dotcom-arcade/docker-compose.prod.yml

version: '3.8'

services:
  # Backend API Service
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    image: flashpoint-backend:latest
    container_name: flashpoint-backend
    restart: unless-stopped
    ports:
      - "${API_PORT:-3100}:3100"
    volumes:
      # Flashpoint data (read-only)
      - ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH environment variable must be set}:/data/flashpoint:ro
      # User database (persistent)
      - backend-db:/app/data
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - TZ=${TZ:-UTC}
      - PORT=3100
      - HOST=0.0.0.0
      # Flashpoint base path (all other paths derived automatically by backend)
      - FLASHPOINT_PATH=/data/flashpoint
      # Game service URLs (Docker network)
      - GAME_SERVICE_PROXY_URL=http://game-service:22500
      - GAME_SERVICE_GAMEZIP_URL=http://game-service:22501
      # External services
      - EXTERNAL_IMAGE_URLS=${EXTERNAL_IMAGE_URLS:-https://infinity.flashpointarchive.org/Flashpoint/Data/Images,https://infinity.unstable.life/Flashpoint/Data/Images}
      - DOMAIN=${DOMAIN:-http://localhost:${WEB_PORT:-80}}
      # Application settings
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET environment variable must be set}
      - USER_DB_PATH=/app/data/user.db
    depends_on:
      game-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:3100/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - backend-network
    # Security options
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Game Service (Proxy and ZIP Server)
  game-service:
    build:
      context: ./game-service
      dockerfile: Dockerfile
    image: flashpoint-game-service:latest
    container_name: flashpoint-game-service
    restart: unless-stopped
    ports:
      - "${PROXY_PORT:-22500}:22500"
      - "${GAMEZIP_PORT:-22501}:22501"
    volumes:
      - ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH environment variable must be set}:/data/flashpoint:ro
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - TZ=${TZ:-UTC}
      - PROXY_PORT=22500
      - GAMEZIPSERVER_PORT=22501
      # Flashpoint base path (all other paths derived automatically)
      - FLASHPOINT_PATH=/data/flashpoint
      # Application settings
      - LOG_LEVEL=${LOG_LEVEL:-info}
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:22500/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    networks:
      - backend-network
    # Security options
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 128M
    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Frontend Service (Nginx serving built files)
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        - VITE_API_URL=http://localhost:${API_PORT:-3100}
    image: flashpoint-frontend:latest
    container_name: flashpoint-frontend
    restart: unless-stopped
    environment:
      - TZ=${TZ:-UTC}
    ports:
      - "${WEB_PORT:-80}:8080"
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:8080/"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 10s
    networks:
      - frontend-network
      - backend-network
    # Security options
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 128M
        reservations:
          cpus: '0.1'
          memory: 64M
    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

# Networks
networks:
  # Frontend network (isolated)
  frontend-network:
    driver: bridge
  # Backend network (backend and game-service)
  backend-network:
    driver: bridge

# Volumes
volumes:
  # Persistent volume for user database
  backend-db:
    driver: local

# =============================================================================
# Flashpoint Web App - Production Docker Compose Configuration
# =============================================================================
#
# This is the PRODUCTION configuration with security hardening:
# - Multi-stage production builds
# - Non-root users in all containers
# - Resource limits (CPU/memory)
# - Security options (no-new-privileges, dropped capabilities)
# - Network segmentation (frontend/backend separation)
# - Logging configuration (10MB log files, 3 file rotation)
# - Health checks for all services
# - Persistent volume for user database
#
# Usage:
# ------
# 1. Configure environment variables:
#    cp .env.example .env
#    # Edit .env and set FLASHPOINT_HOST_PATH and JWT_SECRET (REQUIRED)
#    # Set DOMAIN to your production domain
#    # Optionally customize other settings (see .env.example for all options)
#
# 2. Build all services:
#    docker-compose -f docker-compose.prod.yml build
#
# 4. Start all services:
#    docker-compose -f docker-compose.prod.yml up -d
#
# 5. View logs:
#    docker-compose -f docker-compose.prod.yml logs -f
#
# 6. Stop all services:
#    docker-compose -f docker-compose.prod.yml down
#
# 7. Rebuild and restart:
#    docker-compose -f docker-compose.prod.yml up -d --build
#
# Access:
# -------
# - Frontend: http://localhost:${WEB_PORT} (default: http://localhost)
# - Backend API: http://localhost:${API_PORT} (default: http://localhost:3100)
# - Game Proxy: http://localhost:${PROXY_PORT} (default: http://localhost:22500)
# - GameZip: http://localhost:${GAMEZIP_PORT} (default: http://localhost:22501)
#
# Environment Variables:
# ----------------------
# See .env.example for all configurable environment variables and their descriptions.
#
# Required variables:
# - FLASHPOINT_HOST_PATH: Path to your Flashpoint installation
# - JWT_SECRET: Secure random string for JWT authentication (use openssl rand -base64 32)
#
# Production-specific recommendations:
# - Set DOMAIN to your actual domain (e.g., https://yourdomain.com)
# - Use strong JWT_SECRET (32+ characters)
# - Set NODE_ENV=production
# - Configure TZ to your timezone
#
# Security Notes:
# ---------------
# - All containers run as non-root users
# - Capabilities are dropped (ALL) for maximum security
# - no-new-privileges prevents privilege escalation
# - Networks are segmented (frontend can't directly access game-service)
# - Flashpoint data mounted read-only
# - User database in persistent volume
# - Resource limits prevent resource exhaustion
#
# =============================================================================