docker-compose.yml

services:
  # Load Balancer - Nginx
  nginx:
    build:
      context: .
      dockerfile: Dockerfile.nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./nginx/ssl:/etc/nginx/ssl
      - static_volume:/var/www/static
      - media_volume:/var/www/media
      - certbot_etc:/etc/letsencrypt
      - certbot_var:/var/lib/letsencrypt
      - webroot:/var/www/certbot
    user: root
    depends_on:
      - django
    networks:
      - techblog_network
    restart: always
    environment:
      - NGINX_ENVSUBST_TEMPLATE_DIR=/etc/nginx/conf.d
      - NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx/conf.d
      - NGINX_HOST=localhost
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 128M
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 30s
      timeout: 10s
      retries: 3
    # Security: Using official image, regularly update to patch vulnerabilities.
    # Enforces HTTPS and adds security headers.

  # Web Application - Django with Gunicorn
  django:
    build:
      context: .
      dockerfile: Dockerfile.django
    volumes:
      - .:/app
      - logs:/app/logs
      - static_volume:/app/static
      - media_volume:/app/media
    expose:
      - 8000
    environment:
      SECRET_KEY: ${SECRET_KEY}  # Loaded from .env file
      DEBUG: ${DEBUG:-False}
      ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1}
      # Prefer passing through DATABASE_URL from .env to avoid duplication
      DATABASE_URL: ${DATABASE_URL}
      # Pass through REDIS_URL so URL-encoded credentials remain intact
      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
      DJANGO_SETTINGS_MODULE: techblog_cms.settings
      PYTHONPATH: /app
      DJANGO_ENV: production
      REDIS_PASSWORD: ${REDIS_PASSWORD}
    depends_on:
      - db
      - redis
    networks:
      - techblog_network
    restart: always
    user: appuser
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 512M
    # Security: Runs the application as a non-root user.
    # Environment variables for sensitive settings.
    healthcheck:
      test: ["CMD", "python", "-c", "import requests; requests.get('http://localhost:8000/health/')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Database - PostgreSQL
  db:
    image: postgres:16-alpine
    volumes:
      - db_data:/var/lib/postgresql/data # Persist data
      - ./docker/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      # Optional app-specific DB credentials used by init-db.sh
      APP_DB_USER: ${APP_DB_USER:-}
      APP_DB_PASSWORD: ${APP_DB_PASSWORD:-}
      APP_DB_NAME: ${APP_DB_NAME:-}
    networks:
      - techblog_network
    restart: always
    user: postgres
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 512M
    # Security: Uses a specific PostgreSQL version.
    # Environment variables for credentials.

  # Caching - Redis
  redis:
    image: redis:7-alpine
    command: redis-server --requirepass ${REDIS_PASSWORD:-your_redis_password} # Set a password
    ports:
      - "6379:6379"
    networks:
      techblog_network:
        aliases:
          - cache
    restart: always
    user: redis
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 256M
    # Security: Requires a password for authentication.
    # Consider network restrictions for enhanced security.

  # Static Files Server
  static:
    image: nginx:alpine
    volumes:
      - static_volume:/usr/share/nginx/html
    ports:
      - "8080:80"
    networks:
      - techblog_network
    restart: unless-stopped
    user: root
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 128M

  certbot:
    image: certbot/certbot:latest
    volumes:
      - ./nginx/ssl:/etc/nginx/ssl:rw
      - certbot_etc:/etc/letsencrypt:rw
      - certbot_var:/var/lib/letsencrypt
      - webroot:/var/www/certbot
    user: root
    entrypoint: "/bin/sh"
    command: >
      -c 'trap exit TERM; while :; do 
      certbot renew --webroot -w /var/www/certbot --deploy-hook "cp -fL /etc/letsencrypt/live/${DOMAIN:-blog.iohub.link}/* /etc/nginx/ssl/ && chmod 644 /etc/nginx/ssl/*.pem" --quiet && 
      sleep 12h & wait $${!}; 
      done'
    restart: unless-stopped
    environment:
      - DOMAIN=blog.iohub.link

networks:
  techblog_network:
    driver: bridge

volumes:
  db_data:
  static_volume:
  logs:
    driver: local
  media_volume:
    driver: local
  certbot_etc:
  certbot_var:
  webroot: