docker-compose.bitrix.yml

# ============================================================================
# DOCKER COMPOSE ДЛЯ 1С-БИТРИКС
# Единый Bitrix контейнер + оптимизированная структура
# Поддержка окружений: local, dev, test, prod
# Кросс-платформенность: Linux, macOS, Windows
# ============================================================================

name: ${COMPOSE_PROJECT_NAME:-bitrix}

# ============================================================================
# X-TEMPLATES: ПЕРЕИСПОЛЬЗУЕМЫЕ КОНФИГУРАЦИИ
# ============================================================================

# Volumes шаблоны
x-volumes:
  # Основной код приложения (мультисайт)
  # Структура: www/${DOMAIN}/www/ — каждый сайт в своей папке
  app-code: &app-code
    type: bind
    source: ./www
    target: /home/${UGN}/app

  # Конфигурационные файлы
  # NOTE: msmtp config is generated dynamically in entrypoint based on ENVIRONMENT
  # Per-site SMTP configs are in ./config/sites/{domain}/msmtp.conf
  # NOTE: dcron in Alpine requires root crontab for reliable execution
  # Base crontab is read-only; entrypoint merges it with per-site crontabs
  crontab: &crontab ./config/cron/crontab:/etc/crontabs/root.base:ro
  # Per-site configurations (DB credentials, SMTP, etc.)
  sites-config: &sites-config ./config/sites:/etc/bitrix-sites:ro

  # Redis unix socket (shared between redis and php containers)
  redis-socket: &redis-socket redis-socket:/var/run/redis

  # Логи (доступны и для хоста и для Promtail)
  logs-nginx: &logs-nginx ./volume/logs/nginx:/var/log/nginx
  logs-letsencrypt: &logs-letsencrypt ./volume/logs/letsencrypt:/var/log/letsencrypt
  logs-php: &logs-php ./volume/logs/php:/var/log/php
  logs-php-fpm: &logs-php-fpm ./volume/logs/php-fpm:/var/log/php-fpm
  logs-cron: &logs-cron ./volume/logs/cron:/var/log/cron
  logs-supervisor: &logs-supervisor ./volume/logs/supervisor:/var/log/supervisor
  logs-bitrix: &logs-bitrix ./volume/logs/bitrix:/var/log/bitrix

  # Бэкапы и SSL
  backup-data: &backup-data ./backups:/backups
  ssl-certs: &ssl-certs ./ssl:/etc/nginx/ssl
  letsencrypt-certs: &letsencrypt-certs /etc/letsencrypt:/etc/letsencrypt

  # Docker логи для Promtail
  docker-logs: &docker-logs /var/lib/docker/containers:/var/lib/docker/containers:ro

# Зависимости для PHP контейнеров
x-depends-on-all: &depends-on-all
  mysql:
    condition: service_healthy
  redis:
    condition: service_healthy
  memcached:
    condition: service_healthy

# Общие переменные окружения для Bitrix
x-bitrix-env: &bitrix-env
  TZ: ${TZ}
  BITRIX_VA_VER: ${BITRIX_VM_VER}
  APP_ENV: ${ENVIRONMENT}
  APP_DEBUG: ${DEBUG}
  PHP_IDE_CONFIG: serverName=${DOMAIN}
  XDEBUG_SESSION: docker-server
  # Database
  DB_HOST: ${DB_HOST:-mysql}
  DB_PORT: ${DB_PORT:-3306}
  DB_NAME: ${DB_NAME}
  DB_USERNAME: ${DB_USERNAME}
  DB_PASSWORD: ${DB_PASSWORD}
  # Cache
  REDIS_HOST: ${REDIS_HOST:-redis}
  REDIS_PORT: ${REDIS_PORT:-6379}
  REDIS_UNIX_SOCKET: /var/run/redis/redis.sock
  MEMCACHED_HOST: ${MEMCACHED_HOST:-memcached}
  MEMCACHED_PORT: 11211
  # Queue (if RabbitMQ enabled)
  RABBITMQ_HOST: ${RABBITMQ_HOST:-amqp}
  RABBITMQ_PORT: ${RABBITMQ_PORT:-5672}
  RABBITMQ_USER: ${RABBITMQ_DEFAULT_USER}
  RABBITMQ_PASSWORD: ${RABBITMQ_DEFAULT_PASS}
  # Push Server
  PUSH_SECURITY_KEY: ${PUSH_SECURITY_KEY:-}

# Logging configuration
x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "3"

# ==========================================================================
# SECURITY HARDENING (Bitrix official)
# Based on https://github.com/bitrix-tools/env-docker
# ==========================================================================

# Base security options for all containers
# NOTE: no-new-privileges removed globally — most containers need chmod/chown/gosu
# in entrypoints which requires privilege operations. Security is maintained via
# cap_drop: ALL + minimal cap_add per service.
x-security-base: &security-base
  init: true

# tmpfs mounts for security (noexec, nodev, nosuid)
x-tmpfs-secure: &tmpfs-secure
  tmpfs:
    - /tmp:noexec,nodev,nosuid
    - /var/tmp:noexec,nodev,nosuid

