docker-compose.yml

# Log rotation — prevents Docker logs from filling the disk.
# Applied to all services via the *default-logging anchor.
x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "3"

services:
  web:
    build: .
    restart: unless-stopped
    logging: *default-logging
    environment:
      - DJANGO_SETTINGS_MODULE=konote.settings.production
      - KONOTE_MODE=${KONOTE_MODE:-production}
      - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-konote}
      - AUDIT_DATABASE_URL=postgresql://${AUDIT_POSTGRES_USER}:${AUDIT_POSTGRES_PASSWORD}@audit_db:5432/${AUDIT_POSTGRES_DB:-konote_audit}
      - SECRET_KEY=${SECRET_KEY}
      - FIELD_ENCRYPTION_KEY=${FIELD_ENCRYPTION_KEY}
      - AUTH_MODE=${AUTH_MODE:-local}
      - AZURE_CLIENT_ID=${AZURE_CLIENT_ID:-}
      - AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET:-}
      - AZURE_TENANT_ID=${AZURE_TENANT_ID:-}
      - AZURE_REDIRECT_URI=${AZURE_REDIRECT_URI:-}
      - ALLOWED_HOSTS=${ALLOWED_HOSTS:-localhost}
      - CSRF_TRUSTED_ORIGINS=${CSRF_TRUSTED_ORIGINS:-}
      - DEMO_MODE=${DEMO_MODE:-}
      - DEMO_DATA_PROFILE=${DEMO_DATA_PROFILE:-}
      # Email defaults: if not configured in .env, email logs to console (no
      # real emails sent). To enable email, set EMAIL_BACKEND, EMAIL_HOST, and
      # credentials in .env — see docs/deploy-ovhcloud.md Step 13.
      - DEFAULT_FROM_EMAIL=${DEFAULT_FROM_EMAIL:-KoNote <noreply@konote.app>}
      - EMAIL_BACKEND=${EMAIL_BACKEND:-django.core.mail.backends.console.EmailBackend}
      - EMAIL_HOST=${EMAIL_HOST:-}
      - EMAIL_PORT=${EMAIL_PORT:-587}
      - EMAIL_USE_TLS=${EMAIL_USE_TLS:-True}
      - EMAIL_HOST_USER=${EMAIL_HOST_USER:-}
      - EMAIL_HOST_PASSWORD=${EMAIL_HOST_PASSWORD:-}
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      - OPENROUTER_MODEL=${OPENROUTER_MODEL:-anthropic/claude-sonnet-4-20250514}
      - EMBED_ALLOWED_ORIGINS=${EMBED_ALLOWED_ORIGINS:-}
    ports:
      - "127.0.0.1:8000:8000"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    depends_on:
      db:
        condition: service_healthy
      audit_db:
        condition: service_healthy
    networks:
      - frontend
      - backend

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    logging: *default-logging
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=${POSTGRES_DB:-konote}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - backend

  audit_db:
    image: postgres:16-alpine
    restart: unless-stopped
    logging: *default-logging
    volumes:
      - audit_pgdata:/var/lib/postgresql/data
      - ./scripts/audit_db_init.sql:/docker-entrypoint-initdb.d/01-init.sql
    environment:
      - POSTGRES_DB=${AUDIT_POSTGRES_DB:-konote_audit}
      - POSTGRES_USER=${AUDIT_POSTGRES_USER}
      - POSTGRES_PASSWORD=${AUDIT_POSTGRES_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${AUDIT_POSTGRES_USER} -d ${AUDIT_POSTGRES_DB:-konote_audit}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - backend

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    logging: *default-logging
    ports:
      - "80:80"
      - "443:443"
    environment:
      - DOMAIN=${DOMAIN:-localhost}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - web
    networks:
      - frontend

  autoheal:
    image: willfarrell/autoheal
    restart: always
    logging: *default-logging
    environment:
      - AUTOHEAL_CONTAINER_LABEL=all
      - AUTOHEAL_INTERVAL=30
      - AUTOHEAL_START_PERIOD=60
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  # -----------------------------------------------------------------------
  # Ops sidecar — automated backups, monitoring, health reports
  # All scheduled tasks run inside this container. No host-level cron needed.
  # See docs/deploy-ovhcloud.md Section 11 for configuration.
  # -----------------------------------------------------------------------
  ops:
    build:
      context: .
      dockerfile: Dockerfile.ops
      args:
        KONOTE_VERSION: "${KONOTE_VERSION:-dev}"
    restart: unless-stopped
    logging: *default-logging
    environment:
      # Database credentials (for pg_dump / pg_isready)
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB:-konote}
      - AUDIT_POSTGRES_USER=${AUDIT_POSTGRES_USER}
      - AUDIT_POSTGRES_PASSWORD=${AUDIT_POSTGRES_PASSWORD}
      - AUDIT_POSTGRES_DB=${AUDIT_POSTGRES_DB:-konote_audit}
      # Domain (for health report subject line)
      - DOMAIN=${DOMAIN:-localhost}
      # Email (for health report delivery — same SMTP settings as Django)
      - EMAIL_HOST=${EMAIL_HOST:-}
      - EMAIL_PORT=${EMAIL_PORT:-587}
      - EMAIL_HOST_USER=${EMAIL_HOST_USER:-}
      - EMAIL_HOST_PASSWORD=${EMAIL_HOST_PASSWORD:-}
      - DEFAULT_FROM_EMAIL=${DEFAULT_FROM_EMAIL:-KoNote <noreply@konote.app>}
      # Ops-specific settings (all optional — see .env.example)
      - OPS_HEALTH_REPORT_TO=${OPS_HEALTH_REPORT_TO:-}
      - HEALTHCHECK_PING_URL=${HEALTHCHECK_PING_URL:-}
      - ALERT_WEBHOOK_URL=${ALERT_WEBHOOK_URL:-}
      - BACKUP_RETENTION_DAYS=${BACKUP_RETENTION_DAYS:-30}
      - AUDIT_RETENTION_DAYS=${AUDIT_RETENTION_DAYS:-90}
      - DISK_THRESHOLD=${DISK_THRESHOLD:-80}
      - OPS_PRUNE_ENABLED=${OPS_PRUNE_ENABLED:-true}
      - OPS_VERIFY_BACKUPS=${OPS_VERIFY_BACKUPS:-true}
    volumes:
      - ./backups:/backups                         # Host-bind backup directory
      # SECURITY NOTE: Docker socket grants full Docker API access. If ops
      # container is compromised, attacker can control host containers. Consider
      # tecnativa/docker-socket-proxy for high-threat environments.
      - /var/run/docker.sock:/var/run/docker.sock  # For docker system prune
    depends_on:
      db:
        condition: service_healthy
      audit_db:
        condition: service_healthy
    networks:
      - backend
    healthcheck:
      test: ["CMD", "pgrep", "crond"]
      interval: 60s
      timeout: 5s
      retries: 3
      start_period: 10s

volumes:
  pgdata:
  audit_pgdata:
  caddy_data:
  caddy_config:

networks:
  frontend:
  backend: