docker-compose.prod.yml

version: "3.8"

# Production docker-compose for Oracle Cloud / any Linux VPS
# Usage: docker compose -f docker-compose.prod.yml up -d
#
# Required env vars (set in /etc/environment or .env on the server):
#   POSTGRES_PASSWORD   — strong password for postgres
#   SECRET_KEY          — any random string for future JWT use
#
# Ports exposed publicly:
#   80  → dashboard (via nginx reverse proxy)
#   443 → dashboard HTTPS (if SSL configured)
# Internal only: postgres, redis, kafka, etc.

services:

  zookeeper:
    image: confluentinc/cp-zookeeper:7.5.0
    container_name: zookeeper
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 2181 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: redis
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  postgres:
    image: postgres:16-alpine
    container_name: postgres
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-fraudshield_prod_2024}
      POSTGRES_DB: frauddb
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./infra/postgres/init.sql:/docker-entrypoint-initdb.d/01-schema.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    restart: unless-stopped

  kafka:
    image: confluentinc/cp-kafka:7.5.0
    container_name: kafka
    depends_on:
      zookeeper:
        condition: service_healthy
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT
      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "false"
      KAFKA_LOG_RETENTION_HOURS: 24
      KAFKA_HEAP_OPTS: "-Xmx512m -Xms256m"
    healthcheck:
      test: ["CMD-SHELL", "kafka-topics --bootstrap-server localhost:9092 --list"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 40s
    restart: unless-stopped

  kafka-init:
    image: confluentinc/cp-kafka:7.5.0
    container_name: kafka-init
    depends_on:
      kafka:
        condition: service_healthy
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists \
          --topic transactions --partitions 6 --replication-factor 1 && \
        kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists \
          --topic enriched-transactions --partitions 6 --replication-factor 1 && \
        kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists \
          --topic decisions --partitions 6 --replication-factor 1
    restart: "no"

  transaction-simulator:
    build:
      context: ./simulator
      dockerfile: Dockerfile
    container_name: transaction-simulator
    depends_on:
      kafka-init:
        condition: service_completed_successfully
    environment:
      KAFKA_BOOTSTRAP_SERVERS: kafka:9092
      KAFKA_TOPIC: transactions
      TXN_RATE: "5"
      FRAUD_RATE: "0.08"
      NUM_USERS: "500"
      NUM_MERCHANTS: "100"
      LOG_LEVEL: WARNING
    restart: unless-stopped

  feature-enrichment:
    build:
      context: ./feature-enrichment
      dockerfile: Dockerfile
    container_name: feature-enrichment
    depends_on:
      kafka-init:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    environment:
      KAFKA_BOOTSTRAP_SERVERS: kafka:9092
      KAFKA_INPUT_TOPIC: transactions
      KAFKA_OUTPUT_TOPIC: enriched-transactions
      KAFKA_GROUP_ID: feature-enrichment-group
      KAFKA_RETRY_ATTEMPTS: "12"
      KAFKA_RETRY_INTERVAL_SECONDS: "5"
      REDIS_URL: redis://redis:6379
      LOG_LEVEL: WARNING
    restart: unless-stopped

  ml-scorer:
    build:
      context: ./ml-scorer
      dockerfile: Dockerfile
    container_name: ml-scorer
    environment:
      MODEL_DIR: /app/models
      HOST: "0.0.0.0"
      PORT: "8000"
      WORKERS: "1"
      RISK_LOW_THRESHOLD: "0.3"
      RISK_HIGH_THRESHOLD: "0.7"
      LOG_LEVEL: WARNING
    volumes:
      - ./training/models:/app/models:ro
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  decision-engine:
    build:
      context: ./decision-engine
      dockerfile: Dockerfile
    container_name: decision-engine
    depends_on:
      kafka-init:
        condition: service_completed_successfully
      ml-scorer:
        condition: service_healthy
      postgres:
        condition: service_healthy
    environment:
      KAFKA_BOOTSTRAP_SERVERS: kafka:9092
      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD:-fraudshield_prod_2024}@postgres:5432/frauddb
      SCORER_URL: http://ml-scorer:8000
      LOG_LEVEL: WARNING
    restart: unless-stopped

  shap-explainer:
    build:
      context: ./shap-explainer
      dockerfile: Dockerfile
    container_name: shap-explainer
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD:-fraudshield_prod_2024}@postgres:5432/frauddb
      MODEL_DIR: /app/models
      SHAP_POLL_INTERVAL_SECONDS: "10"
      SHAP_BATCH_SIZE: "20"
      LOG_LEVEL: WARNING
    volumes:
      - ./training/models:/app/models:ro
    restart: unless-stopped

  api-gateway:
    build:
      context: ./api-gateway
      dockerfile: Dockerfile
    container_name: api-gateway
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD:-fraudshield_prod_2024}@postgres:5432/frauddb
      REDIS_URL: redis://redis:6379
      LOG_LEVEL: WARNING
    restart: unless-stopped

  dashboard:
    build:
      context: ./dashboard
      dockerfile: Dockerfile
    container_name: dashboard
    depends_on:
      - api-gateway
    environment:
      API_GATEWAY_URL: http://api-gateway:8080
    restart: unless-stopped

  # Nginx reverse proxy — exposes port 80 publicly, proxies to dashboard + api-gateway
  nginx:
    image: nginx:alpine
    container_name: nginx
    ports:
      - "80:80"
    volumes:
      - ./infra/nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      - dashboard
      - api-gateway
    restart: unless-stopped

volumes:
  postgres_data:
    driver: local