Update the application's production environment for enhanced performance

Refactors the Docker setup, upgrades Node.js and PostgreSQL versions, and improves security.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 4b008663-bd72-492b-b0b6-fa252367e730
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/0715008c-7244-40f4-befc-26c014852236/4b008663-bd72-492b-b0b6-fa252367e730/6nnsA2m

docker-compose.yml

@@ -1,27 +1,40 @@
 version: '3.8'
 
-# Configuration Docker Compose pour RegisFlow
-# Réseau configurable via variables d'environnement
+# Configuration Docker Compose pour RegisFlow Production
+# Version mise à jour avec optimisations et sécurité renforcée
 services:
-  # Base de données PostgreSQL
+  # Base de données PostgreSQL optimisée
   regisflow-db:
-    image: postgres:15-alpine
+    image: postgres:16-alpine
     container_name: regisflow-db
     environment:
       POSTGRES_DB: regisflow
       POSTGRES_USER: regisflow
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-RegisFlow2024!PostgreSQL}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-RegisFlow2025!PostgreSQL}
+      POSTGRES_INITDB_ARGS: "--auth-host=scram-sha-256 --auth-local=scram-sha-256"
+      PGDATA: /var/lib/postgresql/data/pgdata
     volumes:
       - postgres_data:/var/lib/postgresql/data
+      - ./init.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
     ports:
-      - "5433:5432"
+      - "${POSTGRES_PORT:-5433}:5432"
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U regisflow -d regisflow"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
+      interval: 20s
+      timeout: 5s
+      retries: 3
       start_period: 30s
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+          cpus: '0.5'
+        reservations:
+          memory: 256M
+          cpus: '0.25'
 
   # Application RegisFlow
   regisflow:
@@ -31,6 +44,7 @@ services:
       target: production
       args:
         - NODE_ENV=production
+    image: regisflow:latest
     container_name: regisflow-app
     depends_on:
       regisflow-db:
@@ -39,25 +53,40 @@ services:
     environment:
       NODE_ENV: production
       PORT: 5000
-      DATABASE_URL: postgresql://regisflow:${POSTGRES_PASSWORD:-RegisFlow2024!PostgreSQL}@regisflow-db:5432/regisflow
-      SESSION_SECRET: ${SESSION_SECRET:-RegisFlow2024SessionSecretKey1234567890ABCDEF}
+      DATABASE_URL: postgresql://regisflow:${POSTGRES_PASSWORD:-RegisFlow2025!PostgreSQL}@regisflow-db:5432/regisflow
+      SESSION_SECRET: ${SESSION_SECRET:-RegisFlow2025SessionSecretKey1234567890ABCDEF}
       TZ: ${TZ:-Europe/Paris}
-      SECURE_COOKIES: ${SECURE_COOKIES:-false}
+      SECURE_COOKIES: ${SECURE_COOKIES:-true}
       DATA_RETENTION_MONTHS: ${DATA_RETENTION_MONTHS:-19}
       BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-90}
       MAX_BACKUP_COUNT: ${MAX_BACKUP_COUNT:-20}
+      PHOTO_STORAGE_LIMIT: ${PHOTO_STORAGE_LIMIT:-10485760}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
     volumes:
       - backup_data:/app/backups
       - logs_data:/app/logs
     ports:
-      - "5000:5000"
+      - "${APP_PORT:-5000}:5000"
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    read_only: false
+    tmpfs:
+      - /tmp:noexec,nosuid,size=100m
     healthcheck:
       test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:5000/health || exit 1"]
       interval: 30s
       timeout: 15s
       retries: 3
       start_period: 90s
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+          cpus: '1.0'
+        reservations:
+          memory: 512M
+          cpus: '0.5'
 
 # Volumes persistants (Docker gère automatiquement)
 volumes: