version: '3.8'

# Configuration Docker Compose pour RegisFlow Production
# Version mise à jour avec optimisations et sécurité renforcée
services:
  # Base de données PostgreSQL optimisée
  regisflow-db:
    image: postgres:16-alpine
    container_name: regisflow-db
    environment:
      POSTGRES_DB: regisflow
      POSTGRES_USER: regisflow
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-RegisFlow2025!PostgreSQL}
      POSTGRES_INITDB_ARGS: "--auth-host=scram-sha-256 --auth-local=scram-sha-256"
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
    ports:
      - "${POSTGRES_PORT:-5433}:5432"
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U regisflow -d regisflow"]
      interval: 20s
      timeout: 5s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '0.5'
        reservations:
          memory: 256M
          cpus: '0.25'

  # Application RegisFlow
  regisflow:
    build: 
      context: .
      dockerfile: Dockerfile.simple
      target: production
      args:
        - NODE_ENV=production
    image: regisflow:latest
    container_name: regisflow-app
    depends_on:
      regisflow-db:
        condition: service_healthy
    pull_policy: never
    environment:
      NODE_ENV: production
      PORT: 5000
      DATABASE_URL: postgresql://regisflow:${POSTGRES_PASSWORD:-RegisFlow2025!PostgreSQL}@regisflow-db:5432/regisflow?sslmode=disable
      SESSION_SECRET: ${SESSION_SECRET:-RegisFlow2025SessionSecretKey1234567890ABCDEF}
      TZ: ${TZ:-Europe/Paris}
      SECURE_COOKIES: ${SECURE_COOKIES:-true}
      DATA_RETENTION_MONTHS: ${DATA_RETENTION_MONTHS:-19}
      BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-90}
      MAX_BACKUP_COUNT: ${MAX_BACKUP_COUNT:-20}
      PHOTO_STORAGE_LIMIT: ${PHOTO_STORAGE_LIMIT:-10485760}
      LOG_LEVEL: ${LOG_LEVEL:-info}
    volumes:
      - backup_data:/app/backups
      - logs_data:/app/logs
    ports:
      - "${APP_PORT:-5000}:5000"
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    read_only: false
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:5000/health || exit 1"]
      interval: 30s
      timeout: 15s
      retries: 3
      start_period: 90s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '1.0'
        reservations:
          memory: 512M
          cpus: '0.5'

# Volumes persistants (Docker gère automatiquement)
volumes:
  postgres_data:
    driver: local
  backup_data:
    driver: local
  logs_data:
    driver: local

# Utilisation du réseau nginx_default existant
networks:
  default:
    external: true
    name: nginx_default