Restructure backend into microservices, add envelope encryption, DM files, and message editing

deployment/Dockerfile.postgres

@@ -0,0 +1,10 @@
+FROM postgres:15
+
+# Install envsubst for environment variable substitution
+RUN apt-get update && apt-get install -y gettext-base && rm -rf /var/lib/apt/lists/*
+
+# Copy the template
+COPY init-postgres.sql.template /docker-entrypoint-initdb.d/init-postgres.sql.template
+
+# Set the default command to process template and run PostgreSQL
+CMD ["bash", "-c", "if [ ! -f /var/lib/postgresql/data/PG_VERSION ]; then echo 'Processing PostgreSQL init template...'; envsubst < /docker-entrypoint-initdb.d/init-postgres.sql.template > /docker-entrypoint-initdb.d/init-postgres.sql; echo 'Template processing complete.'; fi; exec docker-entrypoint.sh postgres"]

deployment/docker-compose.yml

@@ -1,23 +1,131 @@
 services:
-  backend:
+  main:
     build:
-      dockerfile: deployment/Dockerfile.backend
+      dockerfile: deployment/Dockerfile
       context: ..
+      target: main
     environment:
       PORT: 8300
+      SERVICE_MODE: production
+      MESSAGING_SERVICE_URL: http://messaging:8301
+      FILE_STORAGE_SERVICE_URL: http://file_storage:8302
+      DATABASE_URL: postgresql://main_user:${MAIN_DB_PASSWORD}@postgres:5432/fromchat_main
+      MAIN_DB_PASSWORD: ${MAIN_DB_PASSWORD}
       JWT_SECRET: ${JWT_SECRET}
       VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
       VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
-      FIREBASE_CERT: ${FIREBASE_CERT}
+      COMPLIANCE_PUBLIC_KEY: ${COMPLIANCE_PUBLIC_KEY}
+      MESSAGE_RETENTION_DAYS: ${MESSAGE_RETENTION_DAYS}
+    ports:
+      - "8300:8300"
     volumes:
       - data:/app/data
-      - logs:/app/logs
+      - main_logs:/app/logs
+      # backend/firebase-cert.json on host → path resolved by push_service (__file__ → /app)
+      - ../backend/firebase-cert.json:/app/firebase-cert.json:ro
+    networks:
+      - public
+      - services
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "python3", "/usr/local/bin/healthcheck.py"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    restart: unless-stopped
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    develop:
+      watch:
+        - action: sync+restart
+          path: ../backend/services/main
+          target: /app/services/main
+        - action: sync+restart
+          path: ../backend/services/shared
+          target: /app/services/shared
+        - action: rebuild
+          path: ../backend/requirements.txt
+
+  messaging:
+    build:
+      dockerfile: deployment/Dockerfile
+      context: ..
+      target: messaging
+    environment:
+      PORT: 8301
+      SERVICE_MODE: production
+      DATABASE_URL: postgresql://messaging_user:${MESSAGING_DB_PASSWORD}@postgres:5432/fromchat_messaging
+      MESSAGING_DB_PASSWORD: ${MESSAGING_DB_PASSWORD}
+      COMPLIANCE_PUBLIC_KEY: ${COMPLIANCE_PUBLIC_KEY}
+      MESSAGE_RETENTION_DAYS: ${MESSAGE_RETENTION_DAYS}
+    volumes:
+      - messaging_logs:/app/logs
+    networks:
+      - services
+    depends_on:
+      postgres:
+        condition: service_healthy
+      main:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "python3", "/usr/local/bin/healthcheck.py"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 3s
+    restart: unless-stopped
 
     develop:
       watch:
         - action: sync+restart
-          path: ../backend
-          target: /app
+          path: ../backend/services/messaging
+          target: /app/services/messaging
+        - action: sync+restart
+          path: ../backend/services/shared
+          target: /app/services/shared
+        - action: rebuild
+          path: ../backend/requirements.txt
+
+  file_storage:
+    build:
+      dockerfile: deployment/Dockerfile
+      context: ..
+      target: file_storage
+    environment:
+      PORT: 8302
+      SERVICE_MODE: production
+      DATABASE_URL: postgresql://file_storage_user:${FILE_STORAGE_DB_PASSWORD}@postgres:5432/fromchat_files
+      FILE_STORAGE_DB_PASSWORD: ${FILE_STORAGE_DB_PASSWORD}
+      JWT_SECRET: ${JWT_SECRET}
+    volumes:
+      - files:/app/files
+      - file_storage_logs:/app/logs
+    networks:
+      - services
+    depends_on:
+      postgres:
+        condition: service_healthy
+      main:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "python3", "/usr/local/bin/healthcheck.py"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 3s
+    restart: unless-stopped
+
+    develop:
+      watch:
+        - action: sync+restart
+          path: ../backend/services/file_storage
+          target: /app/services/file_storage
+        - action: sync+restart
+          path: ../backend/services/shared
+          target: /app/services/shared
         - action: rebuild
           path: ../backend/requirements.txt
 
@@ -27,25 +135,36 @@ services:
       context: ..
     environment:
       PORT: 8301
-      BACKEND_HOST: http://backend:8300
+      BACKEND_HOST: http://main:8300
+      FILE_STORAGE_HOST: http://file_storage:8302
     ports:
       - "8301:8301"
-    depends_on:
-      - backend
+    networks:
+      - public
+      - services
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8301/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    restart: unless-stopped
+
     develop:
       watch:
         - action: rebuild
           path: ../frontend
         - action: sync+restart
-          path: server.js
+          path: ../server.js
           target: /server/server.js
         - action: rebuild
-          path: package.json
+          path: ../package.json
 
   caddy:
     build:
       context: ./caddy
       dockerfile: Dockerfile
+    profiles:
+      - production
     restart: unless-stopped
     ports:
       - "80:80"
@@ -53,15 +172,52 @@ services:
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes:
-      - certs:/root/site/certs
+      - caddy_data:/root/site/certs
     environment:
       XDG_DATA_HOME: /root/site/certs
       XDG_CONFIG_HOME: /root/site/certs
+    networks:
+      - public
+
+  postgres:
+    build:
+      context: .
+      dockerfile: Dockerfile.postgres
+    environment:
+      POSTGRES_DB: fromchat
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      MAIN_DB_PASSWORD: ${MAIN_DB_PASSWORD}
+      MESSAGING_DB_PASSWORD: ${MESSAGING_DB_PASSWORD}
+      FILE_STORAGE_DB_PASSWORD: ${FILE_STORAGE_DB_PASSWORD}
+    ports:
+      - "127.0.0.1:5432:5432"
+    volumes:
+      - db:/var/lib/postgresql/data
+    networks:
+      - services
+      - public
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 10s
+      timeout: 10s
+      retries: 15
+      start_period: 3s
+    restart: unless-stopped
 
 volumes:
   data:
-    name: fromchat-data
-  logs:
-    name: fromchat-logs
-  certs:
-    name: fromchat-certs
+  main_logs:
+  messaging_logs:
+  files:
+  file_storage_logs:
+  db:
+  caddy:
+
+networks:
+  public:
+    driver: bridge
+    internal: false
+  services:
+    driver: bridge
+    internal: true

deployment/init-postgres-entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Custom entrypoint for PostgreSQL that processes the init template
+
+set -e
+
+# If this is the first run (data directory is empty), process the template
+if [ ! -f /var/lib/postgresql/data/PG_VERSION ]; then
+    echo "Processing PostgreSQL init template..."
+
+    # Substitute environment variables in the SQL template
+    envsubst < /docker-entrypoint-initdb.d/init-postgres.sql.template > /docker-entrypoint-initdb.d/init-postgres.sql
+
+    echo "Template processing complete."
+else
+    echo "PostgreSQL data directory already exists, skipping template processing."
+fi
+
+# Execute the original PostgreSQL entrypoint
+exec /usr/local/bin/docker-entrypoint.sh "$@"

deployment/init-postgres.sql.template

@@ -0,0 +1,42 @@
+-- PostgreSQL initialization script for FromChat compliance architecture
+-- Creates separate databases and users for each service with minimal required permissions
+
+-- Create users with passwords from environment variables
+-- Variables are substituted by envsubst before PostgreSQL runs this script
+CREATE USER main_user WITH PASSWORD '${MAIN_DB_PASSWORD}';
+CREATE USER messaging_user WITH PASSWORD '${MESSAGING_DB_PASSWORD}';
+CREATE USER file_storage_user WITH PASSWORD '${FILE_STORAGE_DB_PASSWORD}';
+
+-- Create databases for each service
+CREATE DATABASE fromchat_main OWNER main_user;
+CREATE DATABASE fromchat_messaging OWNER messaging_user;
+CREATE DATABASE fromchat_files OWNER file_storage_user;
+
+-- Connect to main database and set up
+\c fromchat_main
+CREATE SCHEMA IF NOT EXISTS fromchat_main AUTHORIZATION main_user;
+GRANT ALL PRIVILEGES ON DATABASE fromchat_main TO main_user;
+GRANT ALL PRIVILEGES ON SCHEMA fromchat_main TO main_user;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA fromchat_main TO main_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_main GRANT ALL ON TABLES TO main_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_main GRANT ALL ON SEQUENCES TO main_user;
+
+-- Connect to messaging database and set up
+\c fromchat_messaging
+CREATE SCHEMA IF NOT EXISTS fromchat_messaging AUTHORIZATION messaging_user;
+GRANT ALL PRIVILEGES ON DATABASE fromchat_messaging TO messaging_user;
+GRANT USAGE ON SCHEMA fromchat_messaging TO messaging_user;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA fromchat_messaging TO messaging_user;
+GRANT USAGE ON ALL SEQUENCES IN SCHEMA fromchat_messaging TO messaging_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_messaging GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO messaging_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_messaging GRANT USAGE ON SEQUENCES TO messaging_user;
+
+-- Connect to files database and set up
+\c fromchat_files
+CREATE SCHEMA IF NOT EXISTS fromchat_files AUTHORIZATION file_storage_user;
+GRANT ALL PRIVILEGES ON DATABASE fromchat_files TO file_storage_user;
+GRANT USAGE ON SCHEMA fromchat_files TO file_storage_user;
+GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA fromchat_files TO file_storage_user;
+GRANT USAGE ON ALL SEQUENCES IN SCHEMA fromchat_files TO file_storage_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_files GRANT SELECT, INSERT, UPDATE ON TABLES TO file_storage_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_files GRANT USAGE ON SEQUENCES TO file_storage_user;