docker-compose-production.yml

# =============================================================================
# Pythinker Production — pythinker.com
# =============================================================================
# Usage:
#   docker compose -f docker-compose-production.yml --env-file .env.production up -d
#
# Required: .env.production with all ${VAR} placeholders populated.
# See docs/architecture/PRODUCTION_DEPLOYMENT.md for full instructions.
# =============================================================================

services:
  # ---------------------------------------------------------------------------
  # Traefik Reverse Proxy & Load Balancer
  # ---------------------------------------------------------------------------
  traefik:
    image: traefik:v3.3
    container_name: pythinker-traefik
    restart: always
    command:
      - --api.dashboard=false
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=pythinker-prod
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      # Redirect all HTTP to HTTPS
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --log.level=WARN
      - --accesslog=true
      - --accesslog.filters.statuscodes=400-599
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_letsencrypt:/letsencrypt
    networks:
      - pythinker-prod
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'

  # ---------------------------------------------------------------------------
  # Frontend (Nginx serving Vue 3 SPA)
  # ---------------------------------------------------------------------------
  frontend:
    image: ${IMAGE_REGISTRY:-pythinker}/pythinker-frontend:${IMAGE_TAG:-latest}
    platform: linux/amd64
    build:
      context: ./frontend
      dockerfile: Dockerfile
    depends_on:
      backend:
        condition: service_healthy
    restart: always
    networks:
      - pythinker-prod
    environment:
      - BACKEND_URL=http://backend:8000
    volumes:
      - ./frontend/nginx.conf:/etc/nginx/nginx.conf.template:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pythinker-frontend.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.pythinker-frontend.entrypoints=websecure"
      - "traefik.http.routers.pythinker-frontend.tls.certresolver=letsencrypt"
      - "traefik.http.services.pythinker-frontend.loadbalancer.server.port=80"
      # Security headers middleware
      - "traefik.http.routers.pythinker-frontend.middlewares=pythinker-security-headers@docker"
      - "traefik.http.middlewares.pythinker-security-headers.headers.customResponseHeaders.X-Content-Type-Options=nosniff"
      - "traefik.http.middlewares.pythinker-security-headers.headers.customResponseHeaders.X-Frame-Options=DENY"
      - "traefik.http.middlewares.pythinker-security-headers.headers.customResponseHeaders.Referrer-Policy=strict-origin-when-cross-origin"
      - "traefik.http.middlewares.pythinker-security-headers.headers.customResponseHeaders.X-XSS-Protection=1; mode=block"
      - "traefik.http.middlewares.pythinker-security-headers.headers.customResponseHeaders.Permissions-Policy=camera=(), microphone=(), geolocation=(), payment=()"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:80/ >/dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  # ---------------------------------------------------------------------------
  # Backend (FastAPI with replicas behind Traefik)
  # ---------------------------------------------------------------------------
  backend:
    image: ${IMAGE_REGISTRY:-pythinker}/pythinker-backend:${IMAGE_TAG:-latest}
    platform: linux/amd64
    build:
      context: ./backend
      dockerfile: Dockerfile
    depends_on:
      sandbox:
        condition: service_healthy
      mongodb:
        condition: service_healthy
      redis:
        condition: service_healthy
      qdrant:
        condition: service_healthy
      minio:
        condition: service_healthy
    restart: always
    deploy:
      replicas: ${BACKEND_REPLICAS:-1}
      resources:
        limits:
          memory: 2G
          cpus: '2'
        reservations:
          memory: 512M
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - knowledge_base_data:/app/data/knowledge_bases
      - dspy_cache:/app/data/dspy_cache
    networks:
      - pythinker-prod              # Frontend-facing network
      - pythinker-internal  # Can reach MongoDB
    env_file:
      - .env.production
    environment:
      - SANDBOX_LIFECYCLE_MODE=${SANDBOX_LIFECYCLE_MODE:-static}
      - SANDBOX_ADDRESS=${SANDBOX_ADDRESS:-sandbox}
      - SANDBOX_API_SECRET=${SANDBOX_API_SECRET}
      - GRPC_ENABLE_FORK_SUPPORT=0
      - NODE_OPTIONS=--no-deprecation
      - FAST_MODEL=${FAST_MODEL:-qwen/qwen3-coder-next}
      - FEATURE_PROMPT_OPTIMIZATION_PIPELINE=${FEATURE_PROMPT_OPTIMIZATION_PIPELINE:-false}
      - DSPY_CACHEDIR=/app/data/dspy_cache
      - DSPY_NUM_THREADS=${DSPY_NUM_THREADS:-4}
      - DSPY_MAX_BOOTSTRAPPED_DEMOS=${DSPY_MAX_BOOTSTRAPPED_DEMOS:-4}
      - DSPY_MAX_LABELED_DEMOS=${DSPY_MAX_LABELED_DEMOS:-4}
      - DSPY_MINIBATCH_SIZE=${DSPY_MINIBATCH_SIZE:-25}
      # Production: connect to Redis with password
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379/0
      # Production: connect to authenticated MongoDB replica set
      - MONGODB_URI=mongodb://mongodb:27017/${MONGODB_DATABASE:-pythinker}?authSource=admin&replicaSet=rs0
      - MONGODB_USERNAME=${MONGODB_ROOT_USERNAME:?Set MONGODB_ROOT_USERNAME}
      - MONGODB_PASSWORD=${MONGODB_ROOT_PASSWORD:?Set MONGODB_ROOT_PASSWORD}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pythinker-api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)"
      - "traefik.http.routers.pythinker-api.entrypoints=websecure"
      - "traefik.http.routers.pythinker-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.pythinker-api.loadbalancer.server.port=8000"
      # Sticky sessions for SSE connections
      - "traefik.http.services.pythinker-api.loadbalancer.sticky.cookie=true"
      - "traefik.http.services.pythinker-api.loadbalancer.sticky.cookie.name=pythinker_backend"
      - "traefik.http.services.pythinker-api.loadbalancer.sticky.cookie.httponly=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8000/api/v1/health >/dev/null || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s

  # ---------------------------------------------------------------------------
  # Sandbox (Isolated Docker execution environment)
  # ---------------------------------------------------------------------------
  sandbox:
    image: ${IMAGE_REGISTRY:-pythinker}/pythinker-sandbox:${IMAGE_TAG:-latest}
    platform: linux/amd64
    build:
      context: ./sandbox
      dockerfile: Dockerfile
      args:
        ENABLE_SANDBOX_ADDONS: "${ENABLE_SANDBOX_ADDONS:-0}"
    hostname: sandbox
    restart: always
    read_only: true
    environment:
      - CHROME_ARGS=--no-sandbox --disable-setuid-sandbox --disable-crashpad --user-data-dir=/tmp/chrome --no-zygote --renderer-process-limit=1 --disable-gpu --disable-vulkan --disable-features=IsolateOrigins,site-per-process --disable-background-networking --disable-sync --disable-translate --disable-default-apps --no-first-run --disable-extensions --js-flags=--max-old-space-size=768
      - FRAMEWORK_DATABASE_URL=sqlite+aiosqlite:////home/ubuntu/.local/pythinker_sandbox.db
      - BROWSER_PATH=/usr/local/bin/chromium
      - SANDBOX_API_SECRET=${SANDBOX_API_SECRET}
      - SUPERVISOR_RPC_USERNAME=${SUPERVISOR_RPC_USERNAME:?Set SUPERVISOR_RPC_USERNAME}
      - SUPERVISOR_RPC_PASSWORD=${SUPERVISOR_RPC_PASSWORD:?Set SUPERVISOR_RPC_PASSWORD}
      - LIBGL_ALWAYS_SOFTWARE=1
      - ENABLE_VNC=${ENABLE_VNC:-1}
    # Production: no host port exposure -- backend accesses via internal network
    shm_size: ${SANDBOX_SHM_SIZE:-1g}
    security_opt:
      - no-new-privileges:true
      - seccomp=./sandbox/seccomp-sandbox.hardened.json
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - NET_BIND_SERVICE
    tmpfs:
      - /run:size=50M,nosuid,nodev,uid=1000,gid=1000
      - /run/user/1000:size=10M,nosuid,nodev,uid=1000,gid=1000,mode=0700
      - /tmp:size=1G,nosuid,nodev
      - /home/ubuntu:size=2G,nosuid,nodev,uid=1000,gid=1000
      - /var:size=500M,nosuid,nodev
      - /workspace:size=2G,nosuid,nodev,uid=1000,gid=1000
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    deploy:
      resources:
        limits:
          memory: ${SANDBOX_MEM_LIMIT:-2G}
          cpus: '${SANDBOX_CPU_LIMIT:-1}'
        reservations:
          memory: ${SANDBOX_MEM_RESERVATION:-512M}
    networks:
      - pythinker-internal  # Backend reaches sandbox; sandbox cannot reach frontend
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3

  # ---------------------------------------------------------------------------
  # MongoDB (Single-node Replica Set for oplog/change streams)
  # ---------------------------------------------------------------------------
  mongodb:
    image: mongo:7.0.31
    container_name: pythinker-mongodb
    command:
      - mongod
      - --replSet=rs0
      - --wiredTigerCacheSizeGB=${MONGO_CACHE_SIZE_GB:-1}
      - --setParameter=diagnosticDataCollectionEnabled=false
      - --setParameter=cursorTimeoutMillis=600000
      - --setParameter=maxIndexBuildMemoryUsageMegabytes=200
    volumes:
      - mongodb_data:/data/db
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGODB_ROOT_USERNAME}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_ROOT_PASSWORD}
    restart: always
    networks:
      - pythinker-internal  # Internal-only network — no external access
    deploy:
      resources:
        limits:
          memory: ${MONGO_MEMORY_LIMIT:-2G}
          cpus: '2'
        reservations:
          memory: 1G
    healthcheck:
      # Ping AND initialize replica set if not already configured.
      # rs.status() throws if uninitialized; initiate then re-check.
      test: >-
        mongosh --norc --quiet -u "$$MONGO_INITDB_ROOT_USERNAME" -p "$$MONGO_INITDB_ROOT_PASSWORD" --authenticationDatabase admin --eval "
          try { rs.status().ok }
          catch(e) { rs.initiate({_id:'rs0', members:[{_id:0, host:'mongodb:27017'}]}).ok }
        "
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s

  # ---------------------------------------------------------------------------
  # Redis (Password-protected with AOF persistence)
  # ---------------------------------------------------------------------------
  redis:
    image: redis:8.4-alpine
    container_name: pythinker-redis
    command:
      - redis-server
      - --requirepass
      - ${REDIS_PASSWORD}
      - --save
      - ""
      - --appendonly
      - "yes"
      - --appendfsync
      - everysec
      - --aof-use-rdb-preamble
      - "yes"
      - --loglevel
      - warning
      - --timeout
      - "0"
      - --maxmemory
      - ${REDIS_MAXMEMORY:-1gb}
      - --maxmemory-policy
      - ${REDIS_MAXMEMORY_POLICY:-volatile-lfu}
      - --lazyfree-lazy-eviction
      - "yes"
      - --lazyfree-lazy-expire
      - "yes"
      - --lazyfree-lazy-server-del
      - "yes"
      - --latency-monitor-threshold
      - "100"
      - --auto-aof-rewrite-percentage
      - "100"
      - --auto-aof-rewrite-min-size
      - "64mb"
      - --aof-load-corrupt-tail-max-size
      - "8192"
      - --tcp-backlog
      - "511"
      - --hz
      - "10"
      - --io-threads
      - "${REDIS_IO_THREADS:-2}"
    volumes:
      - redis_data:/data
    restart: always
    networks:
      - pythinker-internal  # Only backend can reach Redis
    sysctls:
      - net.core.somaxconn=511
    deploy:
      resources:
        limits:
          memory: ${REDIS_MEMORY_LIMIT:-512M}
          cpus: '1'
        reservations:
          memory: 128M
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3

  # ---------------------------------------------------------------------------
  # Qdrant (Vector search with gRPC)
  # ---------------------------------------------------------------------------
  qdrant:
    image: qdrant/qdrant:v1.17.0
    container_name: pythinker-qdrant
    volumes:
      - qdrant_data:/qdrant/storage
    environment:
      - QDRANT__SERVICE__GRPC_PORT=6334
      - QDRANT__SERVICE__API_KEY=${QDRANT_API_KEY:-}
      # Performance: enable on-disk payload index for large collections
      - QDRANT__STORAGE__ON_DISK_PAYLOAD=true
      # Quantization: scalar quantization reduces memory ~4x with minimal recall loss
      - QDRANT__STORAGE__QUANTIZATION__SCALAR__TYPE=int8
      - QDRANT__STORAGE__QUANTIZATION__SCALAR__ALWAYS_RAM=true
      # Optimizer: tune for production write throughput
      - QDRANT__STORAGE__OPTIMIZERS__INDEXING_THRESHOLD=20000
      - QDRANT__STORAGE__OPTIMIZERS__FLUSH_INTERVAL_SEC=5
    restart: always
    networks:
      - pythinker-internal  # Only backend can reach Qdrant
    deploy:
      resources:
        limits:
          memory: ${QDRANT_MEMORY_LIMIT:-768M}
          cpus: '1'
        reservations:
          memory: 256M
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:6333/healthz || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3

  # ---------------------------------------------------------------------------
  # MinIO (S3-compatible object storage)
  # ---------------------------------------------------------------------------
  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    container_name: pythinker-minio
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
      # Healing: auto-heal corrupted objects
      - MINIO_HEAL_INTERVAL=12h
      # API rate limiting
      - MINIO_API_REQUESTS_MAX=${MINIO_API_REQUESTS_MAX:-100}
      - MINIO_API_REQUESTS_DEADLINE=${MINIO_API_REQUESTS_DEADLINE:-10s}
    volumes:
      - minio_data:/data
    command: server /data --console-address ":9001"
    restart: always
    networks:
      - pythinker-internal  # Only backend can reach MinIO
    deploy:
      resources:
        limits:
          memory: ${MINIO_MEMORY_LIMIT:-512M}
          cpus: '1'
        reservations:
          memory: 128M
    # Production: no host port exposure -- backend accesses via internal network.
    # Access console via Traefik if needed (add labels).
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:9000/minio/health/live || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

# =============================================================================
# Volumes
# =============================================================================
volumes:
  mongodb_data:
    name: pythinker-prod-mongodb-data
  redis_data:
    name: pythinker-prod-redis-data
  qdrant_data:
    name: pythinker-prod-qdrant-data
  minio_data:
    name: pythinker-prod-minio-data
  knowledge_base_data:
    name: pythinker-prod-knowledge-base-data
  dspy_cache:
    name: pythinker-prod-dspy-cache
  traefik_letsencrypt:
    name: pythinker-prod-traefik-letsencrypt

# =============================================================================
# Networks
# =============================================================================
networks:
  pythinker-prod:
    name: pythinker-prod
    driver: bridge
  pythinker-internal:
    name: pythinker-internal
    internal: true  # No external access — containers only