Deployment and Infrastructure as Code¶

# Create non-root user
RUN useradd -r -u 1000 appuser

WORKDIR /app
COPY --from=builder /app .

# Set user before execution
USER appuser

# Build stage
FROM python:3.11-slim-bullseye@sha256:abc123... AS builder

# Build metadata
ARG APP_VERSION
ARG BUILD_DATE
ARG VCS_REF

LABEL org.opencontainers.image.version="${APP_VERSION}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.revision="${VCS_REF}"

WORKDIR /app

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Install Python dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy and test application
COPY . .
RUN python -m pytest

# Final stage - minimal runtime image
FROM python:3.11-slim-bullseye@sha256:abc123...

# Create non-root user
RUN useradd -r -u 1000 appuser

WORKDIR /app
COPY --from=builder /app .

USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s \
    CMD curl -f http://localhost:8000/health || exit 1

ENTRYPOINT ["python"]
CMD ["app.py"]

# Build stage
FROM node:18-alpine@sha256:def456... AS builder

WORKDIR /app

# Mount npm token as secret (not stored in layers)
RUN --mount=type=secret,id=npm_token \
    npm config set //registry.npmjs.org/:_authToken=$(cat /run/secrets/npm_token)

# Install dependencies
COPY package*.json ./
RUN npm ci --only=production

# Build application
COPY . .
RUN npm run build

# Final stage
FROM node:18-alpine@sha256:def456...

# Create non-root user
RUN addgroup -g 1000 appgroup && \
    adduser -u 1000 -G appgroup -s /bin/sh -D appuser

WORKDIR /app

# Copy built artifacts
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules

USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s \
    CMD wget -q --spider http://localhost:3000/health || exit 1

CMD ["node", "dist/server.js"]

# Dependencies
node_modules
vendor

# Development files
*.log
npm-debug.log
.env
.env.local

# Version control
.git
.gitignore

# Documentation
*.md
docs/

# Build artifacts
dist
build
*.tar.gz

# IDE files
.vscode
.idea
*.swp

# trivy.yaml
trivy:
  severity: CRITICAL,HIGH
  ignore-unfixed: true
  vuln-type: os,library
  format: table
  output: scan-results.txt

scan-image:
  script:
    - trivy image --severity HIGH,CRITICAL \
        company-registry.com/team/app:${CI_COMMIT_SHA}
    - |
      if [ $? -eq 1 ]; then
        echo "Critical vulnerabilities found"
        exit 1
      fi

cleanup:
  policies:
    - name: keep-latest-versions
      rules:
        - type: tag
          pattern: '^v\d+\.\d+\.\d+$'
          action: keep
          amount: 5

    - name: cleanup-feature-branches
      rules:
        - type: tag
          pattern: '^feature-.*$'
          action: delete
          older-than: 7d

    - name: cleanup-development-tags
      rules:
        - type: tag
          pattern: '^dev-.*$'
          action: delete
          older-than: 3d

# Stage 1: Dependencies
FROM node:18-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci

# Stage 2: Frontend build
FROM node:18-alpine AS frontend-builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY frontend/ .
RUN npm run build

# Stage 3: Backend build
FROM maven:3.8-openjdk-17 AS backend-builder
WORKDIR /app
COPY backend/pom.xml .
RUN --mount=type=cache,target=/root/.m2 \
    mvn dependency:go-offline
COPY backend/ .
RUN mvn package -DskipTests

# Stage 4: Security scan
FROM aquasec/trivy:latest AS security-scan
COPY --from=backend-builder /app/target/*.jar /app/
RUN trivy filesystem --exit-code 1 \
    --severity HIGH,CRITICAL /app

# Stage 5: Final runtime image
FROM eclipse-temurin:17-jre-alpine
WORKDIR /app

# Copy built artifacts
COPY --from=frontend-builder /app/dist /app/public
COPY --from=backend-builder /app/target/*.jar app.jar

# Non-root user
RUN addgroup -g 1000 appgroup && \
    adduser -u 1000 -G appgroup -s /bin/sh -D appuser
USER appuser

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=3s \
    CMD wget -q --spider http://localhost:8080/actuator/health || exit 1

ENTRYPOINT ["java", "-XX:+UseContainerSupport", "-jar", "app.jar"]

# docker-compose.yml
version: '3.8'

x-logging: &default-logging
  options:
    max-size: "10m"
    max-file: "3"
  driver: json-file

services:
  app:
    build:
      context: .
      target: development
      args:
        - NODE_ENV=development
    volumes:
      - .:/app:delegated
      - node_modules:/app/node_modules
    ports:
      - "${PORT:-3000}:3000"
      - "9229:9229"  # Debug port
    environment:
      - NODE_ENV=development
      - DATABASE_URL=postgresql://postgres:password@db:5432/myapp
      - REDIS_URL=redis://redis:6379/0
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    logging: *default-logging

  db:
    image: postgres:14-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init-scripts:/docker-entrypoint-initdb.d
    environment:
      - POSTGRES_PASSWORD=password
      - POSTGRES_DB=myapp
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
    logging: *default-logging

  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
    logging: *default-logging

volumes:
  node_modules:
  postgres_data:
  redis_data:

networks:
  default:
    driver: bridge

# docker-compose.override.yml
services:
  app:
    command: npm run dev
    environment:
      - DEBUG=app:*

  # Expose ports for local debugging tools
  db:
    ports:
      - "5432:5432"

  redis:
    ports:
      - "6379:6379"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
    environment: production
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "3000"
    spec:
      securityContext:
        runAsNonRoot: true
        fsGroup: 2000
      containers:
        - name: myapp
          image: company-registry.com/myapp:1.2.3
          ports:
            - containerPort: 3000
              name: http
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: 500m
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 15
            periodSeconds: 20
          startupProbe:
            httpGet:
              path: /health
              port: http
            failureThreshold: 30
            periodSeconds: 10
          env:
            - name: NODE_ENV
              value: "production"
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: myapp-secrets
                  key: database-url
          volumeMounts:
            - name: config
              mountPath: /etc/config
              readOnly: true
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: config
          configMap:
            name: myapp-config
        - name: tmp
          emptyDir: {}

infrastructure/
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   └── variables.tf
│   ├── staging/
│   │   ├── main.tf
│   │   └── variables.tf
│   └── prod/
│       ├── main.tf
│       └── variables.tf
├── modules/
│   ├── networking/
│   ├── kubernetes/
│   └── database/
└── shared/
    └── variables.tf

# Define explicit variable types and validation
variable "environment" {
  type        = string
  description = "Environment name (e.g., staging, production)"
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

variable "region" {
  type        = string
  description = "AWS region for deployment"
  default     = "us-west-2"
}

# Local variables for common configurations
locals {
  vpc_cidr = {
    dev     = "10.0.0.0/16"
    staging = "10.1.0.0/16"
    prod    = "10.2.0.0/16"
  }

  common_tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
    Team        = "platform"
  }
}

# Modular resource organization
module "vpc" {
  source = "./modules/vpc"

  environment = var.environment
  cidr_block  = local.vpc_cidr[var.environment]

  tags = local.common_tags
}

# Dependencies and relationships
module "kubernetes" {
  source = "./modules/kubernetes"

  vpc_id         = module.vpc.vpc_id
  subnet_ids     = module.vpc.private_subnet_ids
  cluster_version = "1.24"

  node_groups = {
    general = {
      desired_size   = lookup(var.node_sizes[var.environment], "desired", 2)
      max_size       = lookup(var.node_sizes[var.environment], "max", 4)
      min_size       = lookup(var.node_sizes[var.environment], "min", 1)
      instance_types = ["t3.medium"]
    }
  }

  depends_on = [module.vpc]
}

# playbook.yml - Main playbook structure
---
- name: Configure application servers
  hosts: app_servers
  become: true
  vars_files:
    - vars/{{ environment }}.yml

  pre_tasks:
    - name: Validate environment variables
      assert:
        that:
          - environment is defined
          - environment in ['dev', 'staging', 'prod']
        msg: "Environment must be set to dev, staging, or prod"

  roles:
    - role: common
      tags: ['common', 'setup']

    - role: nginx
      tags: ['web', 'nginx']
      vars:
        nginx_worker_processes: "{{ 'auto' if environment == 'prod' else '2' }}"

    - role: application
      tags: ['app']

  post_tasks:
    - name: Verify configuration
      include_tasks: tasks/verify.yml

# roles/application/tasks/main.yml
---
- name: Install application dependencies
  apt:
    name: "{{ item }}"
    state: present
    update_cache: yes
  loop: "{{ application_dependencies }}"
  tags: ['install']

- name: Create application directories
  file:
    path: "{{ item }}"
    state: directory
    owner: "{{ app_user }}"
    group: "{{ app_group }}"
    mode: '0755'
  loop:
    - "{{ app_config_path }}"
    - "{{ app_data_path }}"
    - "{{ app_log_path }}"
  tags: ['setup']

- name: Configure application service
  template:
    src: application.service.j2
    dest: /etc/systemd/system/application.service
    mode: '0644'
  notify: restart application
  tags: ['config']

- name: Ensure application is running
  systemd:
    name: application
    state: started
    enabled: yes
  tags: ['service']

import boto3
import json
from botocore.exceptions import ClientError

def get_secret(secret_name, region_name="us-west-2"):
    """
    Retrieve secret from AWS Secrets Manager.
    """
    session = boto3.session.Session()
    client = session.client(
        service_name='secretsmanager',
        region_name=region_name
    )

    try:
        response = client.get_secret_value(SecretId=secret_name)

        if 'SecretString' in response:
            return json.loads(response['SecretString'])
        else:
            return response['SecretBinary']

    except ClientError as e:
        if e.response['Error']['Code'] == 'ResourceNotFoundException':
            raise ValueError(f"Secret {secret_name} not found")
        elif e.response['Error']['Code'] == 'InvalidRequestException':
            raise ValueError(f"Invalid request for secret {secret_name}")
        else:
            raise

def rotate_secret(secret_id):
    """
    Rotate database credentials in AWS Secrets Manager.
    """
    client = boto3.client('secretsmanager')

    try:
        # Get current secret value
        response = client.get_secret_value(SecretId=secret_id)
        current_secret = json.loads(response['SecretString'])

        # Generate new credentials
        new_password = generate_secure_password()

        # Update application database
        update_database_password(
            username=current_secret['username'],
            new_password=new_password
        )

        # Update secret in Secrets Manager
        client.put_secret_value(
            SecretId=secret_id,
            SecretString=json.dumps({
                'username': current_secret['username'],
                'password': new_password,
                'host': current_secret['host'],
                'port': current_secret['port']
            })
        )

        return True

    except Exception as e:
        # Implement proper error handling and rollback
        raise SecretRotationError(f"Failed to rotate secret: {str(e)}")

# .github/workflows/deployment.yml
name: Deployment Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to Container Registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v4
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Run Security Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'

      - name: Run tests
        run: |
          docker run --rm \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
            npm test

  deploy-staging:
    needs: build-and-test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/develop'
    environment:
      name: staging
      url: https://staging.example.com

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-west-2

      - name: Update EKS deployment
        run: |
          aws eks update-kubeconfig --name staging-cluster
          kubectl set image deployment/app-deployment \
            app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          kubectl rollout status deployment/app-deployment --timeout=5m

      - name: Run smoke tests
        run: |
          curl -f https://staging.example.com/health || exit 1

  deploy-production:
    needs: deploy-staging
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    environment:
      name: production
      url: https://api.example.com

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.PROD_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.PROD_AWS_SECRET_ACCESS_KEY }}
          aws-region: us-west-2

      - name: Deploy to Production
        run: |
          aws eks update-kubeconfig --name prod-cluster
          kubectl set image deployment/app-deployment \
            app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          kubectl rollout status deployment/app-deployment --timeout=10m

      - name: Verify deployment
        run: |
          # Health check
          curl -f https://api.example.com/health || exit 1

          # Monitor error rates for 5 minutes
          sleep 300

      - name: Notify team
        if: always()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "Production deployment: ${{ job.status }}",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "Deployment to production: *${{ job.status }}*\nCommit: ${{ github.sha }}"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

// Jenkinsfile
pipeline {
    agent any

    environment {
        DOCKER_REGISTRY = 'company-registry.com'
        APP_NAME = 'myapp'
        VERSION = sh(script: 'git describe --tags --always', returnStdout: true).trim()
        KUBECONFIG = credentials('kubeconfig-prod')
    }

    stages {
        stage('Build') {
            steps {
                script {
                    docker.build("${DOCKER_REGISTRY}/${APP_NAME}:${VERSION}")
                }
            }
        }

        stage('Test') {
            parallel {
                stage('Unit Tests') {
                    steps {
                        sh 'npm test'
                        junit 'test-results/**/*.xml'
                    }
                }
                stage('Integration Tests') {
                    steps {
                        sh 'npm run integration-test'
                    }
                }
                stage('Security Scan') {
                    steps {
                        sh """
                            trivy image \
                              --severity HIGH,CRITICAL \
                              --exit-code 1 \
                              ${DOCKER_REGISTRY}/${APP_NAME}:${VERSION}
                        """
                    }
                }
            }
        }

        stage('Push Image') {
            steps {
                script {
                    docker.withRegistry("https://${DOCKER_REGISTRY}", 'registry-credentials') {
                        docker.image("${DOCKER_REGISTRY}/${APP_NAME}:${VERSION}").push()
                        docker.image("${DOCKER_REGISTRY}/${APP_NAME}:${VERSION}").push('latest')
                    }
                }
            }
        }

        stage('Deploy to Staging') {
            when { branch 'develop' }
            steps {
                script {
                    deployToEnvironment(
                        environment: 'staging',
                        version: VERSION
                    )
                }
            }
        }

        stage('Deploy to Production') {
            when { branch 'main' }
            input {
                message 'Deploy to production?'
                ok 'Yes, deploy!'
            }
            steps {
                script {
                    deployToEnvironment(
                        environment: 'production',
                        version: VERSION
                    )
                }
            }
        }

        stage('Verify Deployment') {
            steps {
                script {
                    sh """
                        kubectl rollout status deployment/${APP_NAME} -n production
                        curl -f https://api.example.com/health || exit 1
                    """
                }
            }
        }
    }

    post {
        success {
            slackSend(
                channel: '#deployments',
                color: 'good',
                message: "Deployment successful: ${APP_NAME}:${VERSION}"
            )
        }
        failure {
            slackSend(
                channel: '#deployments',
                color: 'danger',
                message: "Deployment failed: ${APP_NAME}:${VERSION}"
            )
        }
        always {
            cleanWs()
        }
    }
}

// Helper function for deployment
def deployToEnvironment(Map config) {
    sh """
        kubectl config use-context ${config.environment}
        kubectl set image deployment/${APP_NAME} \
          app=${DOCKER_REGISTRY}/${APP_NAME}:${config.version} \
          -n ${config.environment}
        kubectl rollout status deployment/${APP_NAME} \
          -n ${config.environment} \
          --timeout=5m
    """
}

# Using Istio for canary deployment
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: app-vsvc
spec:
  hosts:
    - app.example.com
  http:
    - match:
        - headers:
            canary:
              exact: "true"
      route:
        - destination:
            host: app-canary
            subset: v2
    - route:
        - destination:
            host: app-stable
            subset: v1
          weight: 90
        - destination:
            host: app-canary
            subset: v2
          weight: 10

# prometheus/canary-rules.yaml
groups:
  - name: canary-deployment
    interval: 30s
    rules:
      - alert: CanaryErrorRateHigh
        expr: |
          sum(rate(http_requests_total{version="canary",status=~"5.."}[5m]))
          /
          sum(rate(http_requests_total{version="canary"}[5m])) > 0.05
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Canary deployment error rate too high"
          description: "Canary version showing {{ $value }}% error rate"

      - alert: CanaryLatencyHigh
        expr: |
          histogram_quantile(0.95,
            rate(http_request_duration_seconds_bucket{version="canary"}[5m])
          ) > 1
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Canary deployment latency too high"
          description: "Canary p95 latency: {{ $value }}s"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  replicas: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # Max new pods above desired
      maxUnavailable: 0  # Max old pods that can be down
  template:
    spec:
      containers:
        - name: app
          image: myapp:2.0.0
          readinessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 10

# docker-compose.dev.yml
version: '3.8'

x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "3"

services:
  app:
    build:
      context: .
      target: development
      args:
        NODE_ENV: development
    volumes:
      - .:/app:delegated
      - /app/node_modules
      - ${HOME}/.aws:/root/.aws:ro
    environment:
      - NODE_ENV=development
      - DB_HOST=db
      - DB_PORT=5432
      - DB_NAME=appdb
      - DB_USER=devuser
      - DB_PASSWORD=devpass
      - REDIS_HOST=cache
      - REDIS_PORT=6379
      - AWS_PROFILE=${AWS_PROFILE:-default}
    ports:
      - "${PORT:-3000}:3000"
      - "9229:9229"  # Node.js debugger
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    logging: *default-logging

  db:
    image: postgres:14-alpine
    environment:
      POSTGRES_DB: appdb
      POSTGRES_USER: devuser
      POSTGRES_PASSWORD: devpass
      POSTGRES_INITDB_ARGS: "-E UTF8"
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./init-scripts:/docker-entrypoint-initdb.d:ro
      - ./backups:/backups
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U devuser -d appdb"]
      interval: 10s
      timeout: 5s
      retries: 5
    logging: *default-logging

  cache:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redisdata:/data
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
    logging: *default-logging

  # Development-only services
  mailhog:
    image: mailhog/mailhog:latest
    ports:
      - "1025:1025"  # SMTP
      - "8025:8025"  # Web UI
    logging: *default-logging

  adminer:
    image: adminer:latest
    ports:
      - "8080:8080"
    environment:
      ADMINER_DEFAULT_SERVER: db
    depends_on:
      - db
    logging: *default-logging

volumes:
  pgdata:
    driver: local
  redisdata:
    driver: local

networks:
  default:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16

#!/bin/bash
# setup-dev.sh

set -e

echo "Setting up local development environment..."

# Check prerequisites
check_prerequisites() {
    echo "Checking prerequisites..."

    command -v docker >/dev/null 2>&1 || {
        echo "Error: Docker is not installed"
        exit 1
    }

    command -v docker-compose >/dev/null 2>&1 || {
        echo "Error: Docker Compose is not installed"
        exit 1
    }

    echo "Prerequisites satisfied"
}

# Create necessary directories
setup_directories() {
    echo "Creating project directories..."
    mkdir -p backups
    mkdir -p init-scripts
    mkdir -p logs
    echo "Directories created"
}

# Copy environment template
setup_env_file() {
    if [ ! -f .env ]; then
        echo "Creating .env file..."
        cp .env.example .env
        echo ".env file created"
        echo "WARNING: Please review and update .env with your settings"
    else
        echo ".env file already exists"
    fi
}

# Start services
start_services() {
    echo "Starting Docker services..."
    docker-compose -f docker-compose.dev.yml up -d
    echo "Services started"
}

# Wait for services
wait_for_services() {
    echo "Waiting for services to be healthy..."

    max_attempts=30
    attempt=0

    while [ $attempt -lt $max_attempts ]; do
        if docker-compose -f docker-compose.dev.yml ps | grep -q "healthy"; then
            echo "Services are healthy"
            return 0
        fi

        attempt=$((attempt + 1))
        echo "Waiting... ($attempt/$max_attempts)"
        sleep 2
    done

    echo "Error: Services did not become healthy in time"
    return 1
}

# Run database migrations
run_migrations() {
    echo "Running database migrations..."
    docker-compose -f docker-compose.dev.yml exec -T app npm run migrate
    echo "Migrations completed"
}

# Seed development data
seed_data() {
    echo "Seeding development data..."
    docker-compose -f docker-compose.dev.yml exec -T app npm run seed
    echo "Data seeded"
}

# Print access information
print_info() {
    echo ""
    echo "========================================="
    echo "Development environment is ready!"
    echo "========================================="
    echo ""
    echo "Application: http://localhost:3000"
    echo "Database UI: http://localhost:8080"
    echo "Mail Server: http://localhost:8025"
    echo ""
    echo "Useful commands:"
    echo "  docker-compose -f docker-compose.dev.yml logs -f    # View logs"
    echo "  docker-compose -f docker-compose.dev.yml down       # Stop services"
    echo "  docker-compose -f docker-compose.dev.yml restart    # Restart services"
    echo ""
}

# Main execution
main() {
    check_prerequisites
    setup_directories
    setup_env_file
    start_services
    wait_for_services || exit 1
    run_migrations
    seed_data
    print_info
}

main