# Minimal capabilities (drop all, add only needed)
x-cap-minimal: &cap-minimal
  cap_drop:
    - ALL

# Capabilities for services that need file operations
x-cap-files: &cap-files
  cap_drop:
    - ALL
  cap_add:
    - CHOWN
    - SETUID
    - SETGID
    - FOWNER
    - DAC_OVERRIDE

# Capabilities for nginx (needs NET_BIND_SERVICE for ports < 1024)
x-cap-nginx: &cap-nginx
  cap_drop:
    - ALL
  cap_add:
    - CHOWN
    - SETUID
    - SETGID
    - NET_BIND_SERVICE

# ============================================================================
# SERVICES
# ============================================================================

services:
  # ==========================================================================
  # BITRIX - ЕДИНЫЙ КОНТЕЙНЕР С PHP-FPM + CLI + CRON + SUPERVISOR
  # ==========================================================================
  bitrix:
    container_name: ${DOMAIN}_bitrix
    hostname: ${DOMAIN}
    build:
      context: .
      dockerfile: docker/php/bitrix/Dockerfile
      args:
        PHP_VERSION: ${PHP_VERSION:-8.3}
        TZ: ${TZ}
        ENVIRONMENT: ${ENVIRONMENT}
        DOMAIN: ${DOMAIN}
        EMAIL: ${EMAIL}
        SSL: ${SSL:-0}
        UID: ${UID}
        GID: ${GID}
        UGN: ${UGN}
        DEBUG: ${DEBUG:-0}
      # Используем buildkit для ускорения сборки
      cache_from:
        - ${DOMAIN}_bitrix:latest

    environment:
      <<: *bitrix-env
      # PHP-FPM настройки
      PHP_FPM_PM: ${PHP_FPM_PM:-dynamic}
      PHP_FPM_MAX_CHILDREN: ${PHP_FPM_MAX_CHILDREN:-50}
      PHP_FPM_START_SERVERS: ${PHP_FPM_START_SERVERS:-5}
      PHP_FPM_MIN_SPARE_SERVERS: ${PHP_FPM_MIN_SPARE_SERVERS:-5}
      PHP_FPM_MAX_SPARE_SERVERS: ${PHP_FPM_MAX_SPARE_SERVERS:-35}
      # PHP настройки
      PHP_MEMORY_LIMIT: ${PHP_MEMORY_LIMIT:-256M}
      PHP_UPLOAD_MAX_FILESIZE: ${PHP_UPLOAD_MAX_FILESIZE:-64M}
      PHP_POST_MAX_SIZE: ${PHP_POST_MAX_SIZE:-64M}
      PHP_MAX_EXECUTION_TIME: ${PHP_MAX_EXECUTION_TIME:-300}
      PHP_MAX_INPUT_TIME: ${PHP_MAX_INPUT_TIME:-300}
      # OPcache (Bitrix official recommendations)
      PHP_OPCACHE_ENABLE: ${PHP_OPCACHE_ENABLE:-1}
      PHP_OPCACHE_MEMORY: ${PHP_OPCACHE_MEMORY:-256}
      PHP_OPCACHE_INTERNED_STRINGS: ${PHP_OPCACHE_INTERNED_STRINGS:-64}
      PHP_OPCACHE_MAX_FILES: ${PHP_OPCACHE_MAX_FILES:-100000}
      PHP_OPCACHE_REVALIDATE_FREQ: ${PHP_OPCACHE_REVALIDATE_FREQ:-2}

    volumes:
      # Основной код приложения (мультисайт: www/${DOMAIN}/www/)
      - *app-code
      # Конфигурации
      - *crontab
      - *sites-config
      # Логи
      - *logs-php
      - *logs-php-fpm
      - *logs-cron
      - *logs-supervisor
      - *logs-bitrix
      # MSMTP логи (per-site)
      - ./volume/logs/msmtp:/var/log/msmtp
      # Composer cache (для ускорения установки зависимостей)
      - composer-cache:/home/${UGN}/.composer
      # Redis unix socket (shared volume for ~30% performance boost)
      - *redis-socket

    depends_on:
      <<: *depends-on-all
      nginx:
        condition: service_healthy
      mailhog:
        condition: service_healthy
        required: false

    # Expose порт PHP-FPM для nginx
    expose:
      - "9000"

    # Для dev окружения можно открыть порт для прямого доступа
    # ports:
    #   - "9000:9000"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    # Security hardening (Bitrix official)
    init: true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - FOWNER
      - DAC_OVERRIDE
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    # Health check
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      start_period: 40s
      retries: 3

    # Labels для Prometheus и мониторинга
    labels:
      - "com.docker.compose.project=${COMPOSE_PROJECT_NAME:-bitrix}"
      - "com.docker.compose.service=bitrix"
      - "monitoring=true"
      - "prometheus.scrape=true"
      - "prometheus.port=9000"

  # ==========================================================================
  # SPLIT ARCHITECTURE - РАЗДЕЛЬНЫЕ PHP-КОНТЕЙНЕРЫ (АЛЬТЕРНАТИВА)
  # ==========================================================================
  # Запуск: docker compose --profile split up -d
  # В этом режиме вместо единого "bitrix" контейнера используются 4 отдельных:
  #   php-fpm    — обработка HTTP-запросов через FastCGI
  #   php-cli    — CLI-операции, composer, миграции, интерактивный доступ
  #   cron       — периодические задачи (agents, crontab)
  #   supervisor — фоновые воркеры (очереди, long-running процессы)
  #
  # ВАЖНО: При использовании split-профиля НЕ запускайте "bitrix" сервис!
  # Nginx должен быть настроен на upstream "php-fpm" вместо "bitrix"
  # (см. переменную PHP_FPM_HOST в секции nginx)
  # ==========================================================================

  # --------------------------------------------------------------------------
  # PHP-FPM — FastCGI process manager для обработки HTTP-запросов
  # --------------------------------------------------------------------------
  php-fpm:
    profiles: ["split"]
    container_name: ${DOMAIN}_php-fpm
    hostname: ${DOMAIN}
    build:
      context: .
      dockerfile: docker/php/php-fpm/Dockerfile
      args:
        PHP_VERSION: ${PHP_VERSION:-8.3}
        TZ: ${TZ}
        ENVIRONMENT: ${ENVIRONMENT}
        DOMAIN: ${DOMAIN}
        EMAIL: ${EMAIL}
        SSL: ${SSL:-0}
        UID: ${UID}
        GID: ${GID}
        UGN: ${UGN}
        DEBUG: ${DEBUG:-0}

    environment:
      <<: *bitrix-env
      # PHP-FPM settings
      PHP_FPM_PM: ${PHP_FPM_PM:-dynamic}
      PHP_FPM_MAX_CHILDREN: ${PHP_FPM_MAX_CHILDREN:-50}
      PHP_FPM_START_SERVERS: ${PHP_FPM_START_SERVERS:-5}
      PHP_FPM_MIN_SPARE_SERVERS: ${PHP_FPM_MIN_SPARE_SERVERS:-5}
      PHP_FPM_MAX_SPARE_SERVERS: ${PHP_FPM_MAX_SPARE_SERVERS:-35}
      # PHP settings
      PHP_MEMORY_LIMIT: ${PHP_MEMORY_LIMIT:-256M}
      PHP_UPLOAD_MAX_FILESIZE: ${PHP_UPLOAD_MAX_FILESIZE:-64M}
      PHP_POST_MAX_SIZE: ${PHP_POST_MAX_SIZE:-64M}
      PHP_MAX_EXECUTION_TIME: ${PHP_MAX_EXECUTION_TIME:-300}
      PHP_MAX_INPUT_TIME: ${PHP_MAX_INPUT_TIME:-300}
      # OPcache (Bitrix official recommendations)
      PHP_OPCACHE_ENABLE: ${PHP_OPCACHE_ENABLE:-1}
      PHP_OPCACHE_MEMORY: ${PHP_OPCACHE_MEMORY:-256}
      PHP_OPCACHE_INTERNED_STRINGS: ${PHP_OPCACHE_INTERNED_STRINGS:-64}
      PHP_OPCACHE_MAX_FILES: ${PHP_OPCACHE_MAX_FILES:-100000}
      PHP_OPCACHE_REVALIDATE_FREQ: ${PHP_OPCACHE_REVALIDATE_FREQ:-2}

    volumes:
      - *app-code
      - *sites-config
      - *logs-php
      - *logs-php-fpm
      - *logs-bitrix
      # MSMTP logs (per-site)
      - ./volume/logs/msmtp:/var/log/msmtp
      # Redis unix socket (shared volume for ~30% performance boost)
      - *redis-socket

    depends_on:
      <<: *depends-on-all
      nginx:
        condition: service_healthy

    expose:
      - "9000"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    # Security hardening (Bitrix official)
    init: true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - FOWNER
      - DAC_OVERRIDE
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    healthcheck:
      test: ["CMD-SHELL", "REDIRECT_STATUS=true SCRIPT_NAME=/ping SCRIPT_FILENAME=/ping REQUEST_METHOD=GET cgi-fcgi -bind -connect 127.0.0.1:9000 || exit 1"]
      interval: 30s
      timeout: 10s
      start_period: 40s
      retries: 3

    labels:
      - "com.docker.compose.service=php-fpm"
      - "monitoring=true"
      - "prometheus.scrape=true"
      - "prometheus.port=9000"

  # --------------------------------------------------------------------------
  # PHP-CLI — CLI operations, composer, migrations, interactive access
  # --------------------------------------------------------------------------
  php-cli:
    profiles: ["split"]
    container_name: ${DOMAIN}_php-cli
    hostname: ${DOMAIN}
    build:
      context: .
      dockerfile: docker/php/php-cli/Dockerfile
      args:
        PHP_VERSION: ${PHP_VERSION:-8.3}
        TZ: ${TZ}
        ENVIRONMENT: ${ENVIRONMENT}
        DOMAIN: ${DOMAIN}
        EMAIL: ${EMAIL}
        SSL: ${SSL:-0}
        UID: ${UID}
        GID: ${GID}
        UGN: ${UGN}
        DEBUG: ${DEBUG:-0}

    environment:
      <<: *bitrix-env
      # PHP settings for CLI (higher limits for migrations/imports)
      PHP_MEMORY_LIMIT: ${PHP_CLI_MEMORY_LIMIT:-512M}
      PHP_MAX_EXECUTION_TIME: ${PHP_CLI_MAX_EXECUTION_TIME:-0}

    volumes:
      - *app-code
      - *sites-config
      - *logs-php
      - *logs-bitrix
      # MSMTP logs (per-site)
      - ./volume/logs/msmtp:/var/log/msmtp
      # Composer cache for faster dependency installation
      - composer-cache:/home/${UGN}/.composer
      # Redis unix socket
      - *redis-socket

