docker-compose.production.yml

version: '3.8'

services:
  # Main AgentFlow Backend
  agentflow-backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
      target: production
    container_name: agentflow-backend-prod
    restart: unless-stopped
    environment:
      - NODE_ENV=production
      - PORT=3001
      - DATABASE_URL=sqlite:///app/data/agentflow_production.db
      - REDIS_URL=redis://redis:6379
      - LOG_LEVEL=info
      - ENABLE_METRICS=true
      - ENABLE_ANALYTICS=true
      - CORS_ORIGINS=https://agentflow.com,agentflow://
      - JWT_SECRET=${JWT_SECRET}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
    ports:
      - "3001:3001"
    volumes:
      - ./backend/data:/app/data
      - ./backend/logs:/app/logs
      - ./backend/config:/app/config:ro
    depends_on:
      - redis
      - prometheus
    networks:
      - agentflow-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          memory: 4G
          cpus: '2.0'
        reservations:
          memory: 2G
          cpus: '1.0'
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.agentflow-backend.rule=Host(`api.agentflow.com`)"
      - "traefik.http.routers.agentflow-backend.tls=true"
      - "traefik.http.routers.agentflow-backend.tls.certresolver=letsencrypt"

  # Redis for Caching and Session Management
  redis:
    image: redis:7-alpine
    container_name: agentflow-redis-prod
    restart: unless-stopped
    command: >
      --requirepass ${REDIS_PASSWORD}
      --maxmemory 512mb
      --maxmemory-policy allkeys-lru
      --save 900 1
      --save 300 10
      --save 60 10000
    volumes:
      - redis-data:/data
      - ./redis/redis.conf:/usr/local/etc/redis/redis.conf:ro
    networks:
      - agentflow-network
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Nginx Reverse Proxy
  nginx:
    image: nginx:alpine
    container_name: agentflow-nginx-prod
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - ./nginx/logs:/var/log/nginx
      - nginx-cache:/var/cache/nginx
    depends_on:
      - agentflow-backend
    networks:
      - agentflow-network
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Prometheus for Metrics Collection
  prometheus:
    image: prom/prometheus:latest
    container_name: agentflow-prometheus-prod
    restart: unless-stopped
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=30d'
      - '--web.enable-lifecycle'
      - '--web.enable-admin-api'
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    networks:
      - agentflow-network
    depends_on:
      - node-exporter
      - cadvisor

  # Grafana for Visualization
  grafana:
    image: grafana/grafana:latest
    container_name: agentflow-grafana-prod
    restart: unless-stopped
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SECURITY_ALLOW_EMBEDDING=true
      - GF_AUTH_ANONYMOUS_ENABLED=true
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Viewer
      - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource
    ports:
      - "3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources:ro
    networks:
      - agentflow-network
    depends_on:
      - prometheus

  # Node Exporter for System Metrics
  node-exporter:
    image: prom/node-exporter:latest
    container_name: agentflow-node-exporter-prod
    restart: unless-stopped
    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    ports:
      - "9100:9100"
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    networks:
      - agentflow-network

  # cAdvisor for Container Metrics
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: agentflow-cadvisor-prod
    restart: unless-stopped
    privileged: true
    devices:
      - /dev/kmsg:/dev/kmsg
    ports:
      - "8080:8080"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
      - /cgroup:/cgroup:ro
    networks:
      - agentflow-network

  # Elasticsearch for Centralized Logging
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    container_name: agentflow-elasticsearch-prod
    restart: unless-stopped
    environment:
      - node.name=elasticsearch
      - cluster.name=agentflow-cluster
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
      - xpack.security.enabled=false
      - xpack.security.enrollment.enabled=false
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"
    networks:
      - agentflow-network
    healthcheck:
      test: ["CMD-SHELL", "curl -s http://localhost:9200/_cluster/health"]
      interval: 30s
      timeout: 10s
      retries: 5

  # Kibana for Log Visualization
  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    container_name: agentflow-kibana-prod
    restart: unless-stopped
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - SERVER_NAME=kibana
      - SERVER_HOST=0.0.0.0
    ports:
      - "5601:5601"
    volumes:
      - kibana-data:/usr/share/kibana/data
    depends_on:
      - elasticsearch
    networks:
      - agentflow-network
    healthcheck:
      test: ["CMD-SHELL", "curl -s http://localhost:5601/api/status"]
      interval: 30s
      timeout: 10s
      retries: 5

  # Logstash for Log Processing
  logstash:
    image: docker.elastic.co/logstash/logstash:8.11.0
    container_name: agentflow-logstash-prod
    restart: unless-stopped
    environment:
      - "LS_JAVA_OPTS=-Xmx1g -Xms1g"
    volumes:
      - ./monitoring/logstash/config:/usr/share/logstash/config:ro
      - ./monitoring/logstash/pipeline:/usr/share/logstash/pipeline:ro
      - ./backend/logs:/usr/share/logstash/logs:ro
    ports:
      - "5044:5044"
      - "5000:5000/tcp"
      - "5000:5000/udp"
      - "9600:9600"
    depends_on:
      - elasticsearch
    networks:
      - agentflow-network

  # Jaeger for Distributed Tracing
  jaeger:
    image: jaegertracing/all-in-one:latest
    container_name: agentflow-jaeger-prod
    restart: unless-stopped
    environment:
      - COLLECTOR_ZIPKIN_HOST_PORT=:9411
      - COLLECTOR_OTLP_ENABLED=true
    ports:
      - "5775:5775/udp"
      - "6831:6831/udp"
      - "6832:6832/udp"
      - "5778:5778"
      - "16686:16686"
      - "14250:14250"
      - "14268:14268"
      - "14269:14269"
      - "9411:9411"
    networks:
      - agentflow-network

  # AlertManager for Alerting
  alertmanager:
    image: prom/alertmanager:latest
    container_name: agentflow-alertmanager-prod
    restart: unless-stopped
    ports:
      - "9093:9093"
    volumes:
      - ./monitoring/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - alertmanager-data:/alertmanager
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
      - '--web.external-url=http://localhost:9093'
    networks:
      - agentflow-network

  # Backup Service for Data Protection
  backup:
    image: alpine:latest
    container_name: agentflow-backup-prod
    restart: unless-stopped
    environment:
      - BACKUP_SCHEDULE=0 2 * * *  # Daily at 2 AM
      - RETENTION_DAYS=30
      - S3_BUCKET=${BACKUP_S3_BUCKET}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
    volumes:
      - ./backend/data:/data:ro
      - ./backup-scripts:/backup-scripts:ro
      - backup-storage:/backup
    command: sh -c "while true; do /backup-scripts/backup.sh; sleep 86400; done"
    networks:
      - agentflow-network
    depends_on:
      - agentflow-backend

  # Health Check Service
  healthcheck:
    image: curlimages/curl:latest
    container_name: agentflow-healthcheck-prod
    restart: unless-stopped
    environment:
      - CHECK_INTERVAL=30
      - WEBHOOK_URL=${HEALTH_WEBHOOK_URL}
    command: >
      sh -c '
        while true; do
          if curl -f http://agentflow-backend:3001/health; then
            echo "Health check passed at $(date)"
          else
            echo "Health check failed at $(date)"
            if [ -n "$$WEBHOOK_URL" ]; then
              curl -X POST "$$WEBHOOK_URL" -d "AgentFlow health check failed"
            fi
          fi
          sleep $$CHECK_INTERVAL
        done
      '
    networks:
      - agentflow-network
    depends_on:
      - agentflow-backend

networks:
  agentflow-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

volumes:
  redis-data:
    driver: local
  nginx-cache:
    driver: local
  prometheus-data:
    driver: local
  grafana-data:
    driver: local
  elasticsearch-data:
    driver: local
  kibana-data:
    driver: local
  alertmanager-data:
    driver: local
  backup-storage:
    driver: local

# Production deployment secrets (use .env.production file)
# JWT_SECRET=your-super-secret-jwt-key
# ENCRYPTION_KEY=your-32-character-encryption-key
# REDIS_PASSWORD=your-redis-password
# GRAFANA_ADMIN_PASSWORD=your-grafana-password
# BACKUP_S3_BUCKET=your-backup-bucket
# AWS_ACCESS_KEY_ID=your-aws-key
# AWS_SECRET_ACCESS_KEY=your-aws-secret
# HEALTH_WEBHOOK_URL=your-health-webhook-url