docker-compose.prod.yml

version: '3.8'

services:
  # ===========================================
  # API Gateway - Traefik (Official Docker Image)
  # ===========================================
  # SECURITY: TLS is properly configured with Let's Encrypt ACME
  # - HTTP to HTTPS redirect enabled (entrypoints.web.http.redirections)
  # - Automatic certificate management via ACME HTTP challenge
  # - Certificates stored securely in /letsencrypt/acme.json
  # - All backend services use tls.certresolver=letsencrypt
  traefik:
    image: traefik:v3.0
    container_name: grc-traefik
    command:
      - '--api.dashboard=false'
      - '--providers.docker=true'
      - '--providers.docker.exposedbydefault=false'
      - '--entrypoints.web.address=:80'
      - '--entrypoints.websecure.address=:443'
      # SECURITY: Force HTTPS by redirecting all HTTP traffic
      - '--entrypoints.web.http.redirections.entryPoint.to=websecure'
      - '--entrypoints.web.http.redirections.entryPoint.scheme=https'
      # SECURITY: Let's Encrypt ACME for automatic TLS certificate management
      - '--certificatesresolvers.letsencrypt.acme.httpchallenge=true'
      - '--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web'
      - '--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}'
      - '--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json'
      - '--log.level=${TRAEFIK_LOG_LEVEL:-WARN}'
      - '--log.format=json'
      - '--accesslog=true'
      - '--accesslog.format=json'
      - '--accesslog.filepath=/var/log/traefik/access.log'
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_letsencrypt:/letsencrypt
      - traefik_logs:/var/log/traefik
    networks:
      - grc-network
      - grc-dmz
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD', 'traefik', 'healthcheck', '--ping']
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M

  # ===========================================
  # Database - PostgreSQL (Official Docker Image)
  # ===========================================
  postgres:
    image: postgres:16-alpine
    container_name: grc-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_INITDB_ARGS: '--encoding=UTF8 --locale=en_US.UTF-8'
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - postgres_backups:/backups
      - ./database/init:/docker-entrypoint-initdb.d:ro
    networks:
      - grc-network
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    read_only: true
    tmpfs:
      - /tmp
      - /run/postgresql
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    shm_size: 256mb

  # ===========================================
  # Cache & Message Queue - Redis (Official Docker Image)
  # ===========================================
  redis:
    image: redis:7-alpine
    container_name: grc-redis
    command: >
      redis-server --appendonly yes --requirepass ${REDIS_PASSWORD} --maxmemory ${REDIS_MAX_MEMORY:-512mb} --maxmemory-policy allkeys-lru --save 900 1 --save 300 10 --save 60 10000 --loglevel ${REDIS_LOG_LEVEL:-warning}
    volumes:
      - redis_data:/data
    networks:
      - grc-network
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD', 'redis-cli', '-a', '${REDIS_PASSWORD}', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # Authentication - Keycloak (Official Keycloak Image)
  # ===========================================
  keycloak:
    image: quay.io/keycloak/keycloak:25.0
    container_name: grc-keycloak
    command: start --import-realm
    environment:
      # Database
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/${KEYCLOAK_DB:-keycloak}
      KC_DB_USERNAME: ${POSTGRES_USER}
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
      KC_DB_POOL_INITIAL_SIZE: ${KC_DB_POOL_INITIAL_SIZE:-5}
      KC_DB_POOL_MIN_SIZE: ${KC_DB_POOL_MIN_SIZE:-5}
      KC_DB_POOL_MAX_SIZE: ${KC_DB_POOL_MAX_SIZE:-20}

      # Hostname — Traefik handles TLS, so Keycloak serves HTTP behind the proxy
      KC_HOSTNAME: ${KEYCLOAK_HOSTNAME}
      KC_HOSTNAME_STRICT: 'true'
      KC_HOSTNAME_STRICT_HTTPS: 'true'
      KC_PROXY_HEADERS: xforwarded

