docker-compose.yml

services:
  postgres:
    # PostgreSQL 17.7-alpine - Lightweight and optimized (~150-200MB)
    image: postgres:17.7-alpine
    container_name: coupon-system-postgres
    environment:
      POSTGRES_DB: couponsystem
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    # Expose PostgreSQL to host for local development/testing only
    # Bound to localhost (127.0.0.1) for security - not accessible from network
    # In production, remove this port exposure entirely
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./src/main/resources/postgres-schema.sql:/docker-entrypoint-initdb.d/01-schema.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d couponsystem"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    restart: unless-stopped
    networks:
      - backend
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 256M

  app:
    build: .
    container_name: coupon-system-app
    ports:
      - '8080:8080'   # REST API endpoint
      - '9090:9090'   # Prometheus metrics endpoint
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -s http://localhost:8080/api/v1/public/coupons > /dev/null || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    environment:
      # Database Configuration
      DB_URL: jdbc:postgresql://coupon-system-postgres:5432/couponsystem
      DB_USER: ${DB_USER}
      DB_PASSWORD: ${POSTGRES_PASSWORD}

      # Admin Account
      ADMIN_EMAIL: ${ADMIN_EMAIL}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD}

      # JWT Configuration
      JWT_SECRET: ${JWT_SECRET}
      JWT_ACCESS_TOKEN_EXPIRATION: ${JWT_ACCESS_TOKEN_EXPIRATION:-3600000}
      JWT_REFRESH_TOKEN_EXPIRATION: ${JWT_REFRESH_TOKEN_EXPIRATION:-86400000}

      # Server Configuration
      SERVER_PORT: ${SERVER_PORT:-8080}
      METRICS_PORT: ${METRICS_PORT:-9090}
      LOGGING_LEVEL: ${LOGGING_LEVEL:-INFO}

      # Security Configuration
      ACCOUNT_LOCKOUT_MAX_ATTEMPTS: ${ACCOUNT_LOCKOUT_MAX_ATTEMPTS:-5}
      ACCOUNT_LOCKOUT_DURATION_MINUTES: ${ACCOUNT_LOCKOUT_DURATION_MINUTES:-30}
      ACCOUNT_LOCKOUT_ADMIN_ENABLED: ${ACCOUNT_LOCKOUT_ADMIN_ENABLED:-false}
      PASSWORD_BCRYPT_STRENGTH: ${PASSWORD_BCRYPT_STRENGTH:-12}

      # CORS Configuration
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:3000,http://localhost:5173}

      # Rate Limiting
      RATE_LIMIT_AUTH_CAPACITY: ${RATE_LIMIT_AUTH_CAPACITY:-5}
      RATE_LIMIT_AUTH_REFILL_RATE_MINUTES: ${RATE_LIMIT_AUTH_REFILL_RATE_MINUTES:-1}
      RATE_LIMIT_GENERAL_CAPACITY: ${RATE_LIMIT_GENERAL_CAPACITY:-100}
      RATE_LIMIT_GENERAL_REFILL_RATE_MINUTES: ${RATE_LIMIT_GENERAL_REFILL_RATE_MINUTES:-1}

      # Database Connection Pool
      DB_POOL_MIN_IDLE: ${DB_POOL_MIN_IDLE:-5}
      DB_POOL_MAX_POOL_SIZE: ${DB_POOL_MAX_POOL_SIZE:-20}
      DB_POOL_CONNECTION_TIMEOUT: ${DB_POOL_CONNECTION_TIMEOUT:-30000}
    volumes:
      # Persistent log storage
      - app_logs:/app/logs
    restart: unless-stopped
    networks:
      - backend
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M
    # Security hardening
    security_opt:
      - no-new-privileges:true
    read_only: false
    tmpfs:
      - /tmp

  frontend:
    build:
      context: ./coupon-system-frontend
      dockerfile: Dockerfile
      args:
        # Build-time environment variable for Vite
        # Uses /api/v1 by default - nginx proxies /api to backend (line 19-25 in nginx.conf)
        VITE_API_URL: /api/v1
    container_name: coupon-system-frontend
    ports:
      - "3000:80"
    depends_on:
      app:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - backend
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    # Security hardening
    security_opt:
      - no-new-privileges:true

volumes:
  postgres_data:
    driver: local
  app_logs:
    driver: local

networks:
  backend:
    driver: bridge