docker-compose.yml

# ===========================================
# DEVELOPMENT DOCKER COMPOSE
# ===========================================
#
# SECURITY WARNING: This file contains default credentials for development only.
# DO NOT use this file in production!
#
# For production deployments, use docker-compose.prod.yml which:
# - Requires all credentials to be set via environment variables
# - Enables TLS/HTTPS with Let's Encrypt
# - Applies security hardening (read-only containers, cap_drop, etc.)
# - Disables API dashboards and debug endpoints
#
# Before deploying to production, ensure all secrets are rotated
# and stored securely (e.g., in a secrets manager or .env file
# with restricted permissions).
# ===========================================

services:
  # ===========================================
  # API Gateway - Traefik (Official Docker Image)
  # ===========================================
  traefik:
    image: traefik:v3.0
    container_name: grc-traefik
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    command:
      # SECURITY: api.insecure is only for development - NEVER use in production
      - '--api.insecure=${TRAEFIK_API_INSECURE:-false}'
      - '--api.dashboard=${TRAEFIK_DASHBOARD_ENABLED:-false}'
      - '--providers.docker=true'
      - '--providers.docker.exposedbydefault=false'
      - '--entrypoints.web.address=:80'
      - '--entrypoints.websecure.address=:443'
      - '--log.level=${TRAEFIK_LOG_LEVEL:-INFO}'
    ports:
      - '80:80'
      - '443:443'
      # Dashboard port only exposed if explicitly enabled
      - '${TRAEFIK_DASHBOARD_PORT:-127.0.0.1:8090}:8080'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./gateway/traefik.yml:/etc/traefik/traefik.yml:ro
    networks:
      - grc-network
    restart: unless-stopped

  # ===========================================
  # Database - PostgreSQL (Docker Hardened Image)
  # ===========================================
  postgres:
    image: postgres:16-alpine
    container_name: grc-postgres
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    environment:
      # SECURITY: POSTGRES_PASSWORD must be set - no default value
      # Run: export POSTGRES_PASSWORD=$(openssl rand -base64 32)
      POSTGRES_USER: ${POSTGRES_USER:?POSTGRES_USER is required}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required - set a strong password}
      POSTGRES_DB: ${POSTGRES_DB:-gigachad_grc}
    ports:
      - '127.0.0.1:5433:5432' # Using 5433 externally to avoid conflicts
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./database/init:/docker-entrypoint-initdb.d
    networks:
      - grc-network
    restart: unless-stopped
    # Resource limits - example configuration for development
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 256M
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-grc} -d ${POSTGRES_DB:-gigachad_grc}']
      # First boot runs every script under database/init/ (creates keycloak + infisical DBs,
      # 26+ SQL files for soft-delete, BCDR, enums, indexes, etc.). On a slow / contended CI
      # runner this can easily push past 30s. We've seen `docker compose up -d` exit non-zero
      # with "dependency failed to start: grc-postgres is unhealthy" on PRs #320 and #321
      # despite the previous 30s budget. Bumped headroom + retry total so the dependency wait
      # has 60s of init grace + 80s of polling = ~140s total before compose gives up.
      start_period: 60s
      interval: 10s
      timeout: 5s
      retries: 8
      start_interval: 5s

  # ===========================================
  # Cache & Message Queue - Redis (Docker Hardened Image)
  # ===========================================
  redis:
    image: redis:7-alpine
    container_name: grc-redis
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    # SECURITY: REDIS_PASSWORD must be set - no default value
    # Run: export REDIS_PASSWORD=$(openssl rand -base64 32)
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    ports:
      - '127.0.0.1:6380:6379' # Using 6380 externally to avoid conflicts
    volumes:
      - redis_data:/data
    networks:
      - grc-network
    restart: unless-stopped
    # Resource limits - example configuration for development
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    healthcheck:
      test: ['CMD', 'redis-cli', '-a', '${REDIS_PASSWORD}', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5

  # ===========================================
  # Authentication - Keycloak (Official Keycloak Image)
  # ===========================================
  keycloak:
    image: quay.io/keycloak/keycloak:25.0
    container_name: grc-keycloak
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    command: start-dev --import-realm
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/${KEYCLOAK_DB:-keycloak}
      KC_DB_USERNAME: ${POSTGRES_USER:-grc}
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      KC_HOSTNAME: ${KEYCLOAK_HOSTNAME:-localhost}
      KC_HOSTNAME_PORT: ${KEYCLOAK_PORT:-8080}
      KC_HOSTNAME_STRICT: 'false'
      KC_HOSTNAME_STRICT_HTTPS: 'false'
      KC_HTTP_ENABLED: 'true'
      # SECURITY: KEYCLOAK_ADMIN_PASSWORD must be set - no default value
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:?KEYCLOAK_ADMIN_PASSWORD is required}
    ports:
      # SECURITY: Bound to localhost - access via Traefik in production
      # Direct port access only for local development/debugging
      - '127.0.0.1:8080:8080'
    volumes:
      - ./auth/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.keycloak.rule=Host(`auth.localhost`)'
      - 'traefik.http.services.keycloak.loadbalancer.server.port=8080'
    restart: unless-stopped

  # ===========================================
  # Object Storage - RustFS (S3-Compatible, Apache 2.0)
  # High-performance Rust-based object storage
  # https://github.com/rustfs/rustfs
  # Pinned by digest to match docker-compose.prod.yml.
  # ===========================================
  rustfs:
    image: rustfs/rustfs@sha256:8e467b32af3ff83e70c70dddb0c36b5e611f46e89a3075db8770aea4f30b2fe3
    container_name: grc-rustfs
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    environment:
      RUSTFS_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      RUSTFS_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
    ports:
      # SECURITY: Bound to localhost - internal services access via Docker network
      # Direct port access only for local development/debugging
      - '127.0.0.1:9000:9000' # S3 API
      - '127.0.0.1:9001:9001' # Console
    volumes:
      - rustfs_data:/data
      - rustfs_logs:/logs
    networks:
      - grc-network
    restart: unless-stopped
    healthcheck:
      test:
        ['CMD-SHELL', 'wget -q --spider http://localhost:9001/rustfs/console/index.html || exit 1']
      interval: 30s
      timeout: 20s
      retries: 3
      start_period: 10s

  # ===========================================
  # Secrets Management - Infisical (Optional)
  # Only starts with: docker compose --profile infisical up -d
  # Set SECRETS_PROVIDER=infisical in .env to use
  # ===========================================
  infisical:
    image: infisical/infisical:v0.158.2
    container_name: grc-infisical
    profiles:
      - infisical
    security_opt:
      - no-new-privileges:true
    environment:
      ENCRYPTION_KEY: ${INFISICAL_ENCRYPTION_KEY:-}
      AUTH_SECRET: ${INFISICAL_AUTH_SECRET:-}
      DB_CONNECTION_URI: postgresql://${POSTGRES_USER:?}:${POSTGRES_PASSWORD:?}@postgres:5432/infisical
      REDIS_URL: redis://:${REDIS_PASSWORD:?}@redis:6379/1
      SITE_URL: http://localhost:8443
      TELEMETRY_ENABLED: false
    ports:
      - '127.0.0.1:8443:8080'
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - grc-network
    restart: unless-stopped
    healthcheck:
      test:
        ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:8080/api/status']
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 120s
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================
  # Controls Service - Security Controls Management
  # ===========================================
  controls:
    build:
      context: .
      dockerfile: services/controls/Dockerfile
    container_name: grc-controls
    security_opt:
      - no-new-privileges:true
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      PORT: 3001
      DATABASE_URL: postgresql://${POSTGRES_USER:?POSTGRES_USER is required}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/${POSTGRES_DB:-gigachad_grc}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: ${MINIO_USE_SSL:-true}
      S3_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      # Legacy MinIO env vars (for backwards compatibility)
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: ${MINIO_USE_SSL:-true}
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_REALM: ${KEYCLOAK_REALM:-gigachad-grc}
      # Security secrets
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?ENCRYPTION_KEY is required}
      JWT_SECRET: ${JWT_SECRET:-}
      SESSION_SECRET: ${SESSION_SECRET:-}
      PHISHING_TRACKING_SECRET: ${PHISHING_TRACKING_SECRET:?PHISHING_TRACKING_SECRET is required}
      # Backup configuration
      BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-30}
      DR_REMOTE_BACKUP_ENABLED: ${DR_REMOTE_BACKUP_ENABLED:-false}
      DR_REMOTE_BACKUP_S3_BUCKET: ${DR_REMOTE_BACKUP_S3_BUCKET:-}
    ports:
      # SECURITY: Bound to localhost - access via Traefik gateway
      # Direct port access only for local development/debugging
      - '127.0.0.1:3001:3001'
    volumes:
      - ./deploy:/app/deploy:ro
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_started
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.controls.rule=PathPrefix(`/api/controls`)'
      # SECURITY: Apply rate limiting and security headers middleware to all controls routes
      - 'traefik.http.routers.controls.middlewares=api-security@file'
      - 'traefik.http.routers.controls-evidence.rule=PathPrefix(`/api/evidence`)'
      - 'traefik.http.routers.controls-evidence.middlewares=api-security@file'
      - 'traefik.http.routers.controls-workspaces.rule=PathPrefix(`/api/workspaces`)'
      - 'traefik.http.routers.controls-workspaces.middlewares=api-security@file'
      # Risk module is in controls service, not frameworks
      - 'traefik.http.routers.controls-risks.rule=PathPrefix(`/api/risks`)'
      - 'traefik.http.routers.controls-risks.middlewares=api-security@file'
      - 'traefik.http.routers.controls-risk-config.rule=PathPrefix(`/api/risk-config`)'
      - 'traefik.http.routers.controls-risk-config.middlewares=api-security@file'
      - 'traefik.http.routers.controls-risk-tasks.rule=PathPrefix(`/api/risk-tasks`)'
      - 'traefik.http.routers.controls-risk-tasks.middlewares=api-security@file'
      # BC/DR module is also in controls service
      - 'traefik.http.routers.controls-bcdr.rule=PathPrefix(`/api/bcdr`)'
      - 'traefik.http.routers.controls-bcdr.middlewares=api-security@file'
      - 'traefik.http.services.controls.loadbalancer.server.port=3001'
    restart: unless-stopped
    # Resource limits - example configuration for development
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M

