docker-compose.aws.yml

# Production Docker Compose for AWS Deployment with IAM Roles
# Use this for production deployments on AWS ECS/EC2 with IAM roles
version: '3.8'

services:
  # PostgreSQL Database (use RDS in production)
  postgres:
    image: postgres:15-alpine
    container_name: aetherguard-postgres
    environment:
      POSTGRES_DB: ${DB_NAME:-aetherguard}
      POSTGRES_USER: ${DB_USER:-postgres}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    networks:
      - aetherguard-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Redis Cache (use ElastiCache in production)
  redis:
    image: redis:7-alpine
    container_name: aetherguard-redis
    ports:
      - "6379:6379"
    networks:
      - aetherguard-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Backend API
  backend-api:
    build:
      context: ./backend-api
      dockerfile: Dockerfile
    container_name: aetherguard-api
    environment:
      DB_HOST: postgres
      DB_PORT: 5432
      DB_NAME: ${DB_NAME:-aetherguard}
      DB_USER: ${DB_USER:-postgres}
      DB_PASSWORD: ${DB_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000,http://localhost:3001,http://localhost:5173}
      DEFAULT_ADMIN_PASSWORD: ${DEFAULT_ADMIN_PASSWORD:-admin123}
      DEFAULT_OPENAI_MODEL: ${DEFAULT_OPENAI_MODEL:-gpt-3.5-turbo}
      DEFAULT_ANTHROPIC_MODEL: ${DEFAULT_ANTHROPIC_MODEL:-claude-3-sonnet-20240229}
      
      # SMTP Configuration
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT}
      SMTP_USER: ${SMTP_USER}
      SMTP_PASSWORD: ${SMTP_PASSWORD}
      SMTP_FROM: ${SMTP_FROM}
      SMTP_USE_TLS: ${SMTP_USE_TLS}
    ports:
      - "8081:8081"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - aetherguard-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8081/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ML Services
  ml-services:
    build:
      context: ./ml-services
      dockerfile: Dockerfile
    container_name: aetherguard-ml
    environment:
      HUGGINGFACE_TOKEN: ${HUGGINGFACE_TOKEN}
      LOG_LEVEL: ${LOG_LEVEL:-info}
    ports:
      - "8001:8001"
    networks:
      - aetherguard-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8001/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Rust Proxy Engine with Production AetherSign (AWS IAM Role)
  proxy-engine:
    build:
      context: ./proxy-engine
      dockerfile: Dockerfile
    container_name: aetherguard-proxy
    environment:
      # Core Configuration
      ML_SERVICE_URL: http://ml-services:8001
      BACKEND_API_URL: http://backend-api:8081
      RUST_LOG: ${RUST_LOG:-info}
      ATTRIBUTION_SECRET_KEY: ${ATTRIBUTION_SECRET_KEY}
      
      # AWS Configuration (uses IAM role, no credentials needed)
      AWS_REGION: ${AWS_REGION:-us-east-1}
      AWS_KMS_KEY_ID: ${AWS_KMS_KEY_ID}
      QLDB_LEDGER_NAME: ${QLDB_LEDGER_NAME:-aetherguard-provenance}
      
      # AetherSign Configuration
      AETHERSIGN_ALGORITHM: ${AETHERSIGN_ALGORITHM:-RsaPkcs1v15Sha256}
      AETHERSIGN_CACHE_SIZE: ${AETHERSIGN_CACHE_SIZE:-10000}
      AETHERSIGN_CACHE_TTL: ${AETHERSIGN_CACHE_TTL:-3600}
      AETHERSIGN_KEY_ROTATION_DAYS: ${AETHERSIGN_KEY_ROTATION_DAYS:-90}
      NITRO_ENCLAVE_ENABLED: ${NITRO_ENCLAVE_ENABLED:-false}
      
      # LLM Provider Configuration
      OPENAI_API_KEY: ${OPENAI_API_KEY}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
      LLM_PROVIDER_URL: ${LLM_PROVIDER_URL}
      
      # Performance Configuration
      ENABLE_METRICS: ${ENABLE_METRICS:-true}
      METRICS_PORT: ${METRICS_PORT:-9090}
    ports:
      - "8080:8080"
      - "9090:9090"  # Metrics port
    depends_on:
      ml-services:
        condition: service_healthy
      backend-api:
        condition: service_healthy
    networks:
      - aetherguard-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    # AWS IAM role will be attached at the ECS task level

  # Web Portal
  web-portal:
    build:
      context: ./web-portal
      dockerfile: Dockerfile
      args:
        VITE_API_URL: ${VITE_API_URL}
        VITE_ML_API_URL: ${VITE_ML_API_URL}
        VITE_PROXY_URL: ${VITE_PROXY_URL}
    container_name: aetherguard-web
    ports:
      - "3000:3000"
    networks:
      - aetherguard-network
    restart: unless-stopped

  # Admin Portal
  admin-portal:
    build:
      context: ./admin-portal
      dockerfile: Dockerfile
      args:
        VITE_API_URL: ${VITE_API_URL}
    container_name: aetherguard-admin
    ports:
      - "3001:3001"
    networks:
      - aetherguard-network
    restart: unless-stopped

  # Nginx Reverse Proxy with SSL
  nginx:
    image: nginx:alpine
    container_name: aetherguard-nginx
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - ./nginx/logs:/var/log/nginx
    ports:
      - "80:80"
      - "443:443"
    depends_on:
      - proxy-engine
      - backend-api
      - web-portal
      - admin-portal
    networks:
      - aetherguard-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Prometheus for Metrics (Optional)
  prometheus:
    image: prom/prometheus:latest
    container_name: aetherguard-prometheus
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    ports:
      - "9091:9090"
    networks:
      - aetherguard-network
    restart: unless-stopped
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'

  # Grafana for Dashboards (Optional)
  grafana:
    image: grafana/grafana:latest
    container_name: aetherguard-grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources:ro
    ports:
      - "3002:3000"
    networks:
      - aetherguard-network
    restart: unless-stopped

networks:
  aetherguard-network:
    driver: bridge

volumes:
  postgres_data:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local