docker-compose.yml

services:
  nginx:
    image: nginx:1.25-alpine
    ports:
      - "80:80"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./frontend/dist:/usr/share/nginx/html:ro
    depends_on:
      - backend
      - python-service
    networks:
      - vaccichain
    restart: unless-stopped

  frontend:
    build: ./frontend
    ports:
      - "80:80"    # HTTP → HTTPS redirect only
      - "443:443"  # TLS termination
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - vaccichain
    volumes:
      # Mount TLS certificates (Let's Encrypt / Certbot or your own PKI).
      # In production, replace with a secrets manager or Kubernetes secret mount.
      - ./certs:/etc/nginx/certs:ro
      # ACME challenge directory for certificate renewal
      - certbot_webroot:/var/www/certbot:ro
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:80"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/log/nginx
      - /tmp
    deploy:
      resources:
        limits:
          # nginx serving pre-built static assets + TLS termination.
          # 0.10 CPU covers TLS handshakes + gzip at ~50 req/s.
          # 64 MB covers nginx worker processes with TLS session cache.
          cpus: "0.10"
          memory: 64M
        reservations:
          cpus: "0.01"
          memory: 16M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  # Certbot for automatic Let's Encrypt certificate renewal.
  # Run once to obtain initial cert: docker compose run --rm certbot certonly ...
  certbot:
    image: certbot/certbot:latest
    volumes:
      - ./certs:/etc/letsencrypt
      - certbot_webroot:/var/www/certbot
    entrypoint: /bin/sh -c "trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot; sleep 12h & wait $${!}; done"
    restart: unless-stopped

  backend:
    build: ./backend
    ports:
      - "4000:4000"
    env_file: .env
    environment:
      - EVENT_POLL_INTERVAL_MS=${EVENT_POLL_INTERVAL_MS:-15000}
      - DATABASE_PATH=/data/vaccichain.db
    volumes:
      - vaccichain_db:/data
    depends_on:
      python-service:
        condition: service_healthy
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 15s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          # Node.js heap for Express + Stellar SDK sits ~80–100 MB at rest.
          # Soroban RPC calls are CPU-light but allocate XDR buffers transiently.
          # 0.75 CPU allows burst during contract invocations without starving neighbours.
          # 256 MB gives 2× headroom over observed peak; OOM before host pressure.
          cpus: "0.75"
          memory: 256M
        reservations:
          cpus: "0.10"
          memory: 128M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  python-service:
    build: ./python-service
    ports:
      - "8001:8001"
    environment:
      - BACKEND_URL=http://backend:4000
      - ANOMALY_THRESHOLD=${ANOMALY_THRESHOLD:-50}
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8001/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 15s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          # FastAPI/uvicorn with httpx fan-out to Stellar Horizon.
          # Python baseline ~60 MB; analytics aggregation adds ~20 MB transiently.
          # 0.50 CPU handles concurrent async I/O without blocking the event loop.
          # 128 MB is 2× observed peak; keeps service isolated from backend OOM events.
          cpus: "0.50"
          memory: 128M
        reservations:
          cpus: "0.05"
          memory: 64M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  backup:
    build: ./backup
    env_file: .env
    volumes:
      - vaccichain_db:/data
    networks:
      - vaccichain
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

networks:
  vaccichain:
    driver: bridge

volumes:
  vaccichain_db:
  certbot_webroot: