docker-compose.prod.yml

version: '3.8'

services:
  # Main ContextLite Server (Production)
  contextlite:
    build: 
      context: .
      dockerfile: docker/Dockerfile
      target: production
    image: contextlite/contextlite:${VERSION:-latest}
    container_name: contextlite-prod
    ports:
      - "8080:8080"
    volumes:
      - contextlite_data:/app/data
      - contextlite_logs:/app/logs
      - contextlite_backups:/app/backups
    environment:
      - CONTEXTLITE_ENV=production
      - CONTEXTLITE_LOG_LEVEL=${LOG_LEVEL:-info}
      - CONTEXTLITE_HOST=0.0.0.0
      - CONTEXTLITE_PORT=8080
      - CONTEXTLITE_DATABASE=/app/data/contextlite.db
      - CONTEXTLITE_CONFIG_PATH=/app/configs/production.yaml
      - CONTEXTLITE_AUTH_TOKEN=${CONTEXTLITE_AUTH_TOKEN}
      - POSTGRES_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=require
      - REDIS_URL=redis://redis:6379
      - CLICKHOUSE_URL=http://clickhouse:8123
      - LICENSE_SERVER_URL=http://license-server:8081
    secrets:
      - contextlite_auth_token
      - postgres_password
      - redis_password
      - clickhouse_password
      - stripe_secret_key
    networks:
      - contextlite-prod
      - contextlite-db
    restart: always
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: '2.0'
          memory: 4G
        reservations:
          cpus: '1.0' 
          memory: 2G
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
        order: start-first
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      clickhouse:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "/app/contextlite", "--health-check"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.contextlite.rule=Host(`api.contextlite.com`)"
      - "traefik.http.routers.contextlite.tls=true"
      - "traefik.http.routers.contextlite.tls.certresolver=letsencrypt"
      - "traefik.http.services.contextlite.loadbalancer.server.port=8080"
      - "traefik.http.services.contextlite.loadbalancer.healthcheck.path=/api/v1/health"
      - "traefik.http.middlewares.contextlite-ratelimit.ratelimit.burst=100"
      - "traefik.http.middlewares.contextlite-ratelimit.ratelimit.average=60"

  # Web Dashboard (Production)
  dashboard:
    build:
      context: .
      dockerfile: docker/Dockerfile.dashboard
      target: production
    image: contextlite/dashboard:${VERSION:-latest}
    container_name: contextlite-dashboard-prod
    environment:
      - NODE_ENV=production
      - PORT=3000
      - API_PORT=3001
      - CONTEXTLITE_API_URL=http://contextlite:8080
      - NEXT_PUBLIC_API_URL=https://api.contextlite.com
      - FRONTEND_URL=https://dashboard.contextlite.com
      - CORS_ORIGIN=https://dashboard.contextlite.com
    networks:
      - contextlite-prod
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M
    depends_on:
      - contextlite
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`dashboard.contextlite.com`)"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"

  # PostgreSQL Database (Production)
  postgres:
    image: postgres:16-alpine
    container_name: contextlite-postgres-prod
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - postgres_backups:/backups
      - ./configs/postgres/postgresql.prod.conf:/etc/postgresql/postgresql.conf
      - ./pkg/adapters/postgresql/schemas:/docker-entrypoint-initdb.d
    environment:
      - POSTGRES_DB=${POSTGRES_DB:-contextlite}
      - POSTGRES_USER=${POSTGRES_USER:-contextlite}
      - POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --data-checksums
      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
    secrets:
      - postgres_password
    networks:
      - contextlite-db
    command: ["postgres", "-c", "config_file=/etc/postgresql/postgresql.conf"]
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 4G
        reservations:
          cpus: '1.0'
          memory: 2G
      placement:
        constraints:
          - node.role == manager
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-contextlite} -d ${POSTGRES_DB:-contextlite}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"

  # Redis Cluster (Production)
  redis:
    image: redis:7-alpine
    container_name: contextlite-redis-prod
    volumes:
      - redis_data:/data
      - ./configs/redis/redis.prod.conf:/usr/local/etc/redis/redis.conf
    command: ["redis-server", "/usr/local/etc/redis/redis.conf"]
    environment:
      - REDIS_PASSWORD_FILE=/run/secrets/redis_password
    secrets:
      - redis_password
    networks:
      - contextlite-db
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 1G
    healthcheck:
      test: ["CMD", "redis-cli", "--no-auth-warning", "-a", "$$(cat /run/secrets/redis_password)", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
    restart: always
    sysctls:
      net.core.somaxconn: 1024

  # ClickHouse Analytics (Production)
  clickhouse:
    image: clickhouse/clickhouse-server:24.1-alpine
    container_name: contextlite-clickhouse-prod
    volumes:
      - clickhouse_data:/var/lib/clickhouse
      - clickhouse_logs:/var/log/clickhouse-server
      - clickhouse_backups:/backups
      - ./configs/clickhouse/config.prod.xml:/etc/clickhouse-server/config.xml
      - ./configs/clickhouse/users.prod.xml:/etc/clickhouse-server/users.xml
      - ./pkg/adapters/clickhouse/schemas:/docker-entrypoint-initdb.d
    environment:
      - CLICKHOUSE_DB=${CLICKHOUSE_DB:-contextlite}
      - CLICKHOUSE_USER=${CLICKHOUSE_USER:-contextlite}
      - CLICKHOUSE_PASSWORD_FILE=/run/secrets/clickhouse_password
      - CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1
    secrets:
      - clickhouse_password
    networks:
      - contextlite-db
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 8G
        reservations:
          cpus: '2.0'
          memory: 4G
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8123/ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    restart: always
    ulimits:
      nofile:
        soft: 262144
        hard: 262144

  # License Server (Production)
  license-server:
    build:
      context: .
      dockerfile: docker/Dockerfile.license-server
      target: production
    image: contextlite/license-server:${VERSION:-latest}
    container_name: contextlite-license-prod
    volumes:
      - license_data:/app/data
      - license_backups:/app/backups
    environment:
      - CONTEXTLITE_LICENSE_ENV=production
      - CONTEXTLITE_LICENSE_PORT=8081
      - CONTEXTLITE_LICENSE_DATABASE=/app/data/license_tracking.db
      - POSTGRES_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=require
      - STRIPE_SECRET_KEY_FILE=/run/secrets/stripe_secret_key
      - STRIPE_WEBHOOK_SECRET_FILE=/run/secrets/stripe_webhook_secret
    secrets:
      - stripe_secret_key
      - stripe_webhook_secret
    networks:
      - contextlite-prod
      - contextlite-db
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8081/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.license.rule=Host(`license.contextlite.com`)"
      - "traefik.http.routers.license.tls=true"
      - "traefik.http.routers.license.tls.certresolver=letsencrypt"

  # Production Reverse Proxy (Traefik)
  traefik:
    image: traefik:v3.0
    container_name: contextlite-traefik-prod
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_certs:/certs
      - ./configs/traefik/traefik.prod.yml:/etc/traefik/traefik.yml
      - ./configs/traefik/dynamic.prod.yml:/etc/traefik/dynamic.yml
    environment:
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${ACME_EMAIL}
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_STORAGE=/certs/acme.json
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cloudflare_api_token
    secrets:
      - cloudflare_api_token
    networks:
      - contextlite-prod
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M
      placement:
        constraints:
          - node.role == manager
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`traefik.contextlite.com`)"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.routers.api.tls=true"
      - "traefik.http.routers.api.tls.certresolver=letsencrypt"
      - "traefik.http.routers.api.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=${TRAEFIK_BASIC_AUTH}"

  # Backup Service
  backup:
    build:
      context: .
      dockerfile: docker/Dockerfile.backup
    image: contextlite/backup:${VERSION:-latest}
    container_name: contextlite-backup
    volumes:
      - contextlite_data:/data/contextlite:ro
      - postgres_data:/data/postgres:ro
      - redis_data:/data/redis:ro
      - clickhouse_data:/data/clickhouse:ro
      - license_data:/data/license:ro
      - contextlite_backups:/backups
      - postgres_backups:/backups/postgres
      - clickhouse_backups:/backups/clickhouse
      - license_backups:/backups/license
    environment:
      - BACKUP_SCHEDULE=${BACKUP_SCHEDULE:-0 2 * * *}
      - BACKUP_RETENTION_DAYS=${BACKUP_RETENTION_DAYS:-30}
      - S3_BUCKET=${BACKUP_S3_BUCKET}
      - AWS_ACCESS_KEY_ID_FILE=/run/secrets/aws_access_key
      - AWS_SECRET_ACCESS_KEY_FILE=/run/secrets/aws_secret_key
      - POSTGRES_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
    secrets:
      - aws_access_key
      - aws_secret_key
      - postgres_password
    networks:
      - contextlite-db
    depends_on:
      - postgres
      - redis
      - clickhouse
      - license-server
    restart: always
    profiles:
      - backup

  # Monitoring Stack
  prometheus:
    image: prom/prometheus:latest
    container_name: contextlite-prometheus-prod
    volumes:
      - prometheus_data:/prometheus
      - ./configs/prometheus/prometheus.prod.yml:/etc/prometheus/prometheus.yml
      - ./configs/prometheus/rules:/etc/prometheus/rules
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --web.console.libraries=/etc/prometheus/console_libraries
      - --web.console.templates=/etc/prometheus/consoles
      - --storage.tsdb.retention.time=90d
      - --web.enable-lifecycle
      - --web.enable-admin-api
    networks:
      - contextlite-prod
      - contextlite-monitoring
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 4G
        reservations:
          cpus: '1.0'
          memory: 2G
    restart: always
    profiles:
      - monitoring

  grafana:
    image: grafana/grafana:latest
    container_name: contextlite-grafana-prod
    volumes:
      - grafana_data:/var/lib/grafana
      - ./configs/grafana/provisioning:/etc/grafana/provisioning
      - ./configs/grafana/dashboards:/var/lib/grafana/dashboards
    environment:
      - GF_SECURITY_ADMIN_PASSWORD_FILE=/run/secrets/grafana_admin_password
      - GF_SERVER_ROOT_URL=https://monitoring.contextlite.com
      - GF_DATABASE_TYPE=postgres
      - GF_DATABASE_HOST=postgres:5432
      - GF_DATABASE_NAME=${POSTGRES_DB:-contextlite}
      - GF_DATABASE_USER=${POSTGRES_USER:-contextlite}
      - GF_DATABASE_PASSWORD_FILE=/run/secrets/postgres_password
      - GF_SMTP_ENABLED=true
      - GF_SMTP_HOST=${SMTP_HOST}
      - GF_SMTP_USER=${SMTP_USER}
      - GF_SMTP_PASSWORD_FILE=/run/secrets/smtp_password
    secrets:
      - grafana_admin_password
      - postgres_password
      - smtp_password
    networks:
      - contextlite-monitoring
      - contextlite-db
    depends_on:
      - prometheus
      - postgres
    restart: always
    profiles:
      - monitoring
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.grafana.rule=Host(`monitoring.contextlite.com`)"
      - "traefik.http.routers.grafana.tls=true"
      - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"

# Docker Secrets for Production
secrets:
  contextlite_auth_token:
    external: true
  postgres_password:
    external: true
  redis_password:
    external: true
  clickhouse_password:
    external: true
  stripe_secret_key:
    external: true
  stripe_webhook_secret:
    external: true
  cloudflare_api_token:
    external: true
  aws_access_key:
    external: true
  aws_secret_key:
    external: true
  grafana_admin_password:
    external: true
  smtp_password:
    external: true

volumes:
  contextlite_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/data
  contextlite_logs:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/logs
  contextlite_backups:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/backups
  postgres_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/postgres/data
  postgres_backups:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/postgres/backups
  redis_data:
    driver: local
    driver_opts:
      type: none  
      o: bind
      device: /opt/contextlite/redis/data
  clickhouse_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/clickhouse/data
  clickhouse_logs:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/clickhouse/logs
  clickhouse_backups:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/clickhouse/backups
  license_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/license/data
  license_backups:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/license/backups
  traefik_certs:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/traefik/certs
  prometheus_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/prometheus/data
  grafana_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/contextlite/grafana/data

networks:
  contextlite-prod:
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.0.0/16
  contextlite-db:
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.22.0.0/16
  contextlite-monitoring:
    driver: bridge
    ipam:
      config:
        - subnet: 172.23.0.0/16