docker-compose.prod.yml

version: '3.9'

# Production Docker Compose Configuration for Heimdall SDR
# This file extends the development configuration with:
# - Persistent volume mounts
# - Resource limits
# - Production-grade health checks
# - Enhanced logging
# - Security configurations
# - Automatic restarts

services:
  # PostgreSQL 15 + TimescaleDB (Production)
  postgres:
    image: timescale/timescaledb:latest-pg15
    container_name: heimdall-postgres-prod
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-heimdall}
      POSTGRES_USER: ${POSTGRES_USER:-heimdall_user}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      PGDATA: /var/lib/postgresql/data/pgdata
      # Production settings
      POSTGRES_INITDB_ARGS: "-c max_connections=200 -c shared_buffers=256MB -c effective_cache_size=1GB"
    volumes:
      - postgres_prod_data:/var/lib/postgresql/data
      - ./db/init-postgres.sql:/docker-entrypoint-initdb.d/01-init.sql
      - ./db/postgres-backup:/backup
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-heimdall_user} -d ${POSTGRES_DB:-heimdall}"]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 30s
    resources:
      limits:
        cpus: '1.0'
        memory: 2Gi
      reservations:
        cpus: '0.5'
        memory: 1Gi
    networks:
      - heimdall-network-prod
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "10"
        labels: "service=postgres"
    labels:
      app: "heimdall"
      component: "database"

  # pgAdmin - PostgreSQL Management (Production)
  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: heimdall-pgadmin-prod
    restart: unless-stopped
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD}
      PGADMIN_CONFIG_ENHANCED_LOG_LEVEL: 50
    volumes:
      - pgadmin_prod_data:/var/lib/pgadmin
    ports:
      - "5050:80"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:80/misc/ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    resources:
      limits:
        cpus: '0.5'
        memory: 512Mi
      reservations:
        cpus: '0.25'
        memory: 256Mi
    networks:
      - heimdall-network-prod
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
    labels:
      app: "heimdall"
      component: "management"

  # RabbitMQ 3.12 (Production)
  rabbitmq:
    image: rabbitmq:3.12-management-alpine
    container_name: heimdall-rabbitmq-prod
    restart: unless-stopped
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS}
      RABBITMQ_DEFAULT_VHOST: /
      RABBITMQ_HEARTBEAT: 60
    volumes:
      - rabbitmq_prod_data:/var/lib/rabbitmq
      - ./db/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
    ports:
      - "5672:5672"    # AMQP
      - "15672:15672"  # Management UI
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 40s
    resources:
      limits:
        cpus: '1.0'
        memory: 1Gi
      reservations:
        cpus: '0.5'
        memory: 512Mi
    networks:
      - heimdall-network-prod
    logging:
      driver: "json-file"
      options:
        max-size: "30m"
        max-file: "5"
    labels:
      app: "heimdall"
      component: "messaging"

  # Redis 7 (Production)
  redis:
    image: redis:7-alpine
    container_name: heimdall-redis-prod
    restart: unless-stopped
    command: >
      redis-server
      --requirepass ${REDIS_PASSWORD}
      --appendonly yes
      --appendfsync everysec
      --maxmemory 512mb
      --maxmemory-policy allkeys-lru
    volumes:
      - redis_prod_data:/data
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s
    resources:
      limits:
        cpus: '0.5'
        memory: 512Mi
      reservations:
        cpus: '0.25'
        memory: 256Mi
    networks:
      - heimdall-network-prod
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
    labels:
      app: "heimdall"
      component: "cache"

  # Redis Commander (Production - optional, monitoring only)
  redis-commander:
    image: rediscommander/redis-commander:latest
    container_name: heimdall-redis-commander-prod
    restart: unless-stopped
    environment:
      - REDIS_HOSTS=prod:redis:6379:0:${REDIS_PASSWORD}
      - HTTP_USER=${REDIS_COMMANDER_USER:-admin}
      - HTTP_PASSWORD=${REDIS_COMMANDER_PASSWORD}
    ports:
      - "8081:8081"
    depends_on:
      redis:
        condition: service_healthy
    resources:
      limits:
        cpus: '0.25'
        memory: 256Mi
      reservations:
        cpus: '0.1'
        memory: 128Mi
    networks:
      - heimdall-network-prod
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    labels:
      app: "heimdall"
      component: "monitoring"

