docker-compose.yml

# =============================================================================
# SimpleSecCheck - Refactored Docker Compose Configuration
# =============================================================================
# Phase 1: Service Separation & Redis Addition
# 
# Changes from original:
# - Split backend into separate FastAPI backend and scanner worker services
# - Added dedicated Redis service with persistence and health checks
# - Fixed circular dependencies and network issues
# - Added proper health checks for all services
# - Improved volume management for better isolation
# =============================================================================

services:
  # PostgreSQL Database
  postgres:
    image: postgres:16-alpine
    container_name: SimpleSecCheck_postgres
    command: postgres -c log_min_messages=warning -c log_connections=off -c log_disconnections=off -c log_checkpoints=off -c log_lock_waits=off -c log_statement=none -c log_duration=off -c logging_collector=off
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-simpleseccheck}
      POSTGRES_USER: ${POSTGRES_USER:-ssc_user}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C.UTF-8"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - app
      - internal
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-ssc_user} -d ${POSTGRES_DB:-simpleseccheck}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  # Redis Queue Service
  redis:
    image: redis:7-alpine
    container_name: SimpleSecCheck_redis
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru --loglevel warning --syslog-enabled no
    volumes:
      - redis_data:/data
    networks:
      - app
      - internal
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

  # FastAPI Backend Service
  # Handles API requests, WebSocket connections, and serves frontend
  backend:
    build:
      context: .
      dockerfile: ./backend/Dockerfile
    container_name: SimpleSecCheck_backend
    
    volumes:
      - ./results:/app/results
      - ./uploads:/app/uploads
      - .:/project:ro
    env_file:
      - .env
    environment:
      - SIMPLESECCHECK_ROOT=/app
      - UPLOAD_STORAGE_PATH=/app/uploads
      - PYTHONUNBUFFERED=1
      - POSTGRES_HOST=${POSTGRES_HOST:-postgres}
      - POSTGRES_PORT=${POSTGRES_PORT:-5432}
      - POSTGRES_USER=${POSTGRES_USER:-ssc_user}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB:-simpleseccheck}
      - POSTGRES_SSL=${POSTGRES_SSL:-false}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379}
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
    ports:
      - "8080:8080"
    networks:
      - app
      - internal
    read_only: false
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.get('http://localhost:8080/api/health').ok else 1)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    # Resource Limits (Phase 3)
    deploy:
      resources:
        limits:
          cpus: '${BACKEND_CPU_LIMIT:-2.0}'
          memory: '${BACKEND_MEMORY_LIMIT:-2G}'
          pids: 1000
        reservations:
          cpus: '${BACKEND_CPU_RESERVATION:-0.5}'
          memory: '${BACKEND_MEMORY_RESERVATION:-512M}'
    # Security Context (Phase 3)
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    # Additional Security (Phase 3)
    working_dir: /app
    shm_size: 64M

  # Scanner Worker Service
  # Orchestrates scan execution by managing job queue and starting scanner containers
  # - Processes scan jobs from Redis queue
  # - Starts scanner containers dynamically via Docker API
  # - Provides API for scanner discovery (worker:8081/api/scanners/)
  # - Does NOT execute scans itself - scanner container does that
  worker:
    build:
      context: .
      dockerfile: ./worker/Dockerfile
    container_name: SimpleSecCheck_worker
    # No user: - entrypoint runs as root, then drops privileges with gosu
    # This is the standard pattern for containers that need Docker socket access
    volumes:
      - ./results:/app/results
      - ./uploads:/app/uploads
      - .:/project:ro
      - /var/run/docker.sock:/var/run/docker.sock
    env_file:
      - .env
    environment:
      - POSTGRES_HOST=${POSTGRES_HOST:-postgres}
      - POSTGRES_PORT=${POSTGRES_PORT:-5432}
      - POSTGRES_USER=${POSTGRES_USER:-ssc_user}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB:-simpleseccheck}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379}
      - QUEUE_CONNECTION=${REDIS_URL:-redis://redis:6379}
      - RESULTS_DIR_HOST=${PWD}/results
      # Container paths (what Scanner container sees inside)
      - RESULTS_DIR_CONTAINER=/app/results
      # Uploads: backend extracts ZIPs here; worker mounts same path for uploaded_code scans
      - UPLOAD_STORAGE_PATH=/app/uploads
    ports:
      - "8081:8081"  # Worker API port for scanner discovery
    networks:
      - app
      - internal
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import sys; sys.path.append('/app'); from worker.cli.worker_main import main; main(['--healthcheck'])\""]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    # Resource Limits (Phase 3)
    deploy:
      resources:
        limits:
          cpus: '${WORKER_CPU_LIMIT:-4.0}'
          memory: '${WORKER_MEMORY_LIMIT:-4G}'
          pids: 2000
        reservations:
          cpus: '${WORKER_CPU_RESERVATION:-1.0}'
          memory: '${WORKER_MEMORY_RESERVATION:-1G}'
    # Security Context (Phase 3)
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - SYS_ADMIN  # Required for Docker socket access
    # Additional Security (Phase 3)
    working_dir: /app
    shm_size: 128M

