docker-compose.yml

version: '3.8'

services:
  # ====================
  # Database Services
  # ====================
  
  postgres:
    image: postgres:16-alpine
    container_name: document-analyzer-postgres
    environment:
      POSTGRES_USER: document_analyzer
      POSTGRES_PASSWORD: secure_password_change_in_production
      POSTGRES_DB: document_analyzer
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./backend/scripts/init-db.sql:/docker-entrypoint-initdb.d/init.sql
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U document_analyzer"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - document-analyzer-network
    restart: unless-stopped

  # Vector Database for embeddings
  qdrant:
    image: qdrant/qdrant:latest
    container_name: document-analyzer-qdrant
    volumes:
      - qdrant_data:/qdrant/storage
    ports:
      - "6333:6333"
      - "6334:6334"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:6333/"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - document-analyzer-network
    restart: unless-stopped

  # Graph Database for knowledge graph
  neo4j:
    image: neo4j:5.15
    container_name: document-analyzer-neo4j
    environment:
      NEO4J_AUTH: neo4j/secure_password_change_in_production
      NEO4J_PLUGINS: '["apoc"]'
    volumes:
      - neo4j_data:/data
    ports:
      - "7474:7474"  # HTTP
      - "7687:7687"  # Bolt
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:7474"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - document-analyzer-network
    restart: unless-stopped

  # ====================
  # Cache & Message Queue
  # ====================
  
  redis:
    image: redis:7-alpine
    container_name: document-analyzer-redis
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - document-analyzer-network
    restart: unless-stopped

  # ====================
  # Workflow Engine
  # ====================
  
  temporal:
    image: temporalio/auto-setup:1.22
    container_name: document-analyzer-temporal
    environment:
      - DB=postgresql
      - DB_PORT=5432
      - POSTGRES_USER=document_analyzer
      - POSTGRES_PWD=secure_password_change_in_production
      - POSTGRES_SEEDS=postgres
      - DYNAMIC_CONFIG_FILE_PATH=config/dynamicconfig/development.yaml
    ports:
      - "7233:7233"  # Frontend
      - "8233:8233"  # Web UI
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./backend/temporal-config:/etc/temporal/config/dynamicconfig
    networks:
      - document-analyzer-network
    restart: unless-stopped

  temporal-ui:
    image: temporalio/ui:2.21.0
    container_name: document-analyzer-temporal-ui
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
      - TEMPORAL_CORS_ORIGINS=http://localhost:3000
    ports:
      - "8081:8080"
    depends_on:
      - temporal
    networks:
      - document-analyzer-network
    restart: unless-stopped

  # ====================
  # Backend Services
  # ====================
  
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: document-analyzer-backend
    environment:
      - APP_ENV=production
      - APP_DEBUG=false
      - APP_URL=http://localhost:8000
      
      - DATABASE_URL=postgresql://document_analyzer:secure_password_change_in_production@postgres:5432/document_analyzer
      - REDIS_URL=redis://redis:6379
      
      - SECRET_KEY=change_this_to_a_secure_random_key_in_production
      
      - QDRANT_URL=http://qdrant:6333
      - NEO4J_URI=neo4j://neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=secure_password_change_in_production
      
      - TEMPORAL_HOST=temporal
      - TEMPORAL_PORT=7233
      
      - CORS_ORIGINS=http://localhost:3000,http://frontend:3000
      
      # LLM Provider Keys (optional)
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      
      # Search API Keys (optional)
      - GOOGLE_SEARCH_API_KEY=${GOOGLE_SEARCH_API_KEY:-}
      - BING_SEARCH_API_KEY=${BING_SEARCH_API_KEY:-}
    volumes:
      - ./backend/app:/app/app
      - ./backend/logs:/app/logs
      - workspace_data:/app/workspaces
    ports:
      - "8000:8000"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      temporal:
        condition: service_started
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - document-analyzer-network
    restart: unless-stopped
    command: >
      bash -c "
        poetry run alembic upgrade head &&
        poetry run uvicorn app.main:app --host 0.0.0.0 --port 8000
      "

  # Backend worker for Temporal workflows
  backend-worker:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: document-analyzer-backend-worker
    environment:
      - APP_ENV=production
      - DATABASE_URL=postgresql://document_analyzer:secure_password_change_in_production@postgres:5432/document_analyzer
      - REDIS_URL=redis://redis:6379
      - QDRANT_URL=http://qdrant:6333
      - NEO4J_URI=neo4j://neo4j:7687
      - TEMPORAL_HOST=temporal
      - TEMPORAL_PORT=7233
    volumes:
      - ./backend/app:/app/app
      - ./backend/logs:/app/logs
      - workspace_data:/app/workspaces
    depends_on:
      - backend
      - temporal
    networks:
      - document-analyzer-network
    restart: unless-stopped
    command: >
      bash -c "
        poetry run python -m app.workflow.engine
      "

  # ====================
  # Frontend Service
  # ====================
  
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        - NEXT_PUBLIC_API_URL=http://localhost:8000
        - NEXT_PUBLIC_WS_URL=ws://localhost:8000
    container_name: document-analyzer-frontend
    environment:
      - NEXT_PUBLIC_API_URL=http://localhost:8000
      - NEXT_PUBLIC_WS_URL=ws://localhost:8000
    ports:
      - "3000:3000"
    depends_on:
      - backend
    networks:
      - document-analyzer-network
    restart: unless-stopped

  # ====================
  # Monitoring & Observability
  # ====================
  
  prometheus:
    image: prom/prometheus:latest
    container_name: document-analyzer-prometheus
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
    ports:
      - "9090:9090"
    networks:
      - document-analyzer-network
    restart: unless-stopped

  grafana:
    image: grafana/grafana:latest
    container_name: document-analyzer-grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin_change_in_production
      - GF_USERS_ALLOW_SIGN_UP=false
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards
      - ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources
    ports:
      - "3001:3000"
    depends_on:
      - prometheus
    networks:
      - document-analyzer-network
    restart: unless-stopped

  # ====================
  # File Storage (MinIO for S3-compatible storage)
  # ====================
  
  minio:
    image: minio/minio:latest
    container_name: document-analyzer-minio
    environment:
      - MINIO_ROOT_USER=minioadmin_change_in_production
      - MINIO_ROOT_PASSWORD=minioadmin_change_in_production
    volumes:
      - minio_data:/data
    ports:
      - "9000:9000"
      - "9001:9001"
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 20s
      retries: 3
    networks:
      - document-analyzer-network
    restart: unless-stopped

  # Create MinIO bucket on startup
  minio-init:
    image: minio/mc:latest
    container_name: document-analyzer-minio-init
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set myminio http://minio:9000 minioadmin_change_in_production minioadmin_change_in_production;
      mc mb myminio/documents --ignore-existing;
      mc mb myminio/workspaces --ignore-existing;
      mc mb myminio/artifacts --ignore-existing;
      exit 0;
      "
    networks:
      - document-analyzer-network

networks:
  document-analyzer-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16

volumes:
  postgres_data:
    driver: local
  qdrant_data:
    driver: local
  neo4j_data:
    driver: local
  redis_data:
    driver: local
  workspace_data:
    driver: local
  minio_data:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local

# ====================
# Security Notes
# ====================
# IMPORTANT: Before deploying to production:
# 1. Change all passwords in environment variables
# 2. Generate a secure SECRET_KEY for backend
# 3. Enable SSL/TLS for all endpoints
# 4. Configure proper network policies
# 5. Set up secrets management (Vault, AWS Secrets Manager)
# 6. Enable audit logging
# 7. Configure backup strategies for all volumes
# 8. Set up monitoring alerts
# 9. Implement rate limiting
# 10. Review and harden security configurations