docker-compose.yml

# DELTA-24: version key removed (deprecated in Compose V2)
services:
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile.dev
      args:
        - VITE_API_URL=http://localhost:8000/api/v1
        - VITE_PAYSTACK_PUBLIC_KEY=${PAYSTACK_PUBLIC_KEY:-}
    container_name: serelo_frontend
    ports:
      - "3003:80"
    depends_on:
      - api
    restart: unless-stopped

  api:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: serelo_api
    ports:
      - "8000:8000"
    environment:
      - MONGODB_URL=mongodb://mongodb:27017
      - MONGODB_DB_NAME=serelo_db
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - S3_ENDPOINT=http://minio:9000
      - S3_PUBLIC_ENDPOINT=http://localhost:9000
      - S3_ACCESS_KEY=${S3_ACCESS_KEY:-minioadmin}
      - S3_SECRET_KEY=${S3_SECRET_KEY:-minioadmin}
      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
      - JWT_ALGORITHM=HS256
      - ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES:-60}
      - REFRESH_TOKEN_EXPIRE_DAYS=30
      - TEST_MODE=true
      - TESTING=1
      # OpenAI Configuration for LLM features
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - LLM_PROVIDER=${LLM_PROVIDER:-openai}
      # Payments
      - PAYSTACK_SECRET_KEY=${PAYSTACK_SECRET_KEY:-}
      - PAYSTACK_PUBLIC_KEY=${PAYSTACK_PUBLIC_KEY:-}
      # User Authentication OAuth (Google, GitHub)
      - GOOGLE_AUTH_CLIENT_ID=${GOOGLE_AUTH_CLIENT_ID}
      - GOOGLE_AUTH_CLIENT_SECRET=${GOOGLE_AUTH_CLIENT_SECRET}
      - GITHUB_AUTH_CLIENT_ID=${GITHUB_AUTH_CLIENT_ID}
      - GITHUB_AUTH_CLIENT_SECRET=${GITHUB_AUTH_CLIENT_SECRET}
      - OAUTH_STATE_SECRET=${OAUTH_STATE_SECRET}
      - FRONTEND_URL=${FRONTEND_URL:-http://localhost:3003}
      # Social Media OAuth (Facebook, LinkedIn for publishing)
      - SOCIAL_TOKEN_ENCRYPTION_KEY=${SOCIAL_TOKEN_ENCRYPTION_KEY}
      - FACEBOOK_APP_ID=${FACEBOOK_APP_ID:-}
      - FACEBOOK_APP_SECRET=${FACEBOOK_APP_SECRET:-}
      - FACEBOOK_CLIENT_ID=${FACEBOOK_CLIENT_ID:-}
      - FACEBOOK_CLIENT_SECRET=${FACEBOOK_CLIENT_SECRET:-}
      - FACEBOOK_REDIRECT_URI=${FACEBOOK_REDIRECT_URI:-http://localhost:3003/oauth/facebook/callback}
      - LINKEDIN_CLIENT_ID=${LINKEDIN_CLIENT_ID:-}
      - LINKEDIN_CLIENT_SECRET=${LINKEDIN_CLIENT_SECRET:-}
      - LINKEDIN_REDIRECT_URI=${LINKEDIN_REDIRECT_URI:-http://localhost:3003/oauth/linkedin/callback}
      # Trust & Safety: Email Validation
      - TANDS_EMAIL_VALIDATION_ENABLED=true
      - TANDS_EMAIL_VALIDATION_BLOCK_DISPOSABLE=true
      - TANDS_EMAIL_VALIDATION_MONITOR_ONLY=true
      # Trust & Safety: CAPTCHA
      - TANDS_CAPTCHA_ENABLED=true
      - TANDS_CAPTCHA_MONITOR_ONLY=true
      - RECAPTCHA_SECRET_KEY=${RECAPTCHA_SECRET_KEY:-}
      - RECAPTCHA_SCORE_THRESHOLD=0.5
      # Email/SMTP Configuration
      - SMTP_HOST=${SMTP_HOST:-smtp.gmail.com}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_USE_SSL=${SMTP_USE_SSL:-False}
      - SMTP_USERNAME=${SMTP_USERNAME}
      - SMTP_PASSWORD=${SMTP_PASSWORD}
      - EMAIL_FROM=${EMAIL_FROM}
      - EMAIL_FROM_NAME=${EMAIL_FROM_NAME:-Serelo}
      # Sentry Error Tracking
      - SENTRY_DSN=${SENTRY_DSN:-}
      - SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT:-development}
      - SENTRY_TRACES_SAMPLE_RATE=${SENTRY_TRACES_SAMPLE_RATE:-0.1}
      - SENTRY_PROFILES_SAMPLE_RATE=${SENTRY_PROFILES_SAMPLE_RATE:-0.1}
      # PostHog Product Analytics
      - POSTHOG_API_KEY=${POSTHOG_API_KEY:-}
      - POSTHOG_HOST=${POSTHOG_HOST:-https://us.i.posthog.com}
      # Encryption (for WordPress passwords, OAuth tokens, etc.)
      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}
    volumes:
      - ./backend/app:/app/app
      - ./backend/scripts:/app/scripts
      - ./backend/tests:/app/tests
      - ./backend/seed_test_data.py:/app/seed_test_data.py
      - ./backend/seed_system_templates.py:/app/seed_system_templates.py
    depends_on:
      - mongodb
      - redis
      - minio
    deploy:
      resources:
        limits:
          memory: 2G
        reservations:
          memory: 512M
    # Startup script will run seed_test_data.py then start uvicorn

  celery_worker:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: serelo_celery_worker
    restart: unless-stopped
    environment:
      - MONGODB_URL=mongodb://mongodb:27017
      - MONGODB_DB_NAME=serelo_db
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - S3_ENDPOINT=http://minio:9000
      - S3_ACCESS_KEY=${S3_ACCESS_KEY:-minioadmin}
      - S3_SECRET_KEY=${S3_SECRET_KEY:-minioadmin}
      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      # Social Media OAuth (needed for publishing worker)
      - SOCIAL_TOKEN_ENCRYPTION_KEY=${SOCIAL_TOKEN_ENCRYPTION_KEY}
      - FACEBOOK_APP_ID=${FACEBOOK_APP_ID:-}
      - FACEBOOK_APP_SECRET=${FACEBOOK_APP_SECRET:-}
      - FACEBOOK_CLIENT_ID=${FACEBOOK_CLIENT_ID:-}
      - FACEBOOK_CLIENT_SECRET=${FACEBOOK_CLIENT_SECRET:-}
      - LINKEDIN_CLIENT_ID=${LINKEDIN_CLIENT_ID:-}
      - LINKEDIN_CLIENT_SECRET=${LINKEDIN_CLIENT_SECRET:-}
      # Trust & Safety: Content Moderation
      - TANDS_MODERATION_INPUT=true
      - TANDS_MODERATION_OUTPUT=true
      - TANDS_MODERATION_MONITOR_ONLY=true
    volumes:
      - ./backend/app:/app/app
      - ./backend/scripts:/app/scripts
    depends_on:
      - mongodb
      - redis
      - minio
    deploy:
      resources:
        limits:
          memory: 2G
        reservations:
          memory: 512M
    command: celery -A app.core.celery_app worker --loglevel=info --concurrency=3 --queues=parsing,generation,maintenance

  celery_beat:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: serelo_celery_beat
    restart: unless-stopped
    environment:
      - MONGODB_URL=mongodb://mongodb:27017
      - MONGODB_DB_NAME=serelo_db
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - S3_ENDPOINT=http://minio:9000
      - S3_ACCESS_KEY=${S3_ACCESS_KEY:-minioadmin}
      - S3_SECRET_KEY=${S3_SECRET_KEY:-minioadmin}
      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
    volumes:
      - ./backend/app:/app/app
      - ./backend/scripts:/app/scripts
    depends_on:
      - mongodb
      - redis
      - celery_worker
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 256M
    command: celery -A app.core.celery_app beat --loglevel=info

  mongodb:
    image: mongo:7.0
    container_name: serelo_mongodb
    # DELTA-23: Bind to localhost only to prevent external access
    ports:
      - "127.0.0.1:27018:27017"
    volumes:
      - mongodb_data:/data/db
    environment:
      - MONGO_INITDB_DATABASE=serelo_db
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  redis:
    image: redis:7-alpine
    container_name: serelo_redis
    # DELTA-23: Bind to localhost only to prevent external access
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - redis_data:/data
    command: redis-server --requirepass ${REDIS_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "REDISCLI_AUTH=${REDIS_PASSWORD} redis-cli ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  minio:
    # DELTA-13: Pinned MinIO version (avoid unpredictable latest tag)
    image: minio/minio:RELEASE.2024-11-07T00-52-20Z
    container_name: serelo_minio
    ports:
      - "127.0.0.1:9000:9000"
      - "127.0.0.1:9001:9001"
    environment:
      - MINIO_ROOT_USER=${S3_ACCESS_KEY:-minioadmin}
      - MINIO_ROOT_PASSWORD=${S3_SECRET_KEY:-minioadmin}
    volumes:
      - minio_data:/data
    command: server /data --console-address ":9001"

  prometheus:
    image: prom/prometheus:v2.48.0
    container_name: serelo_prometheus
    ports:
      # Bind to localhost only - metrics not exposed to external networks
      - "127.0.0.1:9090:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=30d'
      - '--web.enable-lifecycle'
    restart: unless-stopped

  grafana:
    image: grafana/grafana:10.2.2
    container_name: serelo_grafana
    ports:
      # Bind to localhost only - dashboards not exposed to external networks
      - "127.0.0.1:3001:3000"
    environment:
      # DELTA-21: No default admin password - must be set via env var
      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD must be set}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SERVER_ROOT_URL=http://localhost:3001
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning
    depends_on:
      - prometheus
    restart: unless-stopped

volumes:
  mongodb_data:
  redis_data:
  minio_data:
  prometheus_data:
  grafana_data: