docker-compose.yml

services:
### =============================================== ###
###               INTERNAL SERVICES                 ###
### =============================================== ###
  frontend:
    build: ./frontend
    image: "${FRONTEND_IMAGE:-off-key-frontend:latest}"
    container_name: react_client
    env_file: .env
    ports:
      - "${FRONTEND_PORT}:5173"
    depends_on:
      - api-gateway
    networks:
      - socket-network
    develop:
      watch:
        - action: sync
          path: ./frontend
          target: /src
          ignore:
            - node_modules/
        - action: rebuild
          path: ./frontend/package.json
        - action: rebuild
          path: ./frontend/package-lock.json

  api-gateway:
    build:
      context: ./backend/
      args:
        SERVICE_NAME: off-key-api-gateway
        SERVICE_ROOT: services/api/gateway
    image: "${API_GATEWAY_IMAGE:-off-key-api-gateway:latest}"
    container_name: api_gateway
    env_file: .env
    ports:
      - "${BACKEND_PORT}:8000"
    depends_on:
      timescaledb:
        condition: service_healthy
      socket-proxy:
        condition: service_started
      db-sync:
        condition: service_started
      tactic-middleware:
        condition: service_healthy
    networks:
      - app-network
      - socket-network
    restart: always
    healthcheck:
      test:
        - "CMD"
        - "/app/bin/python"
        - "-c"
        - "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=2)"
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s
    command: ["uvicorn", "off_key_api_gateway.main:app",
              "--reload", "--reload-dir", "/app/lib/python3.12/site-packages/off_key_api_gateway",
              "--host", "", "--port", "8000"]
    develop:
      watch:
        - action: sync
          path: backend/services/api/gateway/src/off_key_api_gateway
          target: /app/lib/python3.12/site-packages/off_key_api_gateway
        - action: rebuild
          path: ./backend/uv.lock

  tactic-middleware:
    build:
      context: ./backend/
      args:
        SERVICE_NAME: off-key-tactic-middleware
        SERVICE_ROOT: services/middleware/tactic
    image: "${TACTIC_MIDDLEWARE_IMAGE:-off-key-tactic-middleware:latest}"
    container_name: tactic_middleware
    env_file: .env
    ports:
      - "8001:8000"
    depends_on:
      timescaledb:
        condition: service_healthy
      socket-proxy:
        condition: service_started
      db-sync:
        condition: service_healthy
    networks:
      - app-network
      - socket-network
      - emqx-network
    environment:
      - TACTIC_DOCKER_DEFAULT_NETWORK=${COMPOSE_PROJECT_NAME:-off-key}_app-network
      - TACTIC_RADAR_IMAGE=${MQTT_RADAR_IMAGE:-off-key-mqtt-radar:latest}
    restart: always
    healthcheck:
      test:
        - "CMD"
        - "/app/bin/python"
        - "-c"
        - "import urllib.request; urllib.request.urlopen('http://localhost:8000/ready', timeout=2)"
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s
    command: [ "/app/bin/python", "-m", "off_key_tactic_middleware" ]

  mqtt-radar:
    build:
      context: ./backend/
      args:
        SERVICE_NAME: off-key-mqtt-radar
        SERVICE_ROOT: services/mqtt/radar
    image: "${MQTT_RADAR_IMAGE:-off-key-mqtt-radar:latest}"
    container_name: mqtt_radar
    env_file: .env
    command: [ "/app/bin/python", "-m", "off_key_mqtt_radar" ]
    depends_on:
      timescaledb:
        condition: service_healthy
      tactic-middleware:
        condition: service_healthy
      mqtt-proxy:
        condition: service_healthy
    networks:
      - app-network
      - emqx-network
    restart: always
    environment:
      - RADAR_DATABASE_URL=postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB}
    profiles:
      - standalone-radar

  mqtt-proxy:
    build:
      context: ./backend/
      args:
        SERVICE_NAME: off-key-mqtt-proxy
        SERVICE_ROOT: services/mqtt/proxy
    image: "${MQTT_PROXY_IMAGE:-off-key-mqtt-proxy:latest}"
    container_name: mqtt_proxy
    env_file: .env
    command: [ "/app/bin/python", "-m", "off_key_mqtt_proxy" ]
    depends_on:
      timescaledb:
        condition: service_healthy
      emqx-main:
        condition: service_healthy
      source-broker:
        condition: service_started
    networks:
      - app-network
      - emqx-network
    restart: always
    healthcheck:
      test:
        - "CMD"
        - "/app/bin/python"
        - "-c"
        - "import urllib.request; urllib.request.urlopen('http://localhost:8010/ready/bridge', timeout=2)"
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s
    environment:
      - SERVICE_TYPE=mqtt_proxy
      - MQTT_TELEMETRY_ENABLED=true
    volumes:
      - ./logs:/app/logs  # For log persistence

  mqtt-simulator:
    build:
      context: ./backend/
      args:
        SERVICE_NAME: off-key-mqtt-simulator
        SERVICE_ROOT: services/mqtt/simulator
    image: "${MQTT_SIMULATOR_IMAGE:-off-key-mqtt-simulator:latest}"
    container_name: mqtt_simulator
    env_file: .env
    command: [ "/app/bin/python", "-m", "off_key_mqtt_simulator" ]
    depends_on:
      source-broker:
        condition: service_started
      mqtt-proxy:
        condition: service_healthy
    networks:
      - app-network
    restart: unless-stopped
    profiles:
      - mqtt-sim

  db-sync:
    build:
      context: ./backend/
      args:
        SERVICE_ROOT: services/db/sync
        SERVICE_NAME: off-key-db-sync
    image: "${DB_SYNC_IMAGE:-off-key-db-sync:latest}"
    container_name: db_sync
    env_file: .env
    depends_on:
      timescaledb:
        condition: service_healthy
    networks:
      - app-network
    restart: always
    healthcheck:
      test:
        - "CMD"
        - "/app/bin/python"
        - "-c"
        - "import urllib.request; urllib.request.urlopen('http://localhost:8009/ready/schema', timeout=2)"
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s
    command: [ "/app/bin/python", "-m", "off_key_db_sync" ]
    develop:
      watch:
        - action: sync
          path: backend/services/db/sync/src/off_key_db_sync
          target: /app/lib/python3.12/site-packages/off_key_db_sync
        - action: rebuild
          path: ./backend/uv.lock

### =============================================== ###
###            THIRD-PARTY DEPENDENCIES             ###
### =============================================== ###
  timescaledb:
    image: timescale/timescaledb:latest-pg15
    container_name: timescaledb
    env_file: .env
    ports:
      - "${POSTGRES_PORT}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: always
    networks:
      - app-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5

  socket-proxy:
    container_name: socket_proxy
    image: tecnativa/docker-socket-proxy
    restart: always
    networks:
      - socket-network
    privileged: true # true for VM. False for unprivileged LXC container/podman
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    environment:
      - LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg
      ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
      # 0 to revoke access.
      # 1 to grant access.
      ## Granted by Default
      - EVENTS=1
      - PING=1
      - VERSION=1
      ## Revoked by Default
      # Security critical
      - AUTH=0
      - SECRETS=0
      - POST=1 # Container(s) Lifecycle Management
      # Not always needed
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - CONTAINERS=1 # Required by TACTIC RADAR container fallback and cleanup.
      - DISTRIBUTION=0
      - EXEC=0
      - IMAGES=0
      - INFO=1 # Required for Swarm manager detection.
      - NETWORKS=0
      - NODES=0
      - PLUGINS=0
      - SERVICES=1 # Required by TACTIC RADAR Swarm orchestration.
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - TASKS=1 # Required for Swarm service status checks.
      - VOLUMES=0

  mailpit:
    image: axllent/mailpit:latest
    container_name: mailpit
    restart: unless-stopped
    volumes:
      - ./data:/data
    ports:
      - "8025:8025" # Web UI
      - "1025:1025" # SMTP port

    networks:
      - app-network

  emqx-main:
    image: emqx/emqx:6.2.1 # BSL license starting at 5.9!
    hostname: emqx-main
    environment:
      # Local single-node default. See docker-compose.cluster.yml for two-node mode.
      - "EMQX_NODE_NAME=emqx@emqx-main"
      - "EMQX_NODE__COOKIE=${EMQX_NODE_COOKIE:-off-key-emqx-cookie-change-me}"
      - "EMQX_CLUSTER__DISCOVERY_STRATEGY=static"
      - "EMQX_CLUSTER__STATIC__SEEDS=[emqx@emqx-main]"
      # See https://github.com/emqx/emqx/issues/8627#issuecomment-2833234761
      # Only works on fresh boot (no data volume!)
      - "EMQX_DASHBOARD__DEFAULT_USERNAME=${EMQX_DASHBOARD_USERNAME:-admin}"
      - "EMQX_DASHBOARD__DEFAULT_PASSWORD=${EMQX_DASHBOARD_PASSWORD:?EMQX_DASHBOARD_PASSWORD must be set}"
    healthcheck:
      test: [ "CMD", "curl", "-fsS", "http://127.0.0.1:18083/status" ]
      interval: 5s
      timeout: 25s
      retries: 5
    networks:
      - emqx-network
      - app-network
    ports:
      - 1883:1883
      - 8083:8083
      - 8084:8084
      - 8883:8883
      - 18083:18083
    # volumes:
    #   - $PWD/emqx1_data:/opt/emqx/data

  source-broker:
    image: eclipse-mosquitto:2.0
    container_name: source_broker
    command: [ "mosquitto", "-c", "/mosquitto/config/mosquitto.conf" ]
    volumes:
      - ./dev/mosquitto/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
    ports:
      - "127.0.0.1:1884:1883"
    networks:
      app-network:
        aliases:
          - source-broker
    restart: unless-stopped

  memcached:
    image: memcached:latest
    ports:
      - "11211:11211"
    networks:
      - app-network

  mcrouter:
    image: ghcr.io/mszabo-wikia/mcrouter-debian-bookworm:20250621-a099b76
    environment:
      - MC_LOCAL=memcached
      - MC_SERVICE=memcached
    ports:
      - "11210:11211"
    volumes:
      - "./backend/services/cache/mcrouter/config.json:/usr/local/mcrouter/config/config.json.template"
    command:
      - /bin/bash
      - -c
      - |
        sed "s|\$${MC_LOCAL}|$${MC_LOCAL}|g" /usr/local/mcrouter/config/config.json.template | \
        sed "s|\$${MC_SERVICE}|$${MC_SERVICE}|g" > /usr/local/mcrouter/config/config.json && \
        /usr/bin/mcrouter --config-file=/usr/local/mcrouter/config/config.json \
        -p 11211 \
        --num-proxies=1 \
        --stats-logging-interval=0 \
        --asynclog-disable \
        --probe-timeout-initial=1000 \
        --probe-timeout-max=15000 \
        --reset-inactive-connection-interval=900000 \
        --keepalive-count=6 \
        --keepalive-interval=4 \
        --keepalive-idle=30 \
        --timeouts-until-tko=6
    depends_on:
      - memcached
    networks:
      - app-network

networks:
  app-network:
    driver: bridge
  socket-network:
    driver: bridge
  emqx-network:
    driver: bridge

volumes:
  postgres_data:
  vite_cache:
    driver: local
  frontend_node_modules: