projet_gestion_commande/docker/docker-compose-prod.yml

services:
    # =========================================================
    # Backend Go
    # =========================================================
    backend:
        image: xor1234/backend-mln:latest
        container_name: gestion-backend
        restart: unless-stopped
        environment:
            - DB_HOST=${DB_HOST:-postgres}
            - DB_PORT=${DB_PORT:-5432}
            - DB_USER=${DB_USER:-postgres}
            - DB_PASSWORD=${DB_PASSWORD}
            - DB_NAME=${DB_NAME:-gestion_db}
            - DB_SSLMODE=${DB_SSLMODE:-disable}
            - SESSION_SECRET=${SESSION_SECRET}
            - USER_JWT_SECRET=${USER_JWT_SECRET}
            - USER_JWT_SECRET_OLD=${USER_JWT_SECRET_OLD}
            - ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
            - ADMIN_JWT_SECRET_OLD=${ADMIN_JWT_SECRET_OLD}
            - REDIS_HOST=${REDIS_HOST:-redis}
            - REDIS_PORT=${REDIS_PORT:-6379}
            - REDIS_PASSWORD=${REDIS_PASSWORD}
            - TOMTOM_API_KEY=${TOMTOM_API_KEY}
            - API_PORT=${API_PORT:-8080}
            - TELEGRAM_WEBHOOK_URL=${TELEGRAM_WEBHOOK_URL}
            - TELEGRAM_WEBHOOK_SECRET=${TELEGRAM_WEBHOOK_SECRET}
            - NOWPAYMENTS_IPN_SECRET=${NOWPAYMENTS_IPN_SECRET}
        volumes:
            - backend_uploads:/app/uploads
        networks:
            - gestion-network
        depends_on:
            postgres:
                condition: service_healthy
            redis:
                condition: service_healthy

    # =========================================================
    # Frontend Web (React/Vite — servi en HTTP interne)
    # =========================================================
    frontend:
        image: xor1234/frontend-mln:latest
        container_name: gestion-frontend
        restart: unless-stopped
        networks:
            - gestion-network
        depends_on:
            - backend

    waf:
        image: xor1234/backend-mln:waf
        container_name: gestion-waf
        restart: unless-stopped
        environment:
            - DISABLE_MODSEC_ENV_SUBST=true
            - PARANOIA=2
            - ANOMALY_INBOUND=5
            - ANOMALY_OUTBOUND=4
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - backend_uploads:/usr/share/nginx/html/uploads:ro
            - ./certs:/etc/nginx/certs:ro
        networks:
            - gestion-network
        depends_on:
            - backend
            - frontend

    # =========================================================
    # PostgreSQL
    # =========================================================
    postgres:
        image: postgres:16-alpine
        container_name: gestion-postgres
        restart: unless-stopped
        environment:
            - POSTGRES_USER=${DB_USER:-postgres}
            - POSTGRES_PASSWORD=${DB_PASSWORD}
            - POSTGRES_DB=${DB_NAME:-gestion_db}
            - PGDATA=/var/lib/postgresql/data/pgdata
        volumes:
            - postgres_data:/var/lib/postgresql/data
        networks:
            - gestion-network
        healthcheck:
            test:
                [
                    "CMD-SHELL",
                    "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-gestion_db}",
                ]
            interval: 10s
            timeout: 5s
            retries: 5
            start_period: 10s

    # =========================================================
    # Redis
    # =========================================================
    redis:
        image: redis:7-alpine
        container_name: gestion-redis
        restart: unless-stopped
        command: >
            redis-server
            --requirepass ${REDIS_PASSWORD}
            --appendonly yes
            --appendfsync everysec
            --maxmemory 256mb
            --maxmemory-policy allkeys-lru
        volumes:
            - redis_data:/data
        networks:
            - gestion-network
        healthcheck:
            test:
                [
                    "CMD",
                    "redis-cli",
                    "--no-auth-warning",
                    "-a",
                    "${REDIS_PASSWORD}",
                    "ping",
                ]
            interval: 10s
            timeout: 3s
            retries: 5
            start_period: 10s

    dozzle-agent:
        image: amir20/dozzle:latest
        command: agent
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock:ro
        ports:
            - "7007:7007"
        restart: unless-stopped

    clamav:
        deploy:
            resources:
                limits:
                    memory: 1g
                    cpus: 0.5
        image: clamav/clamav:latest
        container_name: gestion-clamav
        restart: unless-stopped
        volumes:
            - backend_uploads:/app/uploads:ro
            - clamav_data:/var/lib/clamav
        networks:
            - gestion-network
        healthcheck:
            test: ["CMD", "clamdcheck.sh"]
            interval: 60s
            timeout: 10s
            retries: 3
            start_period: 120s

networks:
    gestion-network:
        driver: bridge
        internal: false
        driver_opts:
            com.docker.network.bridge.name: gestion-br0

volumes:
    postgres_data:
        driver: local
    redis_data:
        driver: local
    backend_uploads:
        driver: local
    clamav_data:
        driver: local