      # HTTP only — TLS is terminated by Traefik
      KC_HTTP_ENABLED: 'true'

      # Admin
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}

      # Performance — default ispn cache with udp discovery for Docker Compose
      KC_CACHE: ispn

      # Logging
      KC_LOG_LEVEL: ${KC_LOG_LEVEL:-info}
      KC_LOG_CONSOLE_OUTPUT: json

      # Features
      KC_HEALTH_ENABLED: 'true'
      KC_METRICS_ENABLED: 'true'
      KC_HTTP_RELATIVE_PATH: /auth
    volumes:
      - ./auth/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
      - keycloak_data:/opt/keycloak/data
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - grc-network
      - grc-dmz
    labels:
      - 'traefik.enable=true'
      - 'traefik.docker.network=grc-dmz'
      - 'traefik.http.routers.keycloak.rule=Host(`${KEYCLOAK_HOSTNAME}`)'
      - 'traefik.http.routers.keycloak.entrypoints=websecure'
      - 'traefik.http.routers.keycloak.tls.certresolver=letsencrypt'
      - 'traefik.http.services.keycloak.loadbalancer.server.port=8080'
      - 'traefik.http.middlewares.keycloak-headers.headers.customrequestheaders.X-Forwarded-Proto=https'
      - 'traefik.http.routers.keycloak.middlewares=keycloak-headers'
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test:
        [
          'CMD-SHELL',
          "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /auth/health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q '200 OK'",
        ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M