    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy
      memcached:
        condition: service_healthy

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    # Keep running for exec access (docker compose exec php-cli bash)
    tty: true
    stdin_open: true

    # Security hardening (Bitrix official)
    init: true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - FOWNER
      - DAC_OVERRIDE
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    healthcheck:
      test: ["CMD-SHELL", "php -r 'echo \"ok\";' || exit 1"]
      interval: 60s
      timeout: 10s
      start_period: 10s
      retries: 3

    labels:
      - "com.docker.compose.service=php-cli"

  # --------------------------------------------------------------------------
  # CRON — Periodic tasks (Bitrix agents, scheduled jobs)
  # --------------------------------------------------------------------------
  cron:
    profiles: ["split"]
    container_name: ${DOMAIN}_cron
    hostname: ${DOMAIN}
    build:
      context: .
      dockerfile: docker/php/cron/Dockerfile
      args:
        PHP_VERSION: ${PHP_VERSION:-8.3}
        TZ: ${TZ}
        ENVIRONMENT: ${ENVIRONMENT}
        DOMAIN: ${DOMAIN}
        EMAIL: ${EMAIL}
        SSL: ${SSL:-0}
        UID: ${UID}
        GID: ${GID}
        UGN: ${UGN}
        DEBUG: ${DEBUG:-0}

    environment:
      <<: *bitrix-env
      PHP_MEMORY_LIMIT: ${PHP_MEMORY_LIMIT:-256M}
      PHP_MAX_EXECUTION_TIME: ${PHP_MAX_EXECUTION_TIME:-300}

    volumes:
      - *app-code
      - *crontab
      - *sites-config
      - *logs-cron
      - *logs-php
      - *logs-bitrix
      # MSMTP logs (per-site)
      - ./volume/logs/msmtp:/var/log/msmtp
      # Redis unix socket
      - *redis-socket

    depends_on:
      php-fpm:
        condition: service_healthy
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    # Security hardening (Bitrix official)
    init: true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - FOWNER
      - DAC_OVERRIDE
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    healthcheck:
      test: ["CMD-SHELL", "pgrep crond || pgrep cron || exit 1"]
      interval: 30s
      timeout: 10s
      start_period: 10s
      retries: 3

    labels:
      - "com.docker.compose.service=cron"

  # --------------------------------------------------------------------------
  # SUPERVISOR — Background workers (queues, long-running processes)
  # --------------------------------------------------------------------------
  supervisor:
    profiles: ["split"]
    container_name: ${DOMAIN}_supervisor
    hostname: ${DOMAIN}
    build:
      context: .
      dockerfile: docker/php/supervisor/Dockerfile
      args:
        PHP_VERSION: ${PHP_VERSION:-8.3}
        TZ: ${TZ}
        ENVIRONMENT: ${ENVIRONMENT}
        DOMAIN: ${DOMAIN}
        EMAIL: ${EMAIL}
        SSL: ${SSL:-0}
        UID: ${UID}
        GID: ${GID}
        UGN: ${UGN}
        DEBUG: ${DEBUG:-0}

    environment:
      <<: *bitrix-env
      PHP_MEMORY_LIMIT: ${PHP_MEMORY_LIMIT:-256M}
      PHP_MAX_EXECUTION_TIME: ${PHP_MAX_EXECUTION_TIME:-300}

    volumes:
      - *app-code
      - ./config/supervisor/conf:/etc/supervisor/conf.d
      - *sites-config
      - *logs-supervisor
      - *logs-php
      - *logs-bitrix
      # MSMTP logs (per-site)
      - ./volume/logs/msmtp:/var/log/msmtp
      # Redis unix socket
      - *redis-socket

    depends_on:
      php-fpm:
        condition: service_healthy
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    # Security hardening (Bitrix official)
    init: true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - FOWNER
      - DAC_OVERRIDE
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    healthcheck:
      test: ["CMD-SHELL", "supervisorctl status || exit 1"]
      interval: 30s
      timeout: 10s
      start_period: 20s
      retries: 3

    labels:
      - "com.docker.compose.service=supervisor"

  # ==========================================================================
  # NGINX - ВЕБ-СЕРВЕР
  # ==========================================================================
  nginx:
    container_name: ${DOMAIN}_nginx
    hostname: nginx
    build:
      context: .
      dockerfile: docker/nginx/Dockerfile
      args:
        TZ: ${TZ}
        ENVIRONMENT: ${ENVIRONMENT}
        SSL: ${SSL:-0}
        DOMAIN: ${DOMAIN}
        EMAIL: ${EMAIL}
        MAIL_CONFIG: ${MAIL_CONFIG:-0}
        RABBIT_CONFIG: ${RABBIT_CONFIG:-0}
        GRAFANA_CONFIG: ${GRAFANA_CONFIG:-0}
        PROMETHEUS_CONFIG: ${PROMETHEUS_CONFIG:-0}
        MAIL_SUBDOMAIN: ${MAIL_SUBDOMAIN:-mail}
        RABBIT_SUBDOMAIN: ${RABBIT_SUBDOMAIN:-rabbit}
        GRAFANA_SUBDOMAIN: ${GRAFANA_SUBDOMAIN:-grafana}
        PROMETHEUS_SUBDOMAIN: ${PROMETHEUS_SUBDOMAIN:-prometheus}
        DOLLAR: $$
        UID: ${UID}
        GID: ${GID}
        UGN: ${UGN}

    # FIXME: Nginx master process needs to run as root to bind ports and write PID file
    # user: "${UID}:${GID}"

    environment:
      TZ: ${TZ}
      # FastCGI backend
      # DEFAULT (unified mode): PHP_FPM_HOST=bitrix (single "bitrix" container)
      # SPLIT MODE: Set PHP_FPM_HOST=php-fpm in .env when using --profile split
      # This controls the upstream for fastcgi_pass in nginx config
      PHP_FPM_HOST: ${PHP_FPM_HOST:-bitrix}
      PHP_FPM_PORT: 9000
      # Monitoring basic auth (for grafana, prometheus, rabbit subdomains)
      MONITORING_USER: ${MONITORING_USER:-admin}
      MONITORING_PASSWORD: ${MONITORING_PASSWORD:-}

    volumes:
      - *app-code
      - *logs-nginx
      - *logs-letsencrypt
      - *ssl-certs
      - *letsencrypt-certs
      # Мультисайтовые конфиги и SSL
      - ./config/nginx/sites:/etc/nginx/sites-enabled
      - ./config/nginx/ssl:/etc/nginx/ssl:ro
      # Per-site custom nginx rules (redirects, rewrites, etc.)
      - *sites-config

    # depends_on убран чтобы избежать циклической зависимости с bitrix
    # nginx может запускаться независимо и будет отдавать 502 пока PHP-FPM недоступен

    ports:
      - "${HTTP_PORT:-80}:80"
      - "${HTTPS_PORT:-443}:443"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:80/health || exit 1"]
      interval: 10s
      timeout: 5s
      start_period: 10s
      retries: 3

    # Security hardening
    # NOTE: no-new-privileges DISABLED for Nginx — master process runs as root
    # and uses setuid() to switch workers to bitrix user via "user bitrix;" directive.
    init: true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - NET_BIND_SERVICE
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    labels:
      - "com.docker.compose.service=nginx"
      - "monitoring=true"

  # ==========================================================================
  # MYSQL - БАЗА ДАННЫХ
  # ==========================================================================
  # Выбор движка базы данных (MYSQL_IMAGE в .env):
  # ─────────────────────────────────────────────────────────────────────────
  # RAM < 4GB:   mariadb:10.11        (default, низкое потребление памяти)
  # RAM 4-16GB:  quay.io/bitrix24/percona-server:8.0.44-v1-rhel (Bitrix official)
  # RAM > 16GB:  quay.io/bitrix24/percona-server:8.4.7-v1-rhel  (новейшая версия)
  # Alternative: mysql:8.0 или mysql:8.4 (официальный MySQL)
  # ─────────────────────────────────────────────────────────────────────────
  mysql:
    container_name: ${DOMAIN}_mysql
    # Bitrix official: quay.io/bitrix24/percona-server:8.0.44-v1-rhel
    # Default: mariadb:10.11 for low RAM environments
    image: ${MYSQL_IMAGE:-mariadb:10.11}

    command:
      # NOTE: --default-authentication-plugin is MySQL-only, not supported by MariaDB
      # For MySQL 8.0+, authentication is configured via mysql_native_password plugin
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
      - --sql-mode=NO_ENGINE_SUBSTITUTION
      # FIXME: O_DIRECT causes issues on macOS/ARM
      # - --innodb-flush-method=O_DIRECT
      - --innodb-buffer-pool-size=${MYSQL_INNODB_BUFFER_POOL_SIZE:-512M}
      - --max-connections=${MYSQL_MAX_CONNECTIONS:-200}
      # Disable error log file (use stderr for Docker logs)
      - --log-error=

    environment:
      TZ: ${TZ}
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MYSQL_DATABASE: ${DB_NAME}
      MYSQL_USER: ${DB_USERNAME}
      MYSQL_PASSWORD: ${DB_PASSWORD}
      MYSQL_EXPORTER_PASSWORD: ${MYSQL_EXPORTER_PASSWORD:-exporter_password}

    volumes:
      - mysql-data:/var/lib/mysql
      - ./volume/logs/mysql:/var/log/mysql
      - ./volume/mysql/dump:/dump
      - ./config/mysql/my.${ENVIRONMENT}.cnf:/etc/mysql/conf.d/bitrix.cnf:ro
      - ./config/mysql/init:/docker-entrypoint-initdb.d:ro

    # SECURITY: Port closed for production - MySQL only accessible within Docker network
    # Uncomment for development/debugging only:
    # ports:
    #   - "${DB_PORT:-3306}:3306"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    healthcheck:
      # NOTE: Using healthcheck.sh wrapper for better diagnostics
      # Falls back to mysqladmin ping if script not available
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -u root -p\"$${MYSQL_ROOT_PASSWORD}\" --silent || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 120s

    # Resource limits для продакшн
    deploy:
      resources:
        limits:
          memory: ${MYSQL_MEMORY_LIMIT:-2G}
        reservations:
          memory: ${MYSQL_MEMORY_RESERVATION:-1G}

    # Security hardening
    # NOTE: no-new-privileges DISABLED for MySQL/MariaDB — entrypoint uses
    # gosu to switch from root to mysql user, which requires setuid syscall.
    init: true
    cap_drop:
      - ALL
    cap_add:
      - SYS_NICE
      - SETUID
      - SETGID
      - DAC_OVERRIDE
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    labels:
      - "com.docker.compose.service=mysql"
      - "monitoring=true"

  # ==========================================================================
  # REDIS - КЭШИРОВАНИЕ
  # ==========================================================================
  redis:
    container_name: ${DOMAIN}_redis
    build:
      context: .
      dockerfile: docker/redis/Dockerfile
      args:
        TZ: ${TZ}

    command: >
      redis-server
      /usr/local/etc/redis/redis.conf
      --maxmemory ${REDIS_MAX_MEMORY:-512mb}

    environment:
      TZ: ${TZ}

    volumes:
      - redis-data:/data
      - ./volume/logs/redis:/var/log/redis
      - ./config/redis/redis.conf:/usr/local/etc/redis/redis.conf:ro
      # Unix socket shared with PHP container
      - *redis-socket

    # Redis port NOT exposed to host for security (no password configured)
    # Containers communicate via Docker network or unix socket
    # Uncomment for debugging: ports: ["${REDIS_PORT:-6379}:6379"]

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 30s
      timeout: 10s
      retries: 3

    # Security hardening (Bitrix official)
    init: true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    labels:
      - "com.docker.compose.service=redis"
      - "monitoring=true"

  # ==========================================================================
  # PUSH SERVER - REAL-TIME УВЕДОМЛЕНИЯ
  # ==========================================================================
  # Push & Pull модуль Bitrix для мгновенных уведомлений, чата, живой ленты
  # Документация: https://dev.1c-bitrix.ru/learning/course/index.php?COURSE_ID=41&LESSON_ID=2033

  # Сервис подписок (клиенты подключаются сюда через WebSocket)
  push-sub:
    image: quay.io/bitrix24/push:3.2-v1-alpine
    container_name: ${DOMAIN}_push_sub

    environment:
      - PUSH_SECURITY_KEY=${PUSH_SECURITY_KEY:-}
      - PUSH_SUB_PORT=8010
      - PUSH_SUB_MODE=sub
      - REDIS_HOST=${REDIS_HOST:-redis}
      - REDIS_PORT=${REDIS_PORT:-6379}

    depends_on:
      redis:
        condition: service_healthy

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 8010 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

    # Security hardening (Bitrix official)
    init: true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    profiles:
      - push
      - full

    labels:
      - "com.docker.compose.service=push-sub"

  # Сервис публикации (PHP отправляет сюда события)
  push-pub:
    image: quay.io/bitrix24/push:3.2-v1-alpine
    container_name: ${DOMAIN}_push_pub

    environment:
      - PUSH_SECURITY_KEY=${PUSH_SECURITY_KEY:-}
      - PUSH_PUB_PORT=9010
      - PUSH_PUB_MODE=pub
      - REDIS_HOST=${REDIS_HOST:-redis}
      - REDIS_PORT=${REDIS_PORT:-6379}

    depends_on:
      redis:
        condition: service_healthy

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 9010 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

    # Security hardening (Bitrix official)
    init: true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid

    profiles:
      - push
      - full

    labels:
      - "com.docker.compose.service=push-pub"

  # ==========================================================================
  # MEMCACHED - ADDITIONAL CACHING (production-proven settings)
  # ==========================================================================
  memcached:
    container_name: ${DOMAIN}_memcached
    build:
      context: .
      dockerfile: docker/memcached/Dockerfile
      args:
        TZ: ${TZ}
        MEMCACHED_MEMORY_LIMIT: ${MEMCACHED_MEMORY_LIMIT:-1024}
        MEMCACHED_THREADS: ${MEMCACHED_THREADS:-8}
        MEMCACHED_CONN_LIMIT: ${MEMCACHED_CONN_LIMIT:-1024}
        MEMCACHED_MAX_ITEM_SIZE: ${MEMCACHED_MAX_ITEM_SIZE:-2m}

    environment:
      TZ: ${TZ}

    command: >-
      memcached -u root
      -m ${MEMCACHED_MEMORY_LIMIT:-1024}
      -c ${MEMCACHED_CONN_LIMIT:-1024}
      -t ${MEMCACHED_THREADS:-8}
      -I ${MEMCACHED_MAX_ITEM_SIZE:-2m}
      -o modern

    volumes:
      - ./volume/logs/memcached:/var/log/memcached

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    healthcheck:
      test: ["CMD", "nc", "-z", "localhost", "11211"]
      interval: 30s
      timeout: 10s
      retries: 3

    # Security hardening
    # NOTE: no-new-privileges DISABLED for Memcached — process needs to
    # drop supplementary groups which requires privilege operations.
    init: true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
    tmpfs:
      - /tmp:noexec,nodev,nosuid
      - /var/tmp:noexec,nodev,nosuid
      - /dev/shm:noexec,nodev,nosuid

    labels:
      - "com.docker.compose.service=memcached"

  # ==========================================================================
  # RABBITMQ - ОЧЕРЕДИ (ОПЦИОНАЛЬНО)
  # ==========================================================================
  amqp:
    container_name: ${DOMAIN}_rabbitmq
    hostname: rabbitmq
    build:
      context: .
      dockerfile: docker/rabbitmq/Dockerfile
      args:
        TZ: ${TZ}
        UID: ${UID}
        GID: ${GID}

    environment:
      TZ: ${TZ}
      RABBITMQ_ERLANG_COOKIE: ${RABBIT_COOKIE}
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS}
      RABBITMQ_DEFAULT_VHOST: ${RABBITMQ_DEFAULT_VHOST}

    volumes:
      - rabbitmq-data:/var/lib/rabbitmq
      - ./volume/logs/rabbitmq:/var/log/rabbitmq

    ports:
      - "${RABBIT_PORT:-5672}:5672"

    # UI access via subdomain rabbit.${DOMAIN} through nginx proxy
    expose:
      - "15672"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - rabbitmq
      - full

    labels:
      - "com.docker.compose.service=rabbitmq"

  # ==========================================================================
  # MAILHOG - ПЕРЕХВАТ ПОЧТЫ ДЛЯ РАЗРАБОТКИ
  # ==========================================================================
  mailhog:
    container_name: ${DOMAIN}_mailhog
    build:
      context: .
      dockerfile: docker/mailhog/Dockerfile

    environment:
      TZ: ${TZ}
      ENVIRONMENT: ${ENVIRONMENT}

    ports:
      - "${MAILHOG_PORT:-1025}:1025"
      - "${MAILHOG_WEB_PORT:-8025}:8025"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - local
      - dev

    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:8025/api/v2/messages || exit 1"]
      interval: 10s
      timeout: 5s
      start_period: 5s
      retries: 3

    labels:
      - "com.docker.compose.service=mailhog"

  # ==========================================================================
  # МОНИТОРИНГ И ЛОГИРОВАНИЕ
  # ==========================================================================

  grafana:
    container_name: ${DOMAIN}_grafana
    image: grafana/grafana:10.3.1

    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admin}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource,grafana-piechart-panel

    volumes:
      - grafana-data:/var/lib/grafana
      - ./config/grafana/provisioning:/etc/grafana/provisioning
      - ./config/grafana/dashboards:/var/lib/grafana/dashboards

    # Access via subdomain grafana.${DOMAIN} through nginx proxy
    expose:
      - "3000"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=grafana"

  prometheus:
    container_name: ${DOMAIN}_prometheus
    image: prom/prometheus:v2.49.1

    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=200h'
      - '--web.enable-lifecycle'

    volumes:
      - ./config/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./config/prometheus/rules:/etc/prometheus/rules:ro
      - prometheus-data:/prometheus
      - /var/run/docker.sock:/var/run/docker.sock:ro

    # Access via subdomain prometheus.${DOMAIN} through nginx proxy
    expose:
      - "9090"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=prometheus"

  loki:
    container_name: ${DOMAIN}_loki
    image: grafana/loki:2.9.4

    # Run as root to fix volume permissions
    user: root

    command: -config.file=/etc/loki/local-config.yaml

    volumes:
      - ./config/loki/loki-config.yaml:/etc/loki/local-config.yaml:ro
      - loki-data:/loki

    ports:
      - "3100:3100"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=loki"

  promtail:
    container_name: ${DOMAIN}_promtail
    image: grafana/promtail:2.9.4

    command: -config.file=/etc/promtail/config.yml

    volumes:
      - *docker-logs
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/promtail/config.yml:/etc/promtail/config.yml:ro
      - promtail-positions:/run/promtail
      - ./volume/logs:/var/log:ro

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=promtail"

  node-exporter:
    container_name: ${DOMAIN}_node_exporter
    image: prom/node-exporter:latest

    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'

    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro

    ports:
      - "9100:9100"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=node-exporter"

  # --------------------------------------------------------------------------
  # NGINX EXPORTER
  # --------------------------------------------------------------------------
  nginx-exporter:
    container_name: ${DOMAIN}_nginx_exporter
    image: nginx/nginx-prometheus-exporter:1.1

    command:
      - '-nginx.scrape-uri=http://nginx:8080/nginx_status'

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=nginx-exporter"

  # --------------------------------------------------------------------------
  # PHP-FPM EXPORTER
  # --------------------------------------------------------------------------
  php-fpm-exporter:
    container_name: ${DOMAIN}_php_fpm_exporter
    image: hipages/php-fpm_exporter:2

    environment:
      - PHP_FPM_SCRAPE_URI=tcp://bitrix:9000/status
      - PHP_FPM_FIX_PROCESS_COUNT=true

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=php-fpm-exporter"

  # --------------------------------------------------------------------------
  # REDIS EXPORTER
  # --------------------------------------------------------------------------
  redis-exporter:
    container_name: ${DOMAIN}_redis_exporter
    image: oliver006/redis_exporter:v1.58.0

    environment:
      - REDIS_ADDR=redis://redis:6379
    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=redis-exporter"