  # ===========================================
  # Frameworks Service - Compliance Frameworks
  # ===========================================
  frameworks:
    build:
      context: .
      dockerfile: services/frameworks/Dockerfile
    container_name: grc-frameworks
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      PORT: 3002
      DATABASE_URL: postgresql://${POSTGRES_USER:?POSTGRES_USER is required}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/${POSTGRES_DB:-gigachad_grc}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: ${MINIO_USE_SSL:-true}
      S3_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: ${MINIO_USE_SSL:-true}
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_REALM: ${KEYCLOAK_REALM:-gigachad-grc}
    ports:
      # SECURITY: Bound to localhost - access via Traefik gateway
      # Direct port access only for local development/debugging
      - '127.0.0.1:3002:3002'
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_started
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.frameworks.rule=PathPrefix(`/api/frameworks`)'
      # SECURITY: Apply rate limiting and security headers middleware
      - 'traefik.http.routers.frameworks.middlewares=api-security@file'
      - 'traefik.http.services.frameworks.loadbalancer.server.port=3002'
    restart: unless-stopped

  # ===========================================
  # Policies Service - Policy Center
  # ===========================================
  policies:
    build:
      context: .
      dockerfile: services/policies/Dockerfile
    container_name: grc-policies
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      PORT: 3004
      DATABASE_URL: postgresql://${POSTGRES_USER:?POSTGRES_USER is required}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/${POSTGRES_DB:-gigachad_grc}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: ${MINIO_USE_SSL:-true}
      S3_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: ${MINIO_USE_SSL:-true}
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_REALM: ${KEYCLOAK_REALM:-gigachad-grc}
    ports:
      # SECURITY: Bound to localhost - access via Traefik gateway
      # Direct port access only for local development/debugging
      - '127.0.0.1:3004:3004'
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_started
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.policies.rule=PathPrefix(`/api/policies`)'
      # SECURITY: Apply rate limiting and security headers middleware
      - 'traefik.http.routers.policies.middlewares=api-security@file'
      - 'traefik.http.services.policies.loadbalancer.server.port=3004'
    restart: unless-stopped