  # ===========================================
  # Object Storage - RustFS (S3-Compatible, Apache 2.0)
  # High-performance Rust-based object storage
  # https://github.com/rustfs/rustfs
  # Pinned by digest so a compromised upstream `:latest` tag cannot
  # silently swap the image at pull time. Reviewers: verify this digest
  # matches the RustFS image currently running in production via
  # `docker image inspect rustfs/rustfs --format '{{.RepoDigests}}'`.
  # ===========================================
  rustfs:
    image: rustfs/rustfs@sha256:8e467b32af3ff83e70c70dddb0c36b5e611f46e89a3075db8770aea4f30b2fe3
    container_name: grc-rustfs
    environment:
      RUSTFS_ROOT_USER: ${MINIO_ROOT_USER}
      RUSTFS_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      RUSTFS_BROWSER: ${MINIO_BROWSER:-on}
      RUSTFS_PROMETHEUS_AUTH_TYPE: public
      RUSTFS_DOMAIN: ${MINIO_DOMAIN:-storage.${APP_DOMAIN}}
    volumes:
      - rustfs_data:/data
      - rustfs_logs:/logs
    networks:
      - grc-network
      - grc-dmz
    labels:
      - 'traefik.enable=true'
      - 'traefik.docker.network=grc-dmz'
      # S3 API
      - 'traefik.http.routers.rustfs-api.rule=Host(`storage.${APP_DOMAIN}`)'
      - 'traefik.http.routers.rustfs-api.entrypoints=websecure'
      - 'traefik.http.routers.rustfs-api.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.rustfs-api.service=rustfs-api'
      - 'traefik.http.services.rustfs-api.loadbalancer.server.port=9000'
      # Console
      - 'traefik.http.routers.rustfs-console.rule=Host(`console.storage.${APP_DOMAIN}`)'
      - 'traefik.http.routers.rustfs-console.entrypoints=websecure'
      - 'traefik.http.routers.rustfs-console.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.rustfs-console.service=rustfs-console'
      - 'traefik.http.services.rustfs-console.loadbalancer.server.port=9001'
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test:
        ['CMD-SHELL', 'wget -q --spider http://localhost:9001/rustfs/console/index.html || exit 1']
      interval: 30s
      timeout: 20s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # Secrets Management - Infisical (Optional)
  # Only starts with: docker compose --profile infisical up -d
  # Set SECRETS_PROVIDER=infisical in .env to use
  # ===========================================
  infisical:
    image: infisical/infisical:v0.158.2
    container_name: grc-infisical
    profiles:
      - infisical
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /etc/ssl/certs
    environment:
      ENCRYPTION_KEY: ${INFISICAL_ENCRYPTION_KEY}
      AUTH_SECRET: ${INFISICAL_AUTH_SECRET}
      DB_CONNECTION_URI: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/infisical
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/1
      SITE_URL: https://secrets.${APP_DOMAIN}
      TELEMETRY_ENABLED: false
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - grc-network
      - grc-dmz
    labels:
      - 'traefik.enable=true'
      - 'traefik.docker.network=grc-dmz'
      - 'traefik.http.routers.infisical.rule=Host(`secrets.${APP_DOMAIN}`)'
      - 'traefik.http.routers.infisical.entrypoints=websecure'
      - 'traefik.http.routers.infisical.tls.certresolver=letsencrypt'
      - 'traefik.http.services.infisical.loadbalancer.server.port=8080'
      - 'traefik.http.middlewares.infisical-ipallow.ipallowlist.sourcerange=10.0.0.0/8,172.16.0.0/12'
      - 'traefik.http.routers.infisical.middlewares=infisical-ipallow'
    restart: always
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test:
        ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:8080/api/status']
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 120s
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # Controls Service - Security Controls Management
  # ===========================================
  controls:
    build:
      context: .
      dockerfile: services/controls/Dockerfile
      args:
        NODE_ENV: production
    image: grc-controls:${IMAGE_TAG:-latest}
    container_name: grc-controls
    environment:
      NODE_ENV: production
      PORT: 3001
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: true
      S3_ACCESS_KEY: ${MINIO_ROOT_USER}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: false
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      KEYCLOAK_URL: http://keycloak:8080/auth
      KEYCLOAK_REALM: ${KEYCLOAK_REALM}
      JWT_SECRET: ${JWT_SECRET}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-100}
      RATE_LIMIT_WINDOW_MS: ${RATE_LIMIT_WINDOW_MS:-60000}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.controls.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/controls`)'
      - 'traefik.http.routers.controls-evidence.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/evidence`)'
      - 'traefik.http.routers.controls-workspaces.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/workspaces`)'
      - 'traefik.http.routers.controls-workspaces.entrypoints=websecure'
      - 'traefik.http.routers.controls-workspaces.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.controls-workspaces.middlewares=controls-ratelimit'
      # Risk module is in controls service, not frameworks
      - 'traefik.http.routers.controls-risks.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/risks`)'
      - 'traefik.http.routers.controls-risks.entrypoints=websecure'
      - 'traefik.http.routers.controls-risks.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.controls-risks.middlewares=controls-ratelimit'
      - 'traefik.http.routers.controls-risk-config.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/risk-config`)'
      - 'traefik.http.routers.controls-risk-config.entrypoints=websecure'
      - 'traefik.http.routers.controls-risk-config.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.controls-risk-config.middlewares=controls-ratelimit'
      - 'traefik.http.routers.controls-risk-tasks.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/risk-tasks`)'
      - 'traefik.http.routers.controls-risk-tasks.entrypoints=websecure'
      - 'traefik.http.routers.controls-risk-tasks.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.controls-risk-tasks.middlewares=controls-ratelimit'
      - 'traefik.http.routers.controls.entrypoints=websecure'
      - 'traefik.http.routers.controls.tls.certresolver=letsencrypt'
      - 'traefik.http.services.controls.loadbalancer.server.port=3001'
      - 'traefik.http.middlewares.controls-ratelimit.ratelimit.average=100'
      - 'traefik.http.middlewares.controls-ratelimit.ratelimit.burst=50'
      - 'traefik.http.routers.controls.middlewares=controls-ratelimit'
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /app/.npm
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:3001/health']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # Frameworks Service - Compliance Frameworks & Risk Management
  # ===========================================
  frameworks:
    build:
      context: .
      dockerfile: services/frameworks/Dockerfile
      args:
        NODE_ENV: production
    image: grc-frameworks:${IMAGE_TAG:-latest}
    container_name: grc-frameworks
    environment:
      NODE_ENV: production
      PORT: 3002
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: true
      S3_ACCESS_KEY: ${MINIO_ROOT_USER}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: false
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      KEYCLOAK_URL: http://keycloak:8080/auth
      KEYCLOAK_REALM: ${KEYCLOAK_REALM}
      JWT_SECRET: ${JWT_SECRET}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-100}
      RATE_LIMIT_WINDOW_MS: ${RATE_LIMIT_WINDOW_MS:-60000}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.frameworks.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/frameworks`)'
      - 'traefik.http.routers.frameworks.entrypoints=websecure'
      - 'traefik.http.routers.frameworks.tls.certresolver=letsencrypt'
      - 'traefik.http.services.frameworks.loadbalancer.server.port=3002'
      - 'traefik.http.middlewares.frameworks-ratelimit.ratelimit.average=100'
      - 'traefik.http.middlewares.frameworks-ratelimit.ratelimit.burst=50'
      - 'traefik.http.routers.frameworks.middlewares=frameworks-ratelimit'
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /app/.npm
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:3002/health']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # Policies Service - Policy Center
  # ===========================================
  policies:
    build:
      context: .
      dockerfile: services/policies/Dockerfile
      args:
        NODE_ENV: production
    image: grc-policies:${IMAGE_TAG:-latest}
    container_name: grc-policies
    environment:
      NODE_ENV: production
      PORT: 3004
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: true
      S3_ACCESS_KEY: ${MINIO_ROOT_USER}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: false
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      KEYCLOAK_URL: http://keycloak:8080/auth
      KEYCLOAK_REALM: ${KEYCLOAK_REALM}
      JWT_SECRET: ${JWT_SECRET}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-100}
      RATE_LIMIT_WINDOW_MS: ${RATE_LIMIT_WINDOW_MS:-60000}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.policies.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/policies`)'
      - 'traefik.http.routers.policies.entrypoints=websecure'
      - 'traefik.http.routers.policies.tls.certresolver=letsencrypt'
      - 'traefik.http.services.policies.loadbalancer.server.port=3004'
      - 'traefik.http.middlewares.policies-ratelimit.ratelimit.average=100'
      - 'traefik.http.middlewares.policies-ratelimit.ratelimit.burst=50'
      - 'traefik.http.routers.policies.middlewares=policies-ratelimit'
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /app/.npm
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:3004/health']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # TPRM Service - Third Party Risk Management
  # ===========================================
  tprm:
    build:
      context: .
      dockerfile: services/tprm/Dockerfile
      args:
        NODE_ENV: production
    image: grc-tprm:${IMAGE_TAG:-latest}
    container_name: grc-tprm
    environment:
      NODE_ENV: production
      PORT: 3005
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: true
      S3_ACCESS_KEY: ${MINIO_ROOT_USER}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: false
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      KEYCLOAK_URL: http://keycloak:8080/auth
      KEYCLOAK_REALM: ${KEYCLOAK_REALM}
      JWT_SECRET: ${JWT_SECRET}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-100}
      RATE_LIMIT_WINDOW_MS: ${RATE_LIMIT_WINDOW_MS:-60000}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.tprm-vendors.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/vendors`)'
      - 'traefik.http.routers.tprm-assessments.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/assessments`)'
      - 'traefik.http.routers.tprm-contracts.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/contracts`)'
      - 'traefik.http.routers.tprm-vendors.entrypoints=websecure'
      - 'traefik.http.routers.tprm-vendors.tls.certresolver=letsencrypt'
      - 'traefik.http.services.tprm.loadbalancer.server.port=3005'
      - 'traefik.http.middlewares.tprm-ratelimit.ratelimit.average=100'
      - 'traefik.http.middlewares.tprm-ratelimit.ratelimit.burst=50'
      - 'traefik.http.routers.tprm-vendors.middlewares=tprm-ratelimit'
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /app/.npm
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:3005/health']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # Trust Service - Questionnaires & Knowledge Base
  # ===========================================
  trust:
    build:
      context: .
      dockerfile: services/trust/Dockerfile
      args:
        NODE_ENV: production
    image: grc-trust:${IMAGE_TAG:-latest}
    container_name: grc-trust
    environment:
      NODE_ENV: production
      PORT: 3006
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: true
      S3_ACCESS_KEY: ${MINIO_ROOT_USER}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: false
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      KEYCLOAK_URL: http://keycloak:8080/auth
      KEYCLOAK_REALM: ${KEYCLOAK_REALM}
      JWT_SECRET: ${JWT_SECRET}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-100}
      RATE_LIMIT_WINDOW_MS: ${RATE_LIMIT_WINDOW_MS:-60000}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.trust-questionnaires.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/questionnaires`)'
      - 'traefik.http.routers.trust-knowledge-base.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/knowledge-base`)'
      - 'traefik.http.routers.trust-center.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/trust-center`)'
      - 'traefik.http.routers.trust-questionnaires.entrypoints=websecure'
      - 'traefik.http.routers.trust-questionnaires.tls.certresolver=letsencrypt'
      - 'traefik.http.services.trust.loadbalancer.server.port=3006'
      - 'traefik.http.middlewares.trust-ratelimit.ratelimit.average=100'
      - 'traefik.http.middlewares.trust-ratelimit.ratelimit.burst=50'
      - 'traefik.http.routers.trust-questionnaires.middlewares=trust-ratelimit'
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /app/.npm
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:3006/health']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # Audit Service - Internal & External Audits
  # ===========================================
  audit:
    build:
      context: .
      dockerfile: services/audit/Dockerfile
      args:
        NODE_ENV: production
    image: grc-audit:${IMAGE_TAG:-latest}
    container_name: grc-audit
    environment:
      NODE_ENV: production
      PORT: 3007
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: true
      S3_ACCESS_KEY: ${MINIO_ROOT_USER}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: false
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      KEYCLOAK_URL: http://keycloak:8080/auth
      KEYCLOAK_REALM: ${KEYCLOAK_REALM}
      JWT_SECRET: ${JWT_SECRET}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-100}
      RATE_LIMIT_WINDOW_MS: ${RATE_LIMIT_WINDOW_MS:-60000}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.audit-audits.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/audits`)'
      - 'traefik.http.routers.audit-requests.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/audit-requests`)'
      - 'traefik.http.routers.audit-findings.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/audit-findings`)'
      - 'traefik.http.routers.audit-portal.rule=Host(`${APP_DOMAIN}`) && PathPrefix(`/api/audit-portal`)'
      - 'traefik.http.routers.audit-audits.entrypoints=websecure'
      - 'traefik.http.routers.audit-audits.tls.certresolver=letsencrypt'
      - 'traefik.http.services.audit.loadbalancer.server.port=3007'
      - 'traefik.http.middlewares.audit-ratelimit.ratelimit.average=100'
      - 'traefik.http.middlewares.audit-ratelimit.ratelimit.burst=50'
      - 'traefik.http.routers.audit-audits.middlewares=audit-ratelimit'
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /app/.npm
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:3007/health']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # Frontend - React SPA with Nginx
  # ===========================================
  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
      args:
        VITE_API_URL: ''
        VITE_ENABLE_DEV_AUTH: 'false'
    image: grc-frontend:${IMAGE_TAG:-latest}
    container_name: grc-frontend
    depends_on:
      - controls
    networks:
      - grc-network
      - grc-dmz
    labels:
      - 'traefik.enable=true'
      - 'traefik.docker.network=grc-dmz'
      - 'traefik.http.routers.frontend.rule=Host(`${APP_DOMAIN}`)'
      - 'traefik.http.routers.frontend.entrypoints=websecure'
      - 'traefik.http.routers.frontend.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.frontend.priority=1'
      - 'traefik.http.services.frontend.loadbalancer.server.port=80'
      - 'traefik.http.middlewares.frontend-headers.headers.stsSeconds=31536000'
      - 'traefik.http.middlewares.frontend-headers.headers.stsIncludeSubdomains=true'
      - 'traefik.http.middlewares.frontend-headers.headers.stsPreload=true'
      - 'traefik.http.middlewares.frontend-headers.headers.contentTypeNosniff=true'
      - 'traefik.http.middlewares.frontend-headers.headers.frameDeny=true'
      - 'traefik.http.routers.frontend.middlewares=frontend-headers'
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /var/cache/nginx
      - /run
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:80/']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M