  # Scanner CLI Container (Standalone Executor)
  # Standalone CLI tool that executes security scans
  # - Used by worker: Worker starts this container dynamically for each scan
  # - Used manually: docker compose run scanner (for CLI usage without WebUI)
  # - Executes scans via scanner.core.orchestrator
  # - Runs individual scanner plugins (OWASP, Trivy, etc.)
  # - Container is ephemeral (temporary, auto-removed after scan)
  scanner:
    build:
      context: .
      dockerfile: ./scanner/Dockerfile
      args:
        VERSION: 2.0.0
    image: simpleseccheck-scanner:latest
    container_name: SimpleSecCheck_scanner
    command: ["sleep", "infinity"]
    volumes:
      - ./results:/app/results
      - .:/project:ro
    environment:
      - SCAN_TARGET=${SCAN_TARGET:-}
      - TARGET_PATH_IN_CONTAINER=${TARGET_PATH_IN_CONTAINER:-/target}
      - RESULTS_DIR_IN_CONTAINER=/app/results
      - POSTGRES_HOST=${POSTGRES_HOST:-postgres}
      - POSTGRES_PORT=${POSTGRES_PORT:-5432}
      - POSTGRES_USER=${POSTGRES_USER:-ssc_user}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB:-simpleseccheck}
      - POSTGRES_SSL=${POSTGRES_SSL:-false}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379}
      - NVD_API_KEY=${NVD_API_KEY:-}
      - SNYK_TOKEN=${SNYK_TOKEN:-}
    networks:
      - app
      - internal
    restart: "no"
    stdin_open: true
    tty: true
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    # Resource Limits (Phase 3)
    deploy:
      resources:
        limits:
          cpus: '${SCANNER_CPU_LIMIT:-4.0}'
          memory: '${SCANNER_MEMORY_LIMIT:-8G}'
          pids: 4000
        reservations:
          cpus: '${SCANNER_CPU_RESERVATION:-1.0}'
          memory: '${SCANNER_MEMORY_RESERVATION:-2G}'
    # Security Context (Phase 3)
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    # Additional Security (Phase 3)
    working_dir: /app
    shm_size: 256M

  # Frontend WebUI Service
  frontend:
    build:
      context: .
      dockerfile: ./frontend/Dockerfile.nginx
    container_name: SimpleSecCheck_frontend
    volumes:
      - ./results:/app/results
    ports:
      - "80:80"
    environment:
      - API_BASE_URL=${API_BASE_URL:-http://backend:8080}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379}
    networks:
      - app
    read_only: false
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:80"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    depends_on:
      backend:
        condition: service_healthy
    # Security Context (Phase 3)
    security_opt:
      - no-new-privileges:true

networks:
  app:
    driver: bridge
  internal:
    driver: bridge
    internal: true

volumes:
  # Data persistence volumes
  postgres_data:
    driver: local
  redis_data:
    driver: local
  results_data:
    driver: local
  logs_data:
    driver: local

# =============================================================================
# Environment variables (reference)
# =============================================================================
# Required:
# - POSTGRES_PASSWORD: PostgreSQL password
# - REDIS_URL: default redis://redis:6379 if unset
#
# Optional tuning:
# - MAX_CONCURRENT_JOBS on worker (overrides DB); else DB max_concurrent_jobs; else 1
# - API_BASE_URL (default: http://backend:8080)
#
# Scanner resource limits:
# - SCANNER_CPU_LIMIT: Max CPU for scanner (default: 4.0)
# - SCANNER_MEMORY_LIMIT: Max memory for scanner (default: 8G)
# - SCANNER_CPU_RESERVATION: Reserved CPU for scanner (default: 1.0)
# - SCANNER_MEMORY_RESERVATION: Reserved memory for scanner (default: 2G)