LeadFlowAI — Stack completo en contenedores

services:

  # ── Frontend (Next.js 14) ────────────────────────────
  frontend:
    build: { context: ./apps/frontend, target: dev }
    ports: ["3000:3000"]
    volumes:
      - ./apps/frontend:/app
      - /app/node_modules      # anon vol — protege deps del container
      - /app/.next             # protege build cache
    environment:
      - NEXT_PUBLIC_API_URL=http://api:4000
      - NODE_ENV=development
    depends_on:
      api: { condition: service_healthy }
    networks: [public-net]

  # ── API (Express) ────────────────────────────────────
  api:
    build: { context: ./apps/api, target: dev }
    ports: ["4000:4000"]
    volumes:
      - ./apps/api:/app
      - /app/node_modules
    env_file: [.env]
    environment:
      - DATABASE_URL=postgres://leadflow:secret@db:5432/leadflow_dev
      - REDIS_URL=redis://redis:6379/0
      - SMTP_HOST=mailpit
      - SMTP_PORT=1025
    depends_on:
      db:    { condition: service_healthy }
      redis: { condition: service_started }
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:4000/health || exit 1"]
      interval: 10s  timeout: 5s  retries: 3
    networks: [public-net, private-net]

  # ── PostgreSQL 16 ────────────────────────────────────
  db:
    image: postgres:16-alpine
    ports: ["127.0.0.1:5432:5432"]   # solo localhost, no red externa
    environment:
      POSTGRES_USER:     leadflow
      POSTGRES_PASSWORD: secret
      POSTGRES_DB:       leadflow_dev
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./scripts/init-db.sql:/docker-entrypoint-initdb.d/init.sql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U leadflow"]
      interval: 5s  timeout: 3s  retries: 5
    networks: [private-net]

  # ── Redis 7 ──────────────────────────────────────────
  redis:
    image: redis:7-alpine
    volumes: [redisdata:/data]
    networks: [private-net]

  # ── Worker (procesamiento leads async) ───────────────
  worker:
    build: { context: ./apps/worker, target: dev }
    volumes: [./apps/worker:/app, /app/node_modules]
    env_file: [.env]
    environment:
      - REDIS_URL=redis://redis:6379/0
      - DATABASE_URL=postgres://leadflow:secret@db:5432/leadflow_dev
    depends_on:
      db:    { condition: service_healthy }
      redis: { condition: service_started }
    networks: [private-net]

  # ── Mailpit (email dev UI) ────────────────────────────
  mailpit:
    image: axllent/mailpit
    ports: ["8025:8025", "1025:1025"]
    networks: [public-net, private-net]

volumes:
  pgdata:
  redisdata:

networks:
  public-net:   # frontend + api + mailpit
  private-net:  # api + db + redis + worker

# Auto-cargado en `docker compose up` — sólo en dev
services:
  api:
    environment:
      - LOG_LEVEL=debug
      - DEBUG=leadflow:*
    ports: ["9229:9229"]  # Node.js inspector
    command: node --inspect=0.0.0.0:9229 src/server.js

  worker:
    environment:
      - LOG_LEVEL=debug

# ── Stage: dependencies ──────────────────────────────
FROM node:22.12-alpine3.20 AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci

# ── Stage: dev (hot reload + inspector) ──────────────
FROM node:22.12-alpine3.20 AS dev
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
EXPOSE 4000 9229
CMD ["npm", "run", "dev"]

# ── Stage: build ─────────────────────────────────────
FROM node:22.12-alpine3.20 AS build
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build && npm prune --production

# ── Stage: production (mínimo, non-root) ─────────────
FROM node:22.12-alpine3.20 AS production
WORKDIR /app

# Usuario non-root
RUN addgroup -g 1001 -S appgroup && adduser -S appuser -u 1001
USER appuser

COPY --from=build --chown=appuser:appgroup /app/dist       ./dist
COPY --from=build --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=build --chown=appuser:appgroup /app/package.json ./

ENV NODE_ENV=production
EXPOSE 4000
HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget -qO- http://localhost:4000/health || exit 1
CMD ["node", "dist/server.js"]

services:
  api:
    build:
      context: ./apps/api
      target: production
    restart: always
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs: [/tmp, /app/.cache]
    cap_drop: [ALL]
    deploy:
      resources:
        limits: { cpus: "1.0", memory: 512M }
    env_file: [.env.production]  # gitignored, cargado en CI/CD

node_modules
.git
.env
.env.*            # NUNCA incluir en imagen
dist
coverage
*.log
.next
.cache
docker-compose*.yml
Dockerfile*
README.md
tests/
apps/*/node_modules
apps/*/.next