  # ===========================================
  # Backup Scheduler - Automated Backups
  # ===========================================
  # The backup scheduler is a plain network peer on grc-network. It uses
  # pg_dump / redis-cli / aws s3 to extract data directly from postgres,
  # redis and rustfs over TCP. It does NOT mount /var/run/docker.sock - a
  # compromised backup container can no longer introspect or operate on
  # other containers on the host.
  backup-scheduler:
    build:
      context: ./deploy
      dockerfile: Dockerfile.backup-scheduler
    image: grc-backup-scheduler:${IMAGE_TAG:-latest}
    container_name: grc-backup-scheduler
    environment:
      TZ: ${TZ:-UTC}
      BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-90}
      DR_REMOTE_BACKUP_ENABLED: ${DR_REMOTE_BACKUP_ENABLED:-false}
      DR_REMOTE_BACKUP_S3_BUCKET: ${DR_REMOTE_BACKUP_S3_BUCKET:-}
      DR_REMOTE_BACKUP_REGION: ${DR_REMOTE_BACKUP_REGION:-us-east-1}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      # PostgreSQL access (network)
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      # Redis access (network)
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      # RustFS / S3 access (network)
      S3_ENDPOINT: http://rustfs:9000
      S3_BUCKET: ${S3_BUCKET:-grc-storage}
      S3_REGION: ${S3_REGION:-us-east-1}
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      SLACK_ENABLED: ${SLACK_ENABLED:-false}
      SLACK_WEBHOOK_URL: ${SLACK_WEBHOOK_URL:-}
    volumes:
      - grc_backups:/backups
      # Mounted read-only so configuration files can be captured in the
      # backup archive. No docker socket is required.
      - ./docker-compose.prod.yml:/app/docker-compose.prod.yml:ro
      - ./.env.prod:/app/.env.prod:ro
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - grc-network
    restart: always
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M

networks:
  grc-network:
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.20.0.0/16
  grc-dmz:
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.0.0/16

volumes:
  postgres_data:
    driver: local
  postgres_backups:
    driver: local
  redis_data:
    driver: local
  rustfs_data:
    driver: local
  rustfs_logs:
    driver: local
  keycloak_data:
    driver: local
  traefik_letsencrypt:
    driver: local
  traefik_logs:
    driver: local
  grc_backups:
    driver: local