Thiết kế Docker compose chuẩn Production

/opt/my-app/
├── .env.example          # Mẫu biến môi trường (cam kết vào Git)
├── .env.production       # Biến môi trường bảo mật thực tế (KHÔNG cam kết vào Git)
├── docker-compose.yml    # File compose chính
├── nginx/
│   └── default.conf      # File cấu hình proxy
└── backups/              # Thư mục lưu trữ backup định kỳ

version: '3.8'

services:
  # ==========================================
  # 1. Backend Application Service (Node.js)
  # ==========================================
  api:
    image: my-company/backend:v1.4.2
    container_name: production_api
    restart: unless-stopped
    env_file:
      - .env.production
    environment:
      - NODE_ENV=production
      - PORT=3000
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - app_network
    # Chỉ bind cổng vào localhost nội bộ (Nginx Reverse Proxy sẽ kết nối tới đây)
    ports:
      - "127.0.0.1:3000:3000"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1.5'
          memory: 1024M
        reservations:
          cpus: '0.25'
          memory: 256M
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # ==========================================
  # 2. Database Service (PostgreSQL 16)
  # ==========================================
  db:
    image: postgres:16-alpine
    container_name: production_postgres
    restart: unless-stopped
    env_file:
      - .env.production
    environment:
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - pgdata:/var/lib/postgresql/data
    networks:
      - app_network
    # Không mở port ra ngoài Internet, chỉ giao tiếp nội bộ trong mạng app_network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2048M
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # ==========================================
  # 3. In-memory Cache Service (Redis 7)
  # ==========================================
  redis:
    image: redis:7-alpine
    container_name: production_redis
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD} --appendonly yes
    volumes:
      - redisdata:/data
    networks:
      - app_network
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "2"

# ==========================================
# Persistent Volumes (Dữ liệu bền vững)
# ==========================================
volumes:
  pgdata:
    name: production_pgdata
  redisdata:
    name: production_redisdata

# ==========================================
# Isolated Network (Mạng nội bộ cách ly)
# ==========================================
networks:
  app_network:
    name: production_network
    driver: bridge

depends_on:
  db:
    condition: service_healthy

logging:
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "3"

touch .env.production
chmod 600 .env.production
nano .env.production

DB_NAME=core_production
DB_USER=pgadmin
DB_PASSWORD=SuperSecretPassword2024!
REDIS_PASSWORD=AnotherVeryStrongPassword2024!
JWT_SECRET=your-random-jwt-token-string-here

# 1. Kéo image mới nhất về máy
docker compose --env-file .env.production pull

# 2. Khởi chạy lại container ở chế độ nền (Zero/Minimal Downtime)
docker compose --env-file .env.production up -d --remove-orphans

# 3. Kiểm tra trạng thái sức khỏe (Health status)
docker compose ps

# 4. Xem log theo dõi thời gian thực
docker compose logs -f --tail=100 api