  # MinIO - S3-compatible Object Storage (Production)
  minio:
    image: minio/minio:latest
    container_name: heimdall-minio-prod
    restart: unless-stopped
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      MINIO_BROWSER_REDIRECT_URL: "http://localhost:9001"
    volumes:
      - minio_prod_data:/minio_data
    ports:
      - "9000:9000"  # API
      - "9001:9001"  # Console
    command: minio server /minio_data --console-address ":9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    resources:
      limits:
        cpus: '1.0'
        memory: 1Gi
      reservations:
        cpus: '0.5'
        memory: 512Mi
    networks:
      - heimdall-network-prod
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"
    labels:
      app: "heimdall"
      component: "storage"

  # MinIO Client Setup - creates buckets (Production)
  minio-init:
    image: minio/mc:latest
    container_name: heimdall-minio-init-prod
    depends_on:
      minio:
        condition: service_healthy
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    entrypoint: >
      /bin/sh -c "
      /usr/bin/mc config host add heimdall http://minio:9000 $$MINIO_ROOT_USER $$MINIO_ROOT_PASSWORD;
      /usr/bin/mc mb heimdall/heimdall-raw-iq || true;
      /usr/bin/mc mb heimdall/heimdall-models || true;
      /usr/bin/mc mb heimdall/heimdall-mlflow || true;
      /usr/bin/mc mb heimdall/heimdall-datasets || true;
      /usr/bin/mc version enable heimdall/heimdall-models;
      /usr/bin/mc version enable heimdall/heimdall-mlflow;
      exit 0;
      "
    networks:
      - heimdall-network-prod
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "1"
    labels:
      app: "heimdall"
      component: "storage"

  # Prometheus - Metrics Collection (Production)
  prometheus:
    image: prom/prometheus:latest
    container_name: heimdall-prometheus-prod
    restart: unless-stopped
    volumes:
      - ./db/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_prod_data:/prometheus
    ports:
      - "9090:9090"
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=90d'
      - '--web.enable-lifecycle'
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:9090/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    resources:
      limits:
        cpus: '0.5'
        memory: 512Mi
      reservations:
        cpus: '0.25'
        memory: 256Mi
    networks:
      - heimdall-network-prod
    logging:
      driver: "json-file"
      options:
        max-size: "30m"
        max-file: "5"
    labels:
      app: "heimdall"
      component: "monitoring"

  # Grafana - Dashboards and Visualization (Production)
  grafana:
    image: grafana/grafana:latest
    container_name: heimdall-grafana-prod
    restart: unless-stopped
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_USER}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD}
      GF_SECURITY_DISABLE_BRUTE_FORCE_LOGIN_PROTECTION: "false"
      GF_SECURITY_LOGIN_MAXIMUM_INACTIVE_LIFETIME_DAYS: 7
      GF_INSTALL_PLUGINS: "grafana-piechart-panel"
    volumes:
      - grafana_prod_data:/var/lib/grafana
      - ./db/grafana-provisioning:/etc/grafana/provisioning:ro
    ports:
      - "3000:3000"
    depends_on:
      prometheus:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    resources:
      limits:
        cpus: '0.5'
        memory: 512Mi
      reservations:
        cpus: '0.25'
        memory: 256Mi
    networks:
      - heimdall-network-prod
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
    labels:
      app: "heimdall"
      component: "monitoring"

volumes:
  postgres_prod_data:
    driver: local
  pgadmin_prod_data:
    driver: local
  rabbitmq_prod_data:
    driver: local
  redis_prod_data:
    driver: local
  minio_prod_data:
    driver: local
  prometheus_prod_data:
    driver: local
  grafana_prod_data:
    driver: local

networks:
  heimdall-network-prod:
    driver: bridge