docker-compose.yml

# Production-like Docker Compose topology for SignUpFlow.
# Startup fails until required secrets and HTTPS origins are supplied. This file
# is not production acceptance; use the release roadmap before deployment.

services:
  # ============================================================================
  # PostgreSQL Database
  # ============================================================================
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-signupflow}
      POSTGRES_USER: ${POSTGRES_USER:-signupflow}
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}"
      POSTGRES_INITDB_ARGS: "-E UTF8 --locale=en_US.UTF-8"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-signupflow} -d ${POSTGRES_DB:-signupflow}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - signupflow-network

  # ============================================================================
  # Redis (for caching, rate limiting, sessions)
  # ============================================================================
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    environment:
      REDIS_PASSWORD: "${REDIS_PASSWORD:?Set REDIS_PASSWORD}"
    command: redis-server --requirepass ${REDIS_PASSWORD:?Set REDIS_PASSWORD} --appendonly yes
    volumes:
      - redis_data:/data
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "redis-cli --no-auth-warning -a \"$${REDIS_PASSWORD}\" ping | grep -q PONG",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - signupflow-network

  # ============================================================================
  # One-shot schema migration. Application replicas never migrate.
  # ============================================================================
  migrate:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VCS_REF: "${VCS_REF:-unknown}"
        BUILD_DATE: "${BUILD_DATE:-unknown}"
    image: "${SIGNUPFLOW_IMAGE:-signupflow:local}"
    restart: "no"
    depends_on:
      db:
        condition: service_healthy
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-signupflow}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-signupflow}"
      SIGNUPFLOW_LOAD_DOTENV: "false"
    command: ["python", "-m", "alembic", "upgrade", "head"]
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - signupflow-network

  # ============================================================================
  # SignUpFlow FastAPI Backend
  # ============================================================================
  api:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VCS_REF: "${VCS_REF:-unknown}"
        BUILD_DATE: "${BUILD_DATE:-unknown}"
    image: "${SIGNUPFLOW_IMAGE:-signupflow:local}"
    restart: unless-stopped
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    environment:
      # Database Configuration
      DATABASE_URL: "postgresql://${POSTGRES_USER:-signupflow}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-signupflow}"

      # Redis/Celery Configuration
      REDIS_URL: "redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379/0"
      RATE_LIMIT_STORAGE: "redis"
      EVENT_BUS_STORAGE: "redis"
      CELERY_BROKER_URL: "redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379/0"
      CELERY_RESULT_BACKEND: "redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379/0"

      # Application Configuration
      ENVIRONMENT: "production"
      RELEASE_SHA: "${RELEASE_SHA:?Set RELEASE_SHA to the deployed commit}"
      SIGNUPFLOW_LOAD_DOTENV: "false"
      SECRET_KEY: "${SECRET_KEY:?Set SECRET_KEY}"
      ACCESS_TOKEN_EXPIRE_HOURS: "${ACCESS_TOKEN_EXPIRE_HOURS:-24}"
      APP_URL: "${APP_URL:?Set APP_URL to the public HTTPS browser origin}"
      API_BASE_URL: "${API_BASE_URL:?Set API_BASE_URL to the public HTTPS API origin}"
      FRONTEND_URL: "${FRONTEND_URL:?Set FRONTEND_URL to the public HTTPS browser origin}"
      CORS_ALLOWED_ORIGINS: "${CORS_ALLOWED_ORIGINS:?Set CORS_ALLOWED_ORIGINS}"
      TRUSTED_PROXY_IPS: "${TRUSTED_PROXY_IPS:-}"
      TESTING: "false"
      DEBUG: "false"
      DEBUG_RETURN_RESET_TOKEN: "false"
      DISABLE_RATE_LIMITS: "false"
      DISABLE_USAGE_LIMITS: "false"
      SIGNUPFLOW_ALLOW_TEST_CLOCK: "false"
      SECURITY_HSTS_ENABLED: "true"
      SECURITY_HSTS_MAX_AGE: "${SECURITY_HSTS_MAX_AGE:-31536000}"
      SECURITY_CSP_ENABLED: "true"

      # Email Configuration (SendGrid)
      SENDGRID_API_KEY: "${SENDGRID_API_KEY:-}"
      SENDGRID_WEBHOOK_PUBLIC_KEY: "${SENDGRID_WEBHOOK_PUBLIC_KEY:-}"
      EMAIL_FROM: ${EMAIL_FROM:-noreply@signupflow.io}
      EMAIL_ENABLED: ${EMAIL_ENABLED:-false}

      # SMS Configuration (Twilio)
      TWILIO_ACCOUNT_SID: "${TWILIO_ACCOUNT_SID:-}"
      TWILIO_AUTH_TOKEN: "${TWILIO_AUTH_TOKEN:-}"
      TWILIO_PHONE_NUMBER: "${TWILIO_PHONE_NUMBER:-}"
      SMS_ENABLED: ${SMS_ENABLED:-false}

      # Stripe Configuration
      STRIPE_SECRET_KEY: "${STRIPE_SECRET_KEY:-}"
      STRIPE_PUBLISHABLE_KEY: "${STRIPE_PUBLISHABLE_KEY:-}"
      STRIPE_WEBHOOK_SECRET: "${STRIPE_WEBHOOK_SECRET:-}"
      BILLING_ENABLED: ${BILLING_ENABLED:-false}

      # Logging
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      READINESS_FAILURE_ALERT_THRESHOLD: "${READINESS_FAILURE_ALERT_THRESHOLD:-3}"
      SENTRY_DSN: "${SENTRY_DSN:-}"

    ports:
      - "${PORT:-8000}:8000"
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://localhost:8000/ready', timeout=5)",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - signupflow-network

  # ============================================================================
  # Celery Worker (committed notification intents and scheduled reminders)
  # ============================================================================
  celery-worker:
    image: "${SIGNUPFLOW_IMAGE:-signupflow:local}"
    restart: unless-stopped
    command: ["celery", "-A", "api.celery_app", "worker", "--loglevel=info"]
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-signupflow}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-signupflow}"
      REDIS_URL: "redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379/0"
      CELERY_BROKER_URL: "redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379/0"
      CELERY_RESULT_BACKEND: "redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379/0"
      RATE_LIMIT_STORAGE: "redis"
      EVENT_BUS_STORAGE: "redis"
      ENVIRONMENT: "production"
      RELEASE_SHA: "${RELEASE_SHA:?Set RELEASE_SHA to the deployed commit}"
      SIGNUPFLOW_LOAD_DOTENV: "false"
      SECRET_KEY: "${SECRET_KEY:?Set SECRET_KEY}"
      ACCESS_TOKEN_EXPIRE_HOURS: "${ACCESS_TOKEN_EXPIRE_HOURS:-24}"
      APP_URL: "${APP_URL:?Set APP_URL to the public HTTPS browser origin}"
      API_BASE_URL: "${API_BASE_URL:?Set API_BASE_URL to the public HTTPS API origin}"
      FRONTEND_URL: "${FRONTEND_URL:?Set FRONTEND_URL to the public HTTPS browser origin}"
      CORS_ALLOWED_ORIGINS: "${CORS_ALLOWED_ORIGINS:?Set CORS_ALLOWED_ORIGINS}"
      TESTING: "false"
      DEBUG: "false"
      DEBUG_RETURN_RESET_TOKEN: "false"
      DISABLE_RATE_LIMITS: "false"
      DISABLE_USAGE_LIMITS: "false"
      SIGNUPFLOW_ALLOW_TEST_CLOCK: "false"
      SECURITY_HSTS_ENABLED: "true"
      SECURITY_CSP_ENABLED: "true"
      EMAIL_ENABLED: ${EMAIL_ENABLED:-false}
      SMS_ENABLED: "false"
      BILLING_ENABLED: "false"
      SENDGRID_API_KEY: "${SENDGRID_API_KEY:-}"
      SENDGRID_WEBHOOK_PUBLIC_KEY: "${SENDGRID_WEBHOOK_PUBLIC_KEY:-}"
      EMAIL_FROM: ${EMAIL_FROM:-noreply@signupflow.io}
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - signupflow-network

  # Exactly one scheduler owns periodic intent recovery and reminders.
  celery-beat:
    image: "${SIGNUPFLOW_IMAGE:-signupflow:local}"
    restart: unless-stopped
    command:
      [
        "celery",
        "-A",
        "api.celery_app",
        "beat",
        "--loglevel=info",
        "--schedule=/tmp/celerybeat-schedule",
      ]
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-signupflow}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-signupflow}"
      REDIS_URL: "redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379/0"
      CELERY_BROKER_URL: "redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379/0"
      CELERY_RESULT_BACKEND: "redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379/0"
      RATE_LIMIT_STORAGE: "redis"
      EVENT_BUS_STORAGE: "redis"
      ENVIRONMENT: "production"
      RELEASE_SHA: "${RELEASE_SHA:?Set RELEASE_SHA to the deployed commit}"
      SIGNUPFLOW_LOAD_DOTENV: "false"
      SECRET_KEY: "${SECRET_KEY:?Set SECRET_KEY}"
      ACCESS_TOKEN_EXPIRE_HOURS: "${ACCESS_TOKEN_EXPIRE_HOURS:-24}"
      APP_URL: "${APP_URL:?Set APP_URL to the public HTTPS browser origin}"
      API_BASE_URL: "${API_BASE_URL:?Set API_BASE_URL to the public HTTPS API origin}"
      FRONTEND_URL: "${FRONTEND_URL:?Set FRONTEND_URL to the public HTTPS browser origin}"
      CORS_ALLOWED_ORIGINS: "${CORS_ALLOWED_ORIGINS:?Set CORS_ALLOWED_ORIGINS}"
      TESTING: "false"
      DEBUG: "false"
      DEBUG_RETURN_RESET_TOKEN: "false"
      DISABLE_RATE_LIMITS: "false"
      DISABLE_USAGE_LIMITS: "false"
      SIGNUPFLOW_ALLOW_TEST_CLOCK: "false"
      SECURITY_HSTS_ENABLED: "true"
      SECURITY_CSP_ENABLED: "true"
      EMAIL_ENABLED: ${EMAIL_ENABLED:-false}
      SMS_ENABLED: "false"
      BILLING_ENABLED: "false"
      SENDGRID_API_KEY: "${SENDGRID_API_KEY:-}"
      SENDGRID_WEBHOOK_PUBLIC_KEY: "${SENDGRID_WEBHOOK_PUBLIC_KEY:-}"
      EMAIL_FROM: ${EMAIL_FROM:-noreply@signupflow.io}
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - signupflow-network

# ============================================================================
# Volumes (persistent data storage)
# ============================================================================
volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local

# ============================================================================
# Networks
# ============================================================================
networks:
  signupflow-network:
    driver: bridge