docker-compose.yml

# =============================================================================
# Nivo - Docker Compose (Base Configuration)
# =============================================================================
#
# Usage:
#   Development: docker compose up -d (auto-loads docker-compose.override.yml)
#   Production:  docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
#   Monitoring:  docker compose -f docker-compose.yml -f docker-compose.observability.yml up -d
#
# Memory:
#   - Development: ~1.1GB (this file alone)
#   - Production:  ~750MB (with docker-compose.prod.yml for 1GB VPS)
#   - Requires 2GB swap enabled on host
#   - See scripts/setup-server.sh for swap configuration
#
# Security:
#   - All containers implement cap_drop: ALL and no-new-privileges: true
#   - Only nginx exposes external ports (80, 443)
#   - All backend services communicate via internal Docker network
#
# =============================================================================

services:
  # ===========================================================================
  # INFRASTRUCTURE
  # ===========================================================================

  postgres:
    image: postgres:15-alpine
    container_name: nivo-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-nivo}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-nivo}
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-nivo}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - nivo-network
    # Security hardening
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - DAC_OVERRIDE
    deploy:
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 128M

  redis:
    image: redis:7-alpine
    container_name: nivo-redis
    restart: unless-stopped
    command: >
      redis-server
      --appendonly yes
      --requirepass ${REDIS_PASSWORD}
      --maxmemory 48mb
      --maxmemory-policy allkeys-lru
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - nivo-network
    # Security hardening (Redis runs as non-root uid 999)
    # Redis needs SETUID/SETGID to switch to redis user
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
    read_only: true
    tmpfs:
      - /tmp:size=64M
    deploy:
      resources:
        limits:
          memory: 64M
          pids: 32
        reservations:
          memory: 32M

  # ===========================================================================
  # BACKEND SERVICES
  # ===========================================================================

  identity-service:
    build:
      context: .
      dockerfile: services/identity/Dockerfile
    container_name: nivo-identity
    restart: unless-stopped
    environment:
      SERVICE_PORT: 8080
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DATABASE_URL: postgres://${POSTGRES_USER:-nivo}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nivo}?sslmode=disable
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      JWT_SECRET: ${JWT_SECRET}
      JWT_EXPIRY_HOURS: ${JWT_EXPIRY_HOURS:-24}
      TIMEZONE: Asia/Kolkata
      DEFAULT_CURRENCY: INR
      COUNTRY_CODE: IN
      RBAC_SERVICE_URL: http://rbac-service:8082
      WALLET_SERVICE_URL: http://wallet-service:8083
      NOTIFICATION_SERVICE_URL: http://notification-service:8087
      INTERNAL_SERVICE_SECRET: ${INTERNAL_SERVICE_SECRET:-}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rbac-service:
        condition: service_healthy
      wallet-service:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8080/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 96M
          pids: 64
        reservations:
          memory: 48M

  ledger-service:
    build:
      context: .
      dockerfile: services/ledger/Dockerfile
    container_name: nivo-ledger
    restart: unless-stopped
    environment:
      SERVICE_PORT: 8081
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DATABASE_URL: postgres://${POSTGRES_USER:-nivo}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nivo}?sslmode=disable
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
      TIMEZONE: Asia/Kolkata
      DEFAULT_CURRENCY: INR
      COUNTRY_CODE: IN
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8081/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 96M
          pids: 64

  rbac-service:
    build:
      context: .
      dockerfile: services/rbac/Dockerfile
    container_name: nivo-rbac
    restart: unless-stopped
    environment:
      SERVICE_PORT: 8082
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DATABASE_URL: postgres://${POSTGRES_USER:-nivo}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nivo}?sslmode=disable
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
      INTERNAL_SERVICE_SECRET: ${INTERNAL_SERVICE_SECRET:-}
      TIMEZONE: Asia/Kolkata
      DEFAULT_CURRENCY: INR
      COUNTRY_CODE: IN
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8082/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 64M
          pids: 32

  wallet-service:
    build:
      context: .
      dockerfile: services/wallet/Dockerfile
    container_name: nivo-wallet
    restart: unless-stopped
    environment:
      SERVICE_PORT: 8083
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DATABASE_URL: postgres://${POSTGRES_USER:-nivo}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nivo}?sslmode=disable
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      LEDGER_SERVICE_URL: http://ledger-service:8081
      JWT_SECRET: ${JWT_SECRET}
      INTERNAL_SERVICE_SECRET: ${INTERNAL_SERVICE_SECRET:-}
      TIMEZONE: Asia/Kolkata
      DEFAULT_CURRENCY: INR
      COUNTRY_CODE: IN
    depends_on:
      postgres:
        condition: service_healthy
      ledger-service:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8083/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 96M
          pids: 64

  transaction-service:
    build:
      context: .
      dockerfile: services/transaction/Dockerfile
    container_name: nivo-transaction
    restart: unless-stopped
    environment:
      SERVICE_PORT: 8084
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DATABASE_URL: postgres://${POSTGRES_USER:-nivo}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nivo}?sslmode=disable
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      WALLET_SERVICE_URL: http://wallet-service:8083
      LEDGER_SERVICE_URL: http://ledger-service:8081
      RISK_SERVICE_URL: http://risk-service:8085
      JWT_SECRET: ${JWT_SECRET}
      INTERNAL_SERVICE_SECRET: ${INTERNAL_SERVICE_SECRET:-}
      TIMEZONE: Asia/Kolkata
      DEFAULT_CURRENCY: INR
      COUNTRY_CODE: IN
    depends_on:
      postgres:
        condition: service_healthy
      wallet-service:
        condition: service_healthy
      ledger-service:
        condition: service_healthy
      risk-service:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8084/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 96M
          pids: 64

  risk-service:
    build:
      context: .
      dockerfile: services/risk/Dockerfile
    container_name: nivo-risk
    restart: unless-stopped
    environment:
      SERVICE_PORT: 8085
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DATABASE_URL: postgres://${POSTGRES_USER:-nivo}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nivo}?sslmode=disable
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
      TIMEZONE: Asia/Kolkata
      DEFAULT_CURRENCY: INR
      COUNTRY_CODE: IN
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8085/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 64M
          pids: 32

  notification-service:
    build:
      context: .
      dockerfile: services/notification/Dockerfile
    container_name: nivo-notification
    restart: unless-stopped
    environment:
      SERVICE_PORT: 8087
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DATABASE_URL: postgres://${POSTGRES_USER:-nivo}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nivo}?sslmode=disable
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
      SIM_DELIVERY_DELAY_MS: 1000
      SIM_FINAL_DELAY_MS: 2000
      SIM_FAILURE_RATE_PERCENT: 10.0
      SIM_MAX_RETRY_ATTEMPTS: 3
      SIM_RETRY_DELAY_MS: 2000
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8087/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 64M
          pids: 32

  simulation-service:
    build:
      context: .
      dockerfile: services/simulation/Dockerfile
    container_name: nivo-simulation
    restart: unless-stopped
    environment:
      SERVICE_PORT: 8086
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DATABASE_URL: postgres://${POSTGRES_USER:-nivo}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nivo}?sslmode=disable
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
      GATEWAY_URL: http://gateway:8000
      ADMIN_TOKEN: ${ADMIN_TOKEN:-}
      AUTO_START_SIMULATION: ${AUTO_START_SIMULATION:-false}
      TIMEZONE: Asia/Kolkata
      DEFAULT_CURRENCY: INR
      COUNTRY_CODE: IN
    depends_on:
      postgres:
        condition: service_healthy
      gateway:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8086/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 64M
          pids: 32

  # ===========================================================================
  # API GATEWAY
  # ===========================================================================

  gateway:
    build:
      context: .
      dockerfile: gateway/Dockerfile
    container_name: nivo-gateway
    restart: unless-stopped
    environment:
      SERVICE_PORT: 8000
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
      IDENTITY_SERVICE_URL: http://identity-service:8080
      LEDGER_SERVICE_URL: http://ledger-service:8081
      RBAC_SERVICE_URL: http://rbac-service:8082
      WALLET_SERVICE_URL: http://wallet-service:8083
      TRANSACTION_SERVICE_URL: http://transaction-service:8084
      RISK_SERVICE_URL: http://risk-service:8085
      NOTIFICATION_SERVICE_URL: http://notification-service:8087
    depends_on:
      identity-service:
        condition: service_healthy
      ledger-service:
        condition: service_healthy
      rbac-service:
        condition: service_healthy
      wallet-service:
        condition: service_healthy
      transaction-service:
        condition: service_healthy
      notification-service:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8000/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 96M
          pids: 64

  # ===========================================================================
  # FRONTEND (nginx serving React apps + reverse proxy)
  # ===========================================================================

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        VITE_API_URL: ${VITE_API_URL:-https://api.nivomoney.com}
    container_name: nivo-frontend
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./frontend/nginx.conf:/etc/nginx/nginx.conf:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
      - /var/www/certbot:/var/www/certbot:ro
    depends_on:
      gateway:
        condition: service_healthy
    networks:
      - nivo-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost/nginx-health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - SETUID
      - SETGID
      - DAC_OVERRIDE
    deploy:
      resources:
        limits:
          memory: 48M
          pids: 32

  # Certbot for SSL certificate renewal
  certbot:
    image: certbot/certbot
    container_name: nivo-certbot
    volumes:
      - ./certbot/conf:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
    networks:
      - nivo-network

  # ===========================================================================
  # OBSERVABILITY
  # ===========================================================================

  prometheus:
    image: prom/prometheus:v2.47.0
    container_name: nivo-prometheus
    restart: unless-stopped
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=15d'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
      - '--web.enable-lifecycle'
    volumes:
      - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./monitoring/prometheus/alerts.yml:/etc/prometheus/alerts.yml:ro
      - prometheus_data:/prometheus
    # No external ports - accessed via internal network only
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:9090/-/healthy || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - nivo-network
    # Security hardening (runs as nobody:65534)
    user: "65534:65534"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 512M
          pids: 64
        reservations:
          memory: 256M

  grafana:
    image: grafana/grafana:10.2.0
    container_name: nivo-grafana
    restart: unless-stopped
    environment:
      # Admin credentials
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
      # Security settings
      GF_SECURITY_COOKIE_SECURE: "true"
      GF_SECURITY_COOKIE_SAMESITE: strict
      GF_SECURITY_DISABLE_GRAVATAR: "true"
      GF_SECURITY_ALLOW_EMBEDDING: "false"
      # Disable sign-up
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_USERS_ALLOW_ORG_CREATE: "false"
      # Anonymous access disabled
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      # Server config
      GF_SERVER_ROOT_URL: ${GF_SERVER_ROOT_URL:-https://grafana.nivomoney.com}
      GF_SERVER_DOMAIN: ${GF_SERVER_DOMAIN:-grafana.nivomoney.com}
      GF_SERVER_HTTP_PORT: "3000"
    # No external ports - accessed via nginx reverse proxy at grafana.nivomoney.com
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
    depends_on:
      prometheus:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:3000/api/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - nivo-network
    # Security hardening (runs as grafana:472)
    user: "472:472"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          memory: 512M
          pids: 64
        reservations:
          memory: 256M

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local

networks:
  nivo-network:
    driver: bridge