Multi-Container Applications

# Dockerfile (used by both api and worker services)
FROM node:18-alpine

WORKDIR /app

COPY package*.json ./
RUN npm install --omit=dev

COPY . .

RUN addgroup -S appgroup && adduser -S appuser -G appgroup
RUN chown -R appuser:appgroup /app
USER appuser

HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

EXPOSE 3000
CMD ["node", "server.js"]

services:

  postgres:
    image: postgres:15-alpine
    environment:
      POSTGRES_USER: orders_user
      POSTGRES_PASSWORD: ${DB_PASSWORD}   # from .env file — never hardcode
      POSTGRES_DB: orders
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      - backend-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U orders_user -d orders"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  redis:
    image: redis:7-alpine
    command: redis-server --requirepass ${REDIS_PASSWORD}
    # command overrides the default CMD — adds password authentication
    volumes:
      - redis-data:/data
    networks:
      - backend-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  order-api:
    build:
      context: .
      dockerfile: Dockerfile
    environment:
      NODE_ENV: production
      PORT: 3000
      DATABASE_URL: postgresql://orders_user:${DB_PASSWORD}@postgres:5432/orders
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      JWT_SECRET: ${JWT_SECRET}
    networks:
      - backend-net
      - frontend-net
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  worker:
    build:
      context: .
      dockerfile: Dockerfile
    command: ["node", "worker.js"]     # override CMD — run worker process instead
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://orders_user:${DB_PASSWORD}@postgres:5432/orders
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
    networks:
      - backend-net
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/certs:/etc/nginx/certs:ro
    networks:
      - frontend-net
    restart: unless-stopped
    depends_on:
      - order-api

networks:
  frontend-net:
    driver: bridge
  backend-net:
    driver: bridge
    internal: true        # database and cache have no outbound internet access

volumes:
  postgres-data:
  redis-data:

# .env — never commit to git, always in .dockerignore
DB_PASSWORD=str0ngP@ssw0rd_2024
REDIS_PASSWORD=r3disS3cr3t!
JWT_SECRET=jwt-secret-minimum-32-chars-long-abc123

# Compose automatically loads .env from the project directory
# Reference variables in docker-compose.yml with ${VARIABLE_NAME}

docker compose up -d --build
# --build  → rebuild images to pick up any Dockerfile changes
# -d       → detached mode

# Watch startup progress
docker compose ps

# Follow all logs in real time
docker compose logs -f

# Follow a specific service
docker compose logs -f order-api

docker compose up -d --scale worker=3
# --scale worker=3 → run 3 instances of the worker service
# Compose starts worker-2 and worker-3 alongside the existing worker-1
# All three connect to the same postgres and redis on backend-net

docker compose ps