docker-compose.yml

services:
  # PostgreSQL Database
  #
  # Credentials come from .env and are mandatory: a compose up with no .env fails
  # at parse time instead of silently booting a database with a known password.
  # The port is published on the loopback interface only so a developer can still
  # connect from the host without exposing the database to the network.
  postgres:
    image: postgres:15.19-alpine
    container_name: stellarcert_db
    environment:
      POSTGRES_DB: ${POSTGRES_DB:?POSTGRES_DB must be set in .env}
      POSTGRES_USER: ${POSTGRES_USER:?POSTGRES_USER must be set in .env}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env}
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - stellarcert_network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  # Redis (used by BullMQ job queues)
  #
  # Redis requires a password and is not published on the host at all: only the
  # backend reaches it, over the compose network. The password is passed as a
  # server argument (never as a plain command-line flag in the image default) and
  # the healthcheck authenticates with REDISCLI_AUTH so it works with auth on.
  redis:
    image: redis:7.4.11-alpine
    container_name: stellarcert_redis
    environment:
      REDISCLI_AUTH: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in .env}
    command:
      - "redis-server"
      - "--requirepass"
      - "${REDIS_PASSWORD:?REDIS_PASSWORD must be set in .env}"
    volumes:
      - redis_data:/data
    networks:
      - stellarcert_network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5

  # Backend API Service
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
      target: production
    container_name: stellarcert_backend
    ports:
      - "3000:3000"
    environment:
      NODE_ENV: production
      PORT: 3000
      DB_TYPE: postgres
      DB_HOST: postgres
      DB_PORT: 5432
      DB_USERNAME: ${POSTGRES_USER:?POSTGRES_USER must be set in .env}
      DB_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env}
      DB_NAME: ${POSTGRES_DB:?POSTGRES_DB must be set in .env}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD must be set in .env}@redis:6379
      STELLAR_NETWORK: TESTNET
      STELLAR_HORIZON_URL: https://horizon-testnet.stellar.org
      STELLAR_ISSUER_SECRET_KEY: ${STELLAR_ISSUER_SECRET_KEY:?STELLAR_ISSUER_SECRET_KEY must be set in .env}
      STELLAR_ISSUER_PUBLIC_KEY: ${STELLAR_ISSUER_PUBLIC_KEY:?STELLAR_ISSUER_PUBLIC_KEY must be set in .env}
      # environment.config.ts validates both secrets in production (>= 32 chars)
      # and derives them from JWT_SECRET when they are absent, so the compose file
      # must pass all three through. The old single JWT_SECRET default of
      # "change_me_in_production" is 23 characters and failed that validation.
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in .env (>= 32 characters)}
      JWT_ACCESS_SECRET: ${JWT_ACCESS_SECRET:?JWT_ACCESS_SECRET must be set in .env (>= 32 characters)}
      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:?JWT_REFRESH_SECRET must be set in .env (>= 32 characters)}
      JWT_EXPIRES_IN: ${JWT_EXPIRES_IN:-3600}
      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:-http://localhost:5173,http://frontend:5173,https://localhost}
      CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:5173,http://frontend:5173,https://localhost}
      # Base URL for links in emails, QR codes and PDFs (#1242).
      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:5173}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      SENTRY_DSN: ${SENTRY_DSN:-}
      METRICS_ENABLED: ${METRICS_ENABLED:-true}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - stellarcert_network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3000/api/v1/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Frontend Service (Development)
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      target: development
    container_name: stellarcert_frontend
    ports:
      - "5173:5173"
    environment:
      # Reachable from the browser, which cannot resolve the compose-internal
      # "backend" hostname, and includes the /v1 prefix the API is mounted under.
      VITE_API_URL: ${VITE_API_URL:-http://localhost:3000/api/v1}
      VITE_STELLAR_NETWORK: TESTNET
      VITE_HORIZON_URL: https://horizon-testnet.stellar.org
      VITE_ENABLE_NOTIFICATIONS: true
      VITE_ENABLE_METRICS: true
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - stellarcert_network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5173"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

  # Frontend Service (Production - Static files)
  frontend-prod:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      target: production
    container_name: stellarcert_frontend_prod
    ports:
      - "8080:80"
    networks:
      - stellarcert_network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:80"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    depends_on:
      backend:
        condition: service_healthy
    profiles:
      - production

  # Nginx Reverse Proxy (Optional - for production)
  nginx:
    image: nginx:1.28.3-alpine
    container_name: stellarcert_nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/security-headers.conf:/etc/nginx/security-headers.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      frontend-prod:
        condition: service_healthy
      backend:
        condition: service_healthy
    networks:
      - stellarcert_network
    restart: unless-stopped
    profiles:
      - production

  # Prometheus (Optional - for monitoring)
  prometheus:
    image: prom/prometheus:v3.15.0
    container_name: stellarcert_prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--web.console.libraries=/etc/prometheus/console_libraries"
      - "--web.console.templates=/etc/prometheus/consoles"
      - "--storage.tsdb.retention.time=200h"
      - "--web.enable-lifecycle"
    networks:
      - stellarcert_network
    restart: unless-stopped
    profiles:
      - monitoring

networks:
  stellarcert_network:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  prometheus_data: