# Stage 1: Build dependencies
FROM python:3.12-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --user --no-cache-dir -r requirements.txt

# Stage 2: Production image (no build tools)
FROM python:3.12-slim
WORKDIR /app
COPY --from=builder /root/.local /root/.local
COPY . .
ENV PATH=/root/.local/bin:$PATH
RUN useradd -m appuser && chown -R appuser:appuser /app
USER appuser
EXPOSE 5000
HEALTHCHECK --interval=30s --timeout=5s CMD curl -f http://localhost:5000/health || exit 1
CMD ["gunicorn", "--bind", "0.0.0.0:5000", "--workers", "4", "app:app"]

Internet
   |
nginx (port 80) -- API Gateway
   |
   +-- auth-service (internal)
   |       |-- postgres-auth (auth-backend network only)
   |
   +-- product-service (internal)
           |-- redis (cache)
           |-- postgres-products

version: "3.8"
services:
  nginx:
    image: nginx:alpine
    ports: ["80:80"]
    networks: [frontend]
    depends_on:
      auth: {condition: service_healthy}
      products: {condition: service_healthy}

  auth:
    build: ./auth-service
    networks: [frontend, auth-backend]
    secrets: [db_password, jwt_secret]
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 10s
      retries: 3

  postgres-auth:
    image: postgres:16-alpine
    networks: [auth-backend]  # NOT accessible from nginx or product service
    volumes: [auth-db-data:/var/lib/postgresql/data]
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets: [db_password]

secrets:
  db_password: {file: ./secrets/db_password.txt}
  jwt_secret: {file: ./secrets/jwt_secret.txt}

volumes:
  auth-db-data:

networks:
  frontend:
  auth-backend:

name: Secure Docker CI/CD
on: [push]
jobs:
  build-scan-push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Scan with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          severity: HIGH,CRITICAL
          exit-code: 1   # Fail pipeline on critical vulnerabilities

      - name: Push to registry
        if: github.ref == "refs/heads/main"
        run: |
          docker push myrepo/myapp:${{ github.sha }}
          docker push myrepo/myapp:latest