  # --------------------------------------------------------------------------
  # RABBITMQ EXPORTER
  # --------------------------------------------------------------------------
  rabbitmq-exporter:
    container_name: ${DOMAIN}_rabbitmq_exporter
    image: kbudde/rabbitmq-exporter:latest

    environment:
      - RABBIT_URL=http://amqp:15672
      - RABBIT_USER=${RABBITMQ_DEFAULT_USER:-rabbitmq}
      - RABBIT_PASSWORD=${RABBITMQ_DEFAULT_PASS:-rabbitmq}
      - PUBLISH_PORT=9419
      - OUTPUT_FORMAT=prometheus

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    # Only run when RabbitMQ is actually running
    profiles:
      - rabbitmq
      - full

    depends_on:
      - amqp

    labels:
      - "com.docker.compose.service=rabbitmq-exporter"

  # --------------------------------------------------------------------------
  # MYSQL/MARIADB EXPORTER
  # --------------------------------------------------------------------------
  mysql-exporter:
    container_name: ${DOMAIN}_mysql_exporter
    image: prom/mysqld-exporter:v0.15.1

    environment:
      - MYSQLD_EXPORTER_PASSWORD=${MYSQL_EXPORTER_PASSWORD:-exporter_password}

    command:
      - "--mysqld.address=mysql:3306"
      - "--mysqld.username=exporter"
      - "--collect.info_schema.tables"
      - "--collect.info_schema.innodb_metrics"
      - "--collect.global_status"
      - "--collect.global_variables"
      - "--collect.slave_status"
      - "--collect.info_schema.processlist"
      - "--collect.perf_schema.tablelocks"
      - "--collect.auto_increment.columns"
      - "--collect.binlog_size"
      - "--collect.engine_innodb_status"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=mysql-exporter"

  # --------------------------------------------------------------------------
  # MEMCACHED EXPORTER
  # --------------------------------------------------------------------------
  memcached-exporter:
    container_name: ${DOMAIN}_memcached_exporter
    image: prom/memcached-exporter:v0.14.4

    command:
      - "--memcached.address=memcached:11211"

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - monitoring
      - full

    labels:
      - "com.docker.compose.service=memcached-exporter"

  # ==========================================================================
  # БЭКАПЫ
  # ==========================================================================

  backup:
    container_name: ${DOMAIN}_backup
    build:
      context: .
      dockerfile: docker/backup/Dockerfile
      args:
        MYSQL_IMAGE: ${MYSQL_IMAGE:-mysql:8.4}
        TZ: ${TZ}

    environment:
      - DB_HOST=${DB_HOST:-mysql}
      - DB_NAME=${DB_NAME}
      - DB_USERNAME=${DB_USERNAME}
      - DB_PASSWORD=${DB_PASSWORD}
      - BACKUP_SCHEDULE_DB=${BACKUP_SCHEDULE_DB:-0 3 * * *}
      - BACKUP_SCHEDULE_FILES=${BACKUP_SCHEDULE_FILES:-0 4 * * *}
      - BACKUP_RETENTION_DAYS=${BACKUP_RETENTION_DAYS:-7}
      - TZ=${TZ}

    volumes:
      - *app-code
      - *backup-data
      - ./volume/mysql/dump:/mysql-dump

    networks:
      - bitrix-network

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - backup
      - full

    labels:
      - "com.docker.compose.service=backup"

  # ==========================================================================
  # БЕЗОПАСНОСТЬ
  # ==========================================================================

  fail2ban:
    container_name: ${DOMAIN}_fail2ban
    build:
      context: .
      dockerfile: docker/fail2ban/Dockerfile

    environment:
      - TZ=${TZ}
      - INIT_IPTABLES=true

    volumes:
      - ./volume/logs/nginx:/var/log/nginx:ro
      - ./volume/logs/fail2ban:/var/log/fail2ban
      - /var/run/docker.sock:/var/run/docker.sock:ro

    network_mode: host

    cap_add:
      - NET_ADMIN
      - NET_RAW

    privileged: false

    restart: unless-stopped

    logging: *default-logging

    profiles:
      - security
      - full

    labels:
      - "com.docker.compose.service=fail2ban"

# ============================================================================
# NETWORKS
# ============================================================================

networks:
  bitrix-network:
    name: ${DOMAIN}_network
    external: true

# ============================================================================
# VOLUMES
# ============================================================================

volumes:
  # Persistent data
  mysql-data:
    name: ${DOMAIN}_mysql_data
  redis-data:
    name: ${DOMAIN}_redis_data
  rabbitmq-data:
    name: ${DOMAIN}_rabbitmq_data

  # Monitoring
  grafana-data:
    name: ${DOMAIN}_grafana_data
  prometheus-data:
    name: ${DOMAIN}_prometheus_data
  loki-data:
    name: ${DOMAIN}_loki_data
  promtail-positions:
    name: ${DOMAIN}_promtail_positions

  # Redis unix socket (shared between redis and PHP containers: bitrix or php-fpm/php-cli/cron/supervisor)
  redis-socket:
    name: ${DOMAIN}_redis_socket

  # Composer cache
  composer-cache:
    name: ${DOMAIN}_composer_cache