version: '3.8'

services:
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    container_name: brainstormer-frontend
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - /etc/letsencrypt:/etc/nginx/ssl:ro
      - ./docker/.htpasswd:/etc/nginx/.htpasswd:ro
      - ./docker/nginx-secure.conf:/etc/nginx/conf.d/default.conf:ro
    networks:
      - frontend-network
    depends_on:
      - backend
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run
      - /tmp

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile.secure
    container_name: brainstormer-backend
    restart: unless-stopped
    expose:
      - '8000'
    env_file:
      - .env
    environment:
      - REDIS_HOST=redis
      - REDIS_PORT=6379
    depends_on:
      - redis
    networks:
      - frontend-network
      - backend-network
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

  redis:
    image: redis:7-alpine
    container_name: brainstormer-redis
    restart: unless-stopped
    volumes:
      - redis-data:/data
    networks:
      - backend-network
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    user: "999:999"
    command: redis-server --save 60 1 --loglevel warning

networks:
  frontend-network:
    driver: bridge
    internal: false
  backend-network:
    driver: bridge
    internal: true

volumes:
  redis-data:
    driver: local