  # ===========================================
  # TPRM Service - Third Party Risk Management
  # ===========================================
  tprm:
    build:
      context: .
      dockerfile: services/tprm/Dockerfile
    container_name: grc-tprm
    security_opt:
      - no-new-privileges:true
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      PORT: 3005
      DATABASE_URL: postgresql://${POSTGRES_USER:?POSTGRES_USER is required}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/${POSTGRES_DB:-gigachad_grc}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: ${MINIO_USE_SSL:-true}
      S3_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: ${MINIO_USE_SSL:-true}
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_REALM: ${KEYCLOAK_REALM:-gigachad-grc}
    ports:
      # SECURITY: Bound to localhost - access via Traefik gateway
      # Direct port access only for local development/debugging
      - '127.0.0.1:3005:3005'
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_started
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.tprm-vendors.rule=PathPrefix(`/api/vendors`)'
      # SECURITY: Apply rate limiting and security headers middleware
      - 'traefik.http.routers.tprm-vendors.middlewares=api-security@file'
      - 'traefik.http.routers.tprm-assessments.rule=PathPrefix(`/api/assessments`)'
      - 'traefik.http.routers.tprm-assessments.middlewares=api-security@file'
      - 'traefik.http.routers.tprm-contracts.rule=PathPrefix(`/api/contracts`)'
      - 'traefik.http.routers.tprm-contracts.middlewares=api-security@file'
      - 'traefik.http.routers.tprm-config.rule=PathPrefix(`/api/tprm-config`)'
      - 'traefik.http.routers.tprm-config.middlewares=api-security@file'
      - 'traefik.http.services.tprm.loadbalancer.server.port=3005'
    restart: unless-stopped

  # ===========================================
  # Trust Service - Questionnaires & Knowledge Base
  # ===========================================
  trust:
    build:
      context: .
      dockerfile: services/trust/Dockerfile
    container_name: grc-trust
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      PORT: 3006
      DATABASE_URL: postgresql://${POSTGRES_USER:?POSTGRES_USER is required}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/${POSTGRES_DB:-gigachad_grc}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: ${MINIO_USE_SSL:-true}
      S3_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: ${MINIO_USE_SSL:-true}
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_REALM: ${KEYCLOAK_REALM:-gigachad-grc}
    ports:
      # SECURITY: Bound to localhost - access via Traefik gateway
      # Direct port access only for local development/debugging
      - '127.0.0.1:3006:3006'
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_started
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.trust-questionnaires.rule=PathPrefix(`/api/questionnaires`)'
      # SECURITY: Apply rate limiting and security headers middleware
      - 'traefik.http.routers.trust-questionnaires.middlewares=api-security@file'
      - 'traefik.http.routers.trust-knowledge-base.rule=PathPrefix(`/api/knowledge-base`)'
      - 'traefik.http.routers.trust-knowledge-base.middlewares=api-security@file'
      - 'traefik.http.routers.trust-center.rule=PathPrefix(`/api/trust-center`)'
      - 'traefik.http.routers.trust-center.middlewares=api-security@file'
      - 'traefik.http.services.trust.loadbalancer.server.port=3006'
    restart: unless-stopped

  # ===========================================
  # Audit Service - Internal & External Audits
  # ===========================================
  audit:
    build:
      context: .
      dockerfile: services/audit/Dockerfile
    container_name: grc-audit
    security_opt:
      - no-new-privileges:true
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      PORT: 3007
      DATABASE_URL: postgresql://${POSTGRES_USER:?POSTGRES_USER is required}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/${POSTGRES_DB:-gigachad_grc}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379
      S3_ENDPOINT: rustfs
      S3_PORT: 9000
      S3_USE_SSL: ${MINIO_USE_SSL:-true}
      S3_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      MINIO_ENDPOINT: rustfs
      MINIO_PORT: 9000
      MINIO_USE_SSL: ${MINIO_USE_SSL:-true}
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_REALM: ${KEYCLOAK_REALM:-gigachad-grc}
    ports:
      # SECURITY: Bound to localhost - access via Traefik gateway
      # Direct port access only for local development/debugging
      - '127.0.0.1:3007:3007'
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      keycloak:
        condition: service_started
      rustfs:
        condition: service_healthy

    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.audit-audits.rule=PathPrefix(`/api/audits`)'
      # SECURITY: Apply rate limiting and security headers middleware to all audit routes
      - 'traefik.http.routers.audit-audits.middlewares=api-security@file'
      - 'traefik.http.routers.audit-requests.rule=PathPrefix(`/api/audit-requests`)'
      - 'traefik.http.routers.audit-requests.middlewares=api-security@file'
      - 'traefik.http.routers.audit-findings.rule=PathPrefix(`/api/findings`)'
      - 'traefik.http.routers.audit-findings.middlewares=api-security@file'
      - 'traefik.http.routers.audit-portal.rule=PathPrefix(`/api/audit-portal`)'
      - 'traefik.http.routers.audit-portal.middlewares=api-security@file'
      - 'traefik.http.routers.audit-templates.rule=PathPrefix(`/api/audit/templates`)'
      - 'traefik.http.routers.audit-templates.middlewares=api-security@file'
      - 'traefik.http.routers.audit-workpapers.rule=PathPrefix(`/api/audit/workpapers`)'
      - 'traefik.http.routers.audit-workpapers.middlewares=api-security@file'
      - 'traefik.http.routers.audit-test-procedures.rule=PathPrefix(`/api/audit/test-procedures`)'
      - 'traefik.http.routers.audit-test-procedures.middlewares=api-security@file'
      - 'traefik.http.routers.audit-remediation.rule=PathPrefix(`/api/audit/remediation`)'
      - 'traefik.http.routers.audit-remediation.middlewares=api-security@file'
      - 'traefik.http.routers.audit-analytics.rule=PathPrefix(`/api/audit/analytics`)'
      - 'traefik.http.routers.audit-analytics.middlewares=api-security@file'
      - 'traefik.http.routers.audit-planning.rule=PathPrefix(`/api/audit/planning`)'
      - 'traefik.http.routers.audit-planning.middlewares=api-security@file'
      - 'traefik.http.routers.audit-reports.rule=PathPrefix(`/api/audit/reports`)'
      - 'traefik.http.routers.audit-reports.middlewares=api-security@file'
      - 'traefik.http.routers.audit-ai.rule=PathPrefix(`/api/audit/audit-ai`)'
      - 'traefik.http.routers.audit-ai.middlewares=api-security@file'
      - 'traefik.http.services.audit.loadbalancer.server.port=3007'
    restart: unless-stopped

  # ===========================================
  # Frontend - React SPA with Nginx
  # ===========================================
  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
      args:
        VITE_ENABLE_DEV_AUTH: 'true'
        # Explicit opt-in for dev-auth bypass. This is intentional in the
        # dev compose file; production builds (docker-compose.prod.yml)
        # must NOT set this.
        ALLOW_DEV_AUTH: 'true'
    container_name: grc-frontend
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    ports:
      # SECURITY: Bound to localhost - access via Traefik gateway
      # Direct port access only for local development/debugging
      - '127.0.0.1:3000:80'
    environment:
      - VITE_API_URL=
      - VITE_ENABLE_DEV_AUTH=true
    depends_on:
      - controls
    networks:
      - grc-network
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.frontend.rule=Host(`localhost`)'
      - 'traefik.http.routers.frontend.priority=1'
      # SECURITY: Apply security headers middleware to frontend
      - 'traefik.http.routers.frontend.middlewares=security-headers@file'
      - 'traefik.http.services.frontend.loadbalancer.server.port=80'
    restart: unless-stopped

  # ===========================================
  # Monitoring Stack
  # ===========================================
  prometheus:
    image: prom/prometheus:v2.47.1
    container_name: grc-prometheus
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.enable-lifecycle'
    volumes:
      - prometheus_data:/prometheus
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    ports:
      - '127.0.0.1:9090:9090'
    networks:
      - grc-network
    restart: unless-stopped
    depends_on:
      - controls
      - audit
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.prometheus.rule=Host(`prometheus.localhost`)'
      - 'traefik.http.routers.prometheus.entrypoints=web'
      - 'traefik.http.services.prometheus.loadbalancer.server.port=9090'

  grafana:
    image: grafana/grafana:10.2.0
    container_name: grc-grafana
    # SECURITY: Prevent privilege escalation attacks
    security_opt:
      - no-new-privileges:true
    environment:
      # SECURITY WARNING: These credentials MUST be set via environment variables!
      # DO NOT use default values in production - set strong credentials:
      #   export GRAFANA_ADMIN_USER=your_admin_user
      #   export GRAFANA_ADMIN_PASSWORD=$(openssl rand -base64 32)
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:?GRAFANA_ADMIN_USER is required}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD is required}
      GF_USERS_ALLOW_SIGN_UP: 'false'
      GF_AUTH_ANONYMOUS_ENABLED: 'false'
      GF_AUTH_ANONYMOUS_ORG_ROLE: 'Viewer'
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
      - ./monitoring/grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards:ro
    ports:
      # SECURITY: Bound to localhost - access via Traefik gateway
      # Direct port access only for local development/debugging
      - '127.0.0.1:3003:3000'
    networks:
      - grc-network
    restart: unless-stopped
    depends_on:
      - prometheus
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.grafana.rule=Host(`grafana.localhost`)'
      - 'traefik.http.routers.grafana.entrypoints=web'
      - 'traefik.http.services.grafana.loadbalancer.server.port=3000'

networks:
  grc-network:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  rustfs_data:
  rustfs_logs:
  prometheus_data:
  grafana_data: