StudyForge/docker-compose.prod.yml at main · Dipendra2003/StudyForge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
# =============================================================================
# StudyForge — Docker Compose Production Override
# =============================================================================
# Usage: docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
#
# Features:
#   - Multi-stage production Dockerfile (optimized, ~150MB image)
#   - Nginx reverse proxy with SSL-ready config
#   - Resource limits on all containers
#   - Restart policies for reliability
#   - Logging configuration with rotation
#   - Security hardening (no-new-privileges, read-only where possible)
#   - Internal-only DB/Redis ports (not exposed to host)
# =============================================================================

services:
  # ---------------------------------------------------------------------------
  # Application — Production Build
  # ---------------------------------------------------------------------------
  app:
    build:
      context: .
      dockerfile: Dockerfile
    environment:
      NODE_ENV: production
      RUN_MIGRATIONS: "true"
    restart: unless-stopped
    # Don't expose app port directly — Nginx handles external traffic
    expose:
      - "5000"
    # Security hardening
    security_opt:
      - no-new-privileges:true
    # Writable tmpfs for logs and temp files (app filesystem is read-only)
    read_only: true
    tmpfs:
      - /tmp:size=100M
      - /app/logs:size=50M
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 1024M
        reservations:
          cpus: "0.5"
          memory: 256M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

  # ---------------------------------------------------------------------------
  # Nginx Reverse Proxy
  # ---------------------------------------------------------------------------
  nginx:
    image: nginx:1.27-alpine
    container_name: studyforge-nginx
    depends_on:
      app:
        condition: service_healthy
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
      # SSL Certificates volume (must exist)
      - ./nginx/certs:/etc/nginx/certs:ro
    ports:
      - "80:80"
      - "443:443"
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:size=10M
      - /var/cache/nginx:size=50M
      - /var/run:size=1M
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 128M
    logging:
      driver: json-file
      options:
        max-size: "5m"
        max-file: "3"
    networks:
      - studyforge-network

  # ---------------------------------------------------------------------------
  # Database — Production Hardening
  # ---------------------------------------------------------------------------
  db:
    restart: unless-stopped
    # Don't expose DB port externally in production
    expose:
      - "5432"
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 128M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

  # ---------------------------------------------------------------------------
  # Redis — Production Hardening
  # ---------------------------------------------------------------------------
  redis:
    restart: unless-stopped
    # Don't expose Redis port externally in production
    expose:
      - "6379"
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M
        reservations:
          cpus: "0.1"
          memory: 64M
    logging:
      driver: json-file
      options:
        max-size: "5m"
        max-file: "3"

  # ---------------------------------------------------------------------------
  # ClamAV Virus Scanner (Optional — uncomment to enable)
  # ---------------------------------------------------------------------------
  # clamav:
  #   image: clamav/clamav:stable
  #   container_name: studyforge-clamav
  #   restart: unless-stopped
  #   expose:
  #     - "3310"
  #   security_opt:
  #     - no-new-privileges:true
  #   deploy:
  #     resources:
  #       limits:
  #         cpus: "1.0"
  #         memory: 2048M
  #       reservations:
  #         cpus: "0.25"
  #         memory: 512M
  #   networks:
  #     - studyforge-network