docker-compose.yml

services:
  # PostgreSQL Database
  db:
    image: postgres:16-alpine
    container_name: isms-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-little_isms}
      POSTGRES_USER: ${POSTGRES_USER:-isms_user}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-isms_password}
    ports:
      # ✅ Security: Port nur auf localhost verfügbar
      - "127.0.0.1:${DB_PORT:-5432}:5432"
    volumes:
      - db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-isms_user} -d ${POSTGRES_DB:-little_isms}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - isms-network
    # Security: Resource Limits
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Little ISMS Helper Application
  app:
    build:
      context: .
      dockerfile: Dockerfile
      target: production
    container_name: isms-app
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      mailhog:
        condition: service_started
    ports:
      - "${APP_PORT:-8000}:80"
      - "${APP_PORT_HTTPS:-8443}:443"
    volumes:
      # Named volumes for cache and logs
      - var_cache:/var/www/html/var/cache
      - var_log:/var/www/html/var/log
    environment:
      # Note: APP_SECRET und DATABASE_URL werden vom Deployment Wizard konfiguriert
      APP_ENV: ${APP_ENV:-prod}
      APP_DEBUG: ${APP_DEBUG:-0}
      # External-DB mode — skip embedded MariaDB bootstrap in init-mysql.sh
      EMBEDDED_DB: none
      DATABASE_URL: "postgresql://${POSTGRES_USER:-isms_user}:${POSTGRES_PASSWORD:-isms_password}@db:5432/${POSTGRES_DB:-little_isms}?serverVersion=16&charset=utf8"
      # MailHog für Email-Testing
      MAILER_DSN: smtp://mailhog:1025
    networks:
      - isms-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/de/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 300s
    # Security: Resource Limits
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # MailHog - Email Testing
  mailhog:
    image: mailhog/mailhog:latest
    container_name: isms-mailhog
    restart: unless-stopped
    ports:
      - "127.0.0.1:${MAILHOG_SMTP_PORT:-1025}:1025"  # SMTP port
      - "127.0.0.1:${MAILHOG_WEB_PORT:-8025}:8025"   # Web UI port
    networks:
      - isms-network
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8025/api/v1/events"]
      interval: 30s
      timeout: 5s
      retries: 3
    # Security: Resource Limits
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # pgAdmin - Database Management (Optional - nur für Development!)
  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: isms-pgadmin
    restart: unless-stopped
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL:-admin@example.com}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD:-admin}
      PGADMIN_CONFIG_SERVER_MODE: 'False'
      PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: 'False'
    ports:
      # ✅ Security: Port nur auf localhost verfügbar
      - "127.0.0.1:${PGADMIN_PORT:-5050}:80"
    volumes:
      - pgadmin_data:/var/lib/pgadmin
    networks:
      - isms-network
    depends_on:
      - db
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/misc/ping"]
      interval: 30s
      timeout: 5s
      retries: 3
    # Security: Resource Limits
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  # ✅ Alle Volumes sind persistent - überleben docker-compose down und Reboot!
  db_data:
    driver: local
  var_cache:
    driver: local
  var_log:
    driver: local
  pgadmin_data:
    driver: local

networks:
  isms-network:
    driver: bridge