services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    image: vault-dash:prod
    ports:
      - "8000:8000"
    environment:
      APP_ENV: production
      APP_HOST: 0.0.0.0
      APP_PORT: 8000
      LOG_LEVEL: INFO
      REDIS_URL: redis://redis:6379/0
      CACHE_TTL: 300
      DEFAULT_SYMBOL: GLD
      UVICORN_WORKERS: 2
      RUN_MIGRATIONS: 0
    depends_on:
      redis:
        condition: service_healthy
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    mem_limit: 512m
    cpus: 1.00
    pids_limit: 256
    healthcheck:
      test: ["CMD", "python", "-c", "import sys, urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=3); sys.exit(0)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

  redis:
    image: redis:7-alpine
    command: ["redis-server", "--save", "", "--appendonly", "no"]
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    mem_limit: 256m
    cpus: 0.50
    pids_limit: 128
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5

volumes:
  redis-data: