docker-compose.yml

###############################################################
# docker-compose.yml — SaaS eCommerce Platform (Phase 2)
# Services: 10 Spring Boot apps + full infrastructure
#
# Ports (external access):
#   8888 config-service    8761 discovery-service
#   8222 gateway           8085 authentication-service
#   8090 customer-service  8082 product-service
#   8083 order-service     8086 payment-service
#   8091 cart-service      8040 notification-service
#   8095 tenant-service
#
# Infrastructure (internal only — no external ports):
#   Kafka, Zookeeper, Redis, PostgreSQL x5, MongoDB, Vault
#
# Observability:
#   9090 Prometheus  3000 Grafana  9411 Zipkin  8025 MailHog
#   8200 Vault UI (dev only — remove in production)
#
# Networks:
#   infra-net     → databases, kafka, redis, vault (internal)
#   services-net  → Spring Boot services + config + discovery
#   monitoring-net→ prometheus, grafana, zipkin
###############################################################

services:

  # ============================================================
  # INFRASTRUCTURE — Secrets Management
  # ============================================================

  vault:
    image: hashicorp/vault:1.16
    container_name: vault
    ports:
      - "8200:8200"   # UI + API — restrict access in production
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: ${VAULT_TOKEN:-root-token}
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
    cap_add:
      - IPC_LOCK
    volumes:
      - vault-data:/vault/data
      - ./vault/config:/vault/config:ro
      - ./vault/policies:/vault/policies:ro
    command: [ "vault", "server", "-dev" ]
    # Production: use -config=/vault/config/vault.hcl instead of -dev
    networks: [ infra-net, services-net ]
    healthcheck:
      test: [ "CMD-SHELL", "VAULT_ADDR=http://127.0.0.1:8200 vault status 2>/dev/null | grep -q 'Initialized'" ]
      interval: 10s
      timeout: 5s
      retries: 8
      start_period: 15s

  # ============================================================
  # INFRASTRUCTURE — Message Bus
  # ============================================================

  kafka:
    image: confluentinc/cp-kafka:7.6.1
    container_name: kafka
    # Port 9092 exposed for local dev tools (Kafka UI, kafka-cli)
    # Remove in production — services communicate via infra-net on port 29092
    ports:
      - "9092:9092"
    environment:
      CLUSTER_ID: "MkU3OEVBNTcwNTJENDM2Qk"
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: "broker,controller"
      KAFKA_CONTROLLER_QUORUM_VOTERS: "1@kafka:29093"
      KAFKA_CONTROLLER_LISTENER_NAMES: "CONTROLLER"
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT
      KAFKA_LISTENERS: PLAINTEXT://0.0.0.0:29092,CONTROLLER://0.0.0.0:29093,PLAINTEXT_HOST://0.0.0.0:9092
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:29092,PLAINTEXT_HOST://localhost:9092
      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
    networks: [ infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "bash -c '</dev/tcp/localhost/9092' 2>/dev/null && exit 0 || exit 1" ]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 30s

  # ============================================================
  # INFRASTRUCTURE — Cache + Rate Limiting
  # ============================================================

  redis:
    image: redis:7.2-alpine
    container_name: redis
    # No external port in production — internal only
    # Keeping for local dev access; remove port binding in production
    ports:
      - "6379:6379"
    command: >
      redis-server
      --maxmemory 512mb
      --maxmemory-policy allkeys-lru
      --save 60 1
      --loglevel warning
      --requirepass ${REDIS_PASSWORD:-redis-secret-2024}
    volumes:
      - redis-data:/data
    networks: [ infra-net, services-net ]
    healthcheck:
      test: [ "CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-redis-secret-2024}", "ping" ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  # ============================================================
  # INFRASTRUCTURE — Databases (one per service, internal only)
  # ============================================================

  postgres-order:
    image: postgres:16-alpine
    container_name: postgres-order
    environment:
      POSTGRES_DB: order_service_db
      POSTGRES_USER: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
    # No external port — internal only. Access via: docker exec postgres-order psql
    volumes:
      - postgres-order-data:/var/lib/postgresql/data
    networks: [ infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USERNAME:-vanilson} -d order_service_db" ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  postgres-product:
    image: postgres:16-alpine
    container_name: postgres-product
    environment:
      POSTGRES_DB: product_service_db
      POSTGRES_USER: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
    volumes:
      - postgres-product-data:/var/lib/postgresql/data
    networks: [ infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USERNAME:-vanilson} -d product_service_db" ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  postgres-payment:
    image: postgres:16-alpine
    container_name: postgres-payment
    environment:
      POSTGRES_DB: payment_db
      POSTGRES_USER: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
    volumes:
      - postgres-payment-data:/var/lib/postgresql/data
    networks: [ infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USERNAME:-vanilson} -d payment_db" ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  postgres-auth:
    image: postgres:16-alpine
    container_name: postgres-auth
    environment:
      POSTGRES_DB: auth_db
      POSTGRES_USER: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
    volumes:
      - postgres-auth-data:/var/lib/postgresql/data
    networks: [ infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USERNAME:-vanilson} -d auth_db" ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  postgres-tenant:
    image: postgres:16-alpine
    container_name: postgres-tenant
    environment:
      POSTGRES_DB: tenant_db
      POSTGRES_USER: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
    volumes:
      - postgres-tenant-data:/var/lib/postgresql/data
    networks: [ infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USERNAME:-vanilson} -d tenant_db" ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  mongodb:
    image: mongo:7.0
    container_name: mongodb
    # No external port — internal only
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_USERNAME:-vanilson}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD:-vanilson}
    volumes:
      - mongodb-data:/data/db
      - ./mongo-init.js:/docker-entrypoint-initdb.d/mongo-init.js:ro
    networks: [ infra-net ]
    healthcheck:
      test: [ "CMD", "mongosh", "--quiet", "-u", "${MONGO_USERNAME:-vanilson}", "-p", "${MONGO_PASSWORD:-vanilson}", "--eval", "db.adminCommand('ping').ok" ]
      interval: 15s
      timeout: 15s
      retries: 10
      start_period: 30s

  # ============================================================
  # INFRASTRUCTURE — Observability
  # ============================================================

  zipkin:
    image: openzipkin/zipkin:3
    container_name: zipkin
    ports:
      - "9411:9411"
    networks: [ monitoring-net, services-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -qO- http://localhost:9411/health > /dev/null || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 30s

  prometheus:
    image: prom/prometheus:v2.51.2
    container_name: prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./config-service/src/main/resources/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./config-service/src/main/resources/prometheus/alert.rules.yml:/etc/prometheus/alert.rules.yml:ro
      - prometheus-data:/prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=15d"
      - "--web.enable-lifecycle"
    networks: [ monitoring-net, services-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -qO- http://localhost:9090/-/healthy | grep -q Prometheus" ]
      interval: 15s
      timeout: 5s
      retries: 5

  alertmanager:
    image: prom/alertmanager:v0.27.0
    container_name: alertmanager
    ports:
      - "9093:9093"
    volumes:
      - ./alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - alertmanager-data:/alertmanager
    command:
      - "--config.file=/etc/alertmanager/alertmanager.yml"
      - "--storage.path=/alertmanager"
    networks: [ monitoring-net, services-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -qO- http://localhost:9093/-/healthy || exit 1" ]
      interval: 15s
      timeout: 5s
      retries: 5

  loki:
    image: grafana/loki:2.9.8
    container_name: loki
    user: "0"
    ports:
      - "3100:3100"
    volumes:
      - ./loki/loki-config.yml:/etc/loki/loki-config.yml:ro
      - loki-data:/tmp/loki
    command: -config.file=/etc/loki/loki-config.yml
    networks: [ monitoring-net, services-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -qO- http://localhost:3100/ready || exit 1" ]
      interval: 15s
      timeout: 5s
      retries: 5

  promtail:
    image: grafana/promtail:2.9.8
    container_name: promtail
    volumes:
      - ./promtail/promtail-config.yml:/etc/promtail/promtail-config.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command: -config.file=/etc/promtail/promtail-config.yml
    depends_on:
      - loki
    networks: [ monitoring-net, services-net ]

  grafana:
    image: grafana/grafana:10.4.2
    container_name: grafana
    ports:
      - "3000:3000"
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-Gr@fana#Secure2024}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      GF_SECURITY_DISABLE_GRAVATAR: "true"
      GF_PATHS_PROVISIONING: /etc/grafana/provisioning
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
    depends_on:
      - prometheus
      - loki
    networks: [ monitoring-net ]

  mailhog:
    image: mailhog/mailhog:v1.0.1
    container_name: mailhog
    ports:
      - "1025:1025"
      - "8025:8025"
    networks: [ services-net ]

  # ============================================================
  # SPRING CLOUD INFRASTRUCTURE
  # ============================================================

  config-service:
    build:
      context: .
      dockerfile: config-service/Dockerfile
    container_name: config-service
    ports:
      - "8888:8888"
    environment:
      JAVA_TOOL_OPTIONS: "-Xms64m -Xmx256m -XX:MaxMetaspaceSize=96m -XX:+UseSerialGC"
      SPRING_PROFILES_ACTIVE: native
      CONFIG_SERVER_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      SPRING_CLOUD_CONFIG_SERVER_NATIVE_SEARCHLOCATIONS: "file:/app/configurations"
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_PORT: ${VAULT_PORT:-8200}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
      - ./config-service/src/main/resources/configurations:/app/configurations:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8888/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 15
      start_period: 60s
    restart: on-failure

  discovery-service:
    build:
      context: .
      dockerfile: discovery-service/Dockerfile
    container_name: discovery-service
    ports:
      - "8761:8761"
    depends_on:
      config-service:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms64m -Xmx256m -XX:MaxMetaspaceSize=96m -XX:+UseSerialGC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -qO- 'http://eureka:eureka-secret-2024@localhost:8761/actuator/health' | grep -q '\"status\":\"UP\"' || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 12
      start_period: 90s
    restart: on-failure

  # ============================================================
  # APPLICATION SERVICES
  # ============================================================

  gateway-api-service:
    build:
      context: .
      dockerfile: gateway-api-service/Dockerfile
    container_name: gateway-api-service
    ports:
      - "8222:8222"
    depends_on:
      config-service:
        condition: service_healthy
      discovery-service:
        condition: service_healthy
      redis:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms128m -Xmx512m -XX:MaxMetaspaceSize=192m -XX:+UseSerialGC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis-secret-2024}
      # Disable Sentinel — use standalone Redis
      SPRING_DATA_REDIS_HOST: redis
      SPRING_DATA_REDIS_PORT: 6379
      SPRING_DATA_REDIS_PASSWORD: ${REDIS_PASSWORD:-redis-secret-2024}
      JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
      GATEWAY_MAX_CONCURRENT: 5000
      GATEWAY_TENANT_SERVICE_BASE_URL: http://tenant-service:8095
      GATEWAY_PUBLIC_PATHS: /api/v1/auth/**,/actuator/**,/fallback/**,/api/v1/products,/api/v1/products/**
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8222/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 90s
    restart: on-failure

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    container_name: frontend
    ports:
      - "80:80"
    depends_on:
      gateway-api-service:
        condition: service_started
    networks: [ services-net ]
    restart: unless-stopped

  authentication-service:
    build:
      context: .
      dockerfile: authentication-service/Dockerfile
    container_name: authentication-service
    ports:
      - "8085:8085"
    depends_on:
      config-service:
        condition: service_healthy
      postgres-auth:
        condition: service_healthy
      discovery-service:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms128m -Xmx512m -XX:MaxMetaspaceSize=192m -XX:+UseSerialGC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      POSTGRES_HOST: postgres-auth
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
      JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
      APP_ADMIN_EMAIL: ${APP_ADMIN_EMAIL:-admin@obsidian.com}
      APP_ADMIN_PASSWORD: ${APP_ADMIN_PASSWORD:-Admin@123!}
      APP_ADMIN_TENANT_ID: ${APP_ADMIN_TENANT_ID:-system}
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8085/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 60s
    restart: on-failure

  tenant-service:
    build:
      context: .
      dockerfile: tenant-service/Dockerfile
    container_name: tenant-service
    ports:
      - "8095:8095"
    depends_on:
      config-service:
        condition: service_healthy
      postgres-tenant:
        condition: service_healthy
      discovery-service:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms128m -Xmx384m -XX:MaxMetaspaceSize=192m -XX:+UseG1GC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      POSTGRES_HOST: postgres-tenant
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
      JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8095/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 60s
    restart: on-failure

  customer-service:
    build:
      context: .
      dockerfile: customer-service/Dockerfile
    container_name: customer-service
    ports:
      - "8090:8090"
    depends_on:
      config-service:
        condition: service_healthy
      discovery-service:
        condition: service_healthy
      mongodb:
        condition: service_healthy
      redis:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms64m -Xmx256m -XX:MaxMetaspaceSize=96m -XX:+UseSerialGC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      MONGO_HOST: mongodb
      MONGO_USERNAME: ${MONGO_USERNAME:-vanilson}
      MONGO_PASSWORD: ${MONGO_PASSWORD:-vanilson}
      REDIS_HOST: redis
      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis-secret-2024}
      JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8090/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 60s
    restart: on-failure

  product-service:
    build:
      context: .
      dockerfile: product-service/Dockerfile
    container_name: product-service
    ports:
      - "8082:8082"
    depends_on:
      config-service:
        condition: service_healthy
      discovery-service:
        condition: service_healthy
      postgres-product:
        condition: service_healthy
      kafka:
        condition: service_healthy
      redis:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms128m -Xmx512m -XX:MaxMetaspaceSize=192m -XX:+UseSerialGC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      POSTGRES_HOST: postgres-product
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
      REDIS_HOST: redis
      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis-secret-2024}
      KAFKA_BOOTSTRAP_SERVERS: kafka:29092
      KAFKA_USERNAME: ${KAFKA_USERNAME:-kafka}
      KAFKA_PASSWORD: ${KAFKA_PASSWORD:-kafka-secret}
      JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8082/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 60s
    restart: on-failure

  order-service:
    build:
      context: .
      dockerfile: order-service/Dockerfile
    container_name: order-service
    ports:
      - "8083:8083"
    depends_on:
      config-service:
        condition: service_healthy
      discovery-service:
        condition: service_healthy
      postgres-order:
        condition: service_healthy
      kafka:
        condition: service_healthy
      redis:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms128m -Xmx512m -XX:MaxMetaspaceSize=192m -XX:+UseSerialGC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      POSTGRES_HOST: postgres-order
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
      KAFKA_BOOTSTRAP_SERVERS: kafka:29092
      KAFKA_USERNAME: ${KAFKA_USERNAME:-kafka}
      KAFKA_PASSWORD: ${KAFKA_PASSWORD:-kafka-secret}
      GATEWAY_HOST: gateway-api-service
      JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8083/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 60s
    restart: on-failure

  payment-service:
    build:
      context: .
      dockerfile: payment-service/Dockerfile
    container_name: payment-service
    ports:
      - "8086:8086"
    depends_on:
      config-service:
        condition: service_healthy
      discovery-service:
        condition: service_healthy
      postgres-payment:
        condition: service_healthy
      kafka:
        condition: service_healthy
      redis:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms128m -Xmx512m -XX:MaxMetaspaceSize=192m -XX:+UseSerialGC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      POSTGRES_HOST: postgres-payment
      POSTGRES_USERNAME: ${POSTGRES_USERNAME:-vanilson}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vanilson}
      KAFKA_BOOTSTRAP_SERVERS: kafka:29092
      KAFKA_USERNAME: ${KAFKA_USERNAME:-kafka}
      KAFKA_PASSWORD: ${KAFKA_PASSWORD:-kafka-secret}
      JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8086/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 60s
    restart: on-failure

  cart-service:
    build:
      context: .
      dockerfile: cart-service/Dockerfile
    container_name: cart-service
    ports:
      - "8091:8091"
    depends_on:
      config-service:
        condition: service_healthy
      redis:
        condition: service_healthy
      discovery-service:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms64m -Xmx256m -XX:MaxMetaspaceSize=96m -XX:+UseSerialGC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis-secret-2024}
      # Disable Sentinel — use standalone Redis
      SPRING_DATA_REDIS_HOST: redis
      SPRING_DATA_REDIS_PORT: 6379
      SPRING_DATA_REDIS_PASSWORD: ${REDIS_PASSWORD:-redis-secret-2024}
      JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8091/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 60s
    restart: on-failure

  notification-service:
    build:
      context: .
      dockerfile: notification-service/Dockerfile
    container_name: notification-service
    ports:
      - "8040:8040"
    depends_on:
      config-service:
        condition: service_healthy
      discovery-service:
        condition: service_healthy
      mongodb:
        condition: service_healthy
      kafka:
        condition: service_healthy
      mailhog:
        condition: service_started
      redis:
        condition: service_healthy
      zipkin:
        condition: service_started
    environment:
      JAVA_TOOL_OPTIONS: "-Xms64m -Xmx256m -XX:MaxMetaspaceSize=96m -XX:+UseSerialGC"
      SPRING_CONFIG_IMPORT: optional:configserver:http://config-service:8888
      SPRING_CLOUD_CONFIG_USERNAME: config
      SPRING_CLOUD_CONFIG_PASSWORD: ${CONFIG_SERVER_PASSWORD:-config-secret-2024}
      EUREKA_HOST: discovery-service
      EUREKA_USERNAME: ${EUREKA_USERNAME:-eureka}
      EUREKA_PASSWORD: ${EUREKA_PASSWORD:-eureka-secret-2024}
      MONGO_HOST: mongodb
      MONGO_USERNAME: ${MONGO_USERNAME:-vanilson}
      MONGO_PASSWORD: ${MONGO_PASSWORD:-vanilson}
      KAFKA_BOOTSTRAP_SERVERS: kafka:29092
      KAFKA_USERNAME: ${KAFKA_USERNAME:-kafka}
      KAFKA_PASSWORD: ${KAFKA_PASSWORD:-kafka-secret}
      MAIL_HOST: mailhog
      MAIL_PORT: 1025
      MAIL_USERNAME: noreply@vanilsonshop.io
      MAIL_PASSWORD: unused
      MAIL_SMTP_AUTH: "false"
      MAIL_SMTP_STARTTLS_ENABLE: "false"
      MAIL_SMTP_STARTTLS_REQUIRED: "false"
      VAULT_ENABLED: ${VAULT_ENABLED:-false}
      VAULT_HOST: ${VAULT_HOST:-vault}
      VAULT_TOKEN: ${VAULT_TOKEN:-root-token}
      ZIPKIN_ENDPOINT: http://zipkin:9411/api/v2/spans
      LOGGING_CONFIG: /app/logback-spring.xml
    volumes:
      - ./logback-spring.xml:/app/logback-spring.xml:ro
    networks: [ services-net, infra-net ]
    healthcheck:
      test: [ "CMD-SHELL", "wget -q --spider http://localhost:8040/actuator/health || exit 1" ]
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 60s
    restart: on-failure

# ============================================================
# NETWORKS — Segmented for security
# ============================================================
networks:
  # Internal infrastructure: databases, kafka, redis, vault, mongodb
  # No external access; only services that explicitly need infra are connected
  infra-net:
    driver: bridge
    internal: false   # Set to true in production (breaks DNS for external-facing needs)

  # Application network: Spring Boot services communicate here
  services-net:
    driver: bridge

  # Monitoring network: Prometheus, Grafana, Zipkin
  monitoring-net:
    driver: bridge

# ============================================================
# VOLUMES
# ============================================================
volumes:
  vault-data:
  redis-data:
  postgres-order-data:
  postgres-product-data:
  postgres-payment-data:
  postgres-auth-data:
  postgres-tenant-data:
  mongodb-data:
  prometheus-data:
  alertmanager-data:
  loki-data:
  grafana-data: