&
        crond -f
      "

  # Health Check Service
  health-check:
    image: alpine:3.17
    container_name: nexus-health-check-production
    restart: unless-stopped
    environment:
      - CHECK_INTERVAL=60
      - NEXUS_URL=http://nexus-app:3000
      - PROMETHEUS_URL=http://prometheus:9090
      - GRAFANA_URL=http://grafana:3000
    volumes:
      - ./scripts/health-check.sh:/health-check.sh:ro
    networks:
      - nexus-network
    command: >
      sh -c "
        apk add --no-cache curl jq &&
        while true; do
          /health-check.sh
          sleep ${CHECK_INTERVAL}
        done
      "

networks:
  nexus-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

volumes:
  mongodb-data:
    driver: local
  mongodb-config:
    driver: local
  redis-data:
    driver: local
  prometheus-data:
    driver: local
  grafana-data:
    driver: local
  alertmanager-data:
    driver: local
  elasticsearch-data:
    driver: local

# Production deployment configuration
# Usage:
# 1. Set environment variables in .env file
# 2. Create SSL certificates in ./ssl directory
# 3. Configure nginx in ./nginx directory
# 4. Run: docker-compose -f docker-compose.production.yml up -d
# 5. Monitor with: docker-compose -f docker-compose.production.yml logs -f