# CC-ADVANCECYBER Memory Backend
# Hardened Docker Compose for security requirements

version: "3.8"

services:
  # Vector database for semantic memory
  qdrant:
    image: qdrant/qdrant:v1.7.4
    container_name: cc-qdrant
    user: "1000:1000"
    restart: unless-stopped
    ports:
      - "127.0.0.1:6334:6333"  # SEC-010: Localhost only
    volumes:
      - qdrant_data:/qdrant/storage
    environment:
      - QDRANT__SERVICE__API_KEY=${QDRANT_API_KEY}  # SEC-004: Required auth
      - QDRANT__LOG_LEVEL=WARN
    security_opt:
      - no-new-privileges:true  # SEC-003: Prevent privilege escalation
    cap_drop:
      - ALL  # SEC-003: Drop all capabilities
    mem_limit: 2g
    cpus: 2
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:6333/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Structured data storage
  claude-postgres:
    image: postgres:16-alpine
    container_name: cc-postgres
    user: "1000:1000"
    restart: unless-stopped
    ports:
      - "127.0.0.1:5432:5432"  # SEC-010: Localhost only
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=claude_memory
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}  # SEC-004: Required auth
      - POSTGRES_DB=claude_memory
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - FOWNER
      - DAC_OVERRIDE
    mem_limit: 1g
    cpus: 1
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U claude_memory"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Workflow automation
  n8n:
    image: n8nio/n8n:1.24.1
    container_name: cc-n8n
    user: "1000:1000"
    restart: unless-stopped
    ports:
      - "127.0.0.1:5679:5678"  # SEC-010: Localhost only
    volumes:
      - n8n_data:/home/node/.n8n
    environment:
      # Authentication
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=${N8N_USER:-admin}
      - N8N_BASIC_AUTH_PASSWORD=${N8N_PASSWORD}  # SEC-004: Required auth
      # Security hardening (SEC-006)
      - N8N_EXTERNAL_HOOKS=false
      - N8N_TEMPLATES_ENABLED=false
      - N8N_PUBLIC_API_DISABLED=true
      - N8N_HIDE_USAGE_PAGE=true
      - N8N_DIAGNOSTICS_ENABLED=false
      - N8N_PERSONALIZATION_ENABLED=false
      # General config
      - N8N_HOST=localhost
      - N8N_PORT=5678
      - N8N_PROTOCOL=http
      - GENERIC_TIMEZONE=America/New_York
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    mem_limit: 1g
    cpus: 1
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:5678/healthz"]
      interval: 30s
      timeout: 10s
      retries: 3
    depends_on:
      claude-postgres:
        condition: service_healthy

volumes:
  qdrant_data:
    name: cc-qdrant-data
  postgres_data:
    name: cc-postgres-data
  n8n_data:
    name: cc-n8n-data

networks:
  default:
    name: cc-memory-network
    driver: bridge
