Prepare the application for deployment into a production environment

Configures application for production with enhanced security, performance optimizations, and automated deployment scripts.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 91318273-c764-4fd4-be04-bdc12c38af32
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/0715008c-7244-40f4-befc-26c014852236/6e755801-08e8-4492-805e-ac3610de5a2a.jpg

docker-compose.yml

@@ -1,29 +1,46 @@
 version: '3.8'
 
+# Configuration Docker Compose pour PRODUCTION RegisFlow
 services:
-  # Base de données PostgreSQL
+  # Base de données PostgreSQL (Production)
   regisflow-db:
     image: postgres:15-alpine
     container_name: regisflow-db
     environment:
       POSTGRES_DB: regisflow
       POSTGRES_USER: regisflow
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-RegisFlow2024!}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      # Optimisations PostgreSQL pour production
+      POSTGRES_INITDB_ARGS: "--auth-host=md5 --auth-local=peer"
     volumes:
       - postgres_data:/var/lib/postgresql/data
       - ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro
+      - ./postgres-prod.conf:/etc/postgresql/postgresql.conf:ro
     ports:
       - "5433:5432"
     restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U regisflow -d regisflow"]
-      interval: 10s
-      timeout: 5s
+      interval: 30s
+      timeout: 10s
       retries: 5
+      start_period: 30s
+    # Limites de ressources pour production
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+        reservations:
+          memory: 256M
+    # Configuration réseau sécurisée
+    networks:
+      - regisflow-internal
 
-  # Application RegisFlow
+  # Application RegisFlow (Production)
   regisflow:
-    build: .
+    build: 
+      context: .
+      target: production
     container_name: regisflow-app
     depends_on:
       regisflow-db:
@@ -31,23 +48,70 @@ services:
     environment:
       NODE_ENV: production
       PORT: 5000
-      DATABASE_URL: postgresql://regisflow:${POSTGRES_PASSWORD:-RegisFlow2024!}@regisflow-db:5432/regisflow
-      SESSION_SECRET: ${SESSION_SECRET:-your-super-secret-session-key-change-in-production}
-      TZ: Europe/Paris
+      DATABASE_URL: postgresql://regisflow:${POSTGRES_PASSWORD}@regisflow-db:5432/regisflow
+      SESSION_SECRET: ${SESSION_SECRET}
+      TZ: ${TZ:-Europe/Paris}
+      # Configuration sécurité production
+      SECURE_COOKIES: ${SECURE_COOKIES:-true}
+      DATA_RETENTION_MONTHS: ${DATA_RETENTION_MONTHS:-19}
+      BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-90}
+      MAX_BACKUP_COUNT: ${MAX_BACKUP_COUNT:-20}
     volumes:
       - backup_data:/app/backups
+      - logs_data:/app/logs
     ports:
       - "5000:5000"
     restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:5000/health || exit 1"]
       interval: 30s
-      timeout: 10s
+      timeout: 15s
       retries: 3
-      start_period: 60s
+      start_period: 90s
+    # Limites de ressources pour production
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+        reservations:
+          memory: 512M
+    # Configuration réseau sécurisée
+    networks:
+      - regisflow-internal
+    # Sécurité container
+    security_opt:
+      - no-new-privileges:true
+    read_only: false
+    tmpfs:
+      - /tmp
 
+# Volumes persistants pour production
 volumes:
   postgres_data:
     driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${PWD}/data/postgres
   backup_data:
-    driver: local
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${PWD}/data/backups
+  logs_data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${PWD}/data/logs
+
+# Réseau interne sécurisé
+networks:
+  regisflow-internal:
+    driver: bridge
+    internal: false
+    ipam:
+      driver: default
+      config:
+        - subnet: 172.20.0.0/24