docker-compose.yml

# Minimal MVP stack: db, cache, broker, ingestor, dashboard
# Network model: All services (including cloud emulator) share `api-obs` network
# for inter-service communication (e.g., ingestor → db, ingestor → cache).
# Host access: All services expose ports to 127.0.0.1 or 0.0.0.0 for local development.

services:
  db:
    build:
      context: ./infra/database
      dockerfile: Dockerfile
    container_name: api-obs-db
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: api_observatory
    ports:
      - '5432:5432'
    volumes:
      - ./infra/database/postgresql.conf:/etc/postgresql/postgresql.conf:ro
      - ./infra/database/pg_hba.conf:/etc/postgresql/pg_hba.conf:ro
      - ./infra/database/init.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
    command: ["postgres", "-c", "config_file=/etc/postgresql/postgresql.conf", "-c", "hba_file=/etc/postgresql/pg_hba.conf"]
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    security_opt: [no-new-privileges:true]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
      resources:
        reservations:
          cpus: '0.5'
          memory: '512M'
        limits:
          cpus: '1.0'
          memory: '1G'
    networks:
      - api-obs

  cache:
    image: redis:7-alpine
    container_name: api-obs-cache
    # Local host port exposed on loopback only — ingestor connects via Docker internal network at redis://cache:6379
    ports:
      - "127.0.0.1:6379:6379"
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:-cache_secret}
    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD:-cache_secret}"]
    healthcheck:
      test: ['CMD', 'redis-cli', '-a', '${REDIS_PASSWORD:-cache_secret}', 'ping']
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    security_opt: [no-new-privileges:true]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      resources:
        reservations:
          cpus: '0.1'
          memory: '128M'
        limits:
          cpus: '0.25'
          memory: '256M'
    networks:
      - api-obs

  broker:
    image: redpandadata/redpanda:v24.1.1
    container_name: api-obs-broker
    command:
      - redpanda
      - start
      - --smp 1
      - --overprovisioned
      - --kafka-addr internal://0.0.0.0:29092,external://0.0.0.0:9092
      - --advertise-kafka-addr internal://broker:29092,external://localhost:9092
      - --pandaproxy-addr 0.0.0.0:8082
      - --advertise-pandaproxy-addr localhost:8082
    ports:
      - '9092:9092'
      - '8082:8082'
    healthcheck:
      test: ["CMD-SHELL", "rpk cluster health | grep -E 'Healthy:.+true' || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      resources:
        reservations:
          cpus: '0.25'
          memory: '256M'
        limits:
          cpus: '0.5'
          memory: '512M'
    networks:
      - api-obs

  ingestor:
    build:
      context: .
    container_name: api-obs-ingestor
    env_file: .env
    environment:
      DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@db:5432/api_observatory
      BROKER_URL: broker:29092
      CACHE_URL: redis://:${REDIS_PASSWORD:-cache_secret}@cache:6379/0
      INFERENCE_URL: http://inference:8001
      LOG_FORMAT: json
      SERVICE_VERSION: ${SERVICE_VERSION:-0.1.0}
    ports:
      - '8000:8000'
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_healthy
      broker:
        condition: service_healthy
    healthcheck:
      test: ['CMD', 'python', '-c', 'import urllib.request; urllib.request.urlopen("http://127.0.0.1:8000/readyz", timeout=3)']
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
      resources:
        reservations:
          cpus: '0.25'
          memory: '256M'
        limits:
          cpus: '0.5'
          memory: '512M'
    networks:
      - api-obs

  inference-db:
    build:
      context: ./infra/database
      dockerfile: Dockerfile
    container_name: api-obs-inference-db
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${INFERENCE_DB_PASSWORD:-postgres}
      POSTGRES_DB: inference
    ports:
      - '5433:5432'
    volumes:
      - ./infra/database/postgresql.conf:/etc/postgresql/postgresql.conf:ro
      - ./infra/database/pg_hba.conf:/etc/postgresql/pg_hba.conf:ro
      - ./infra/database/init.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
    command: ["postgres", "-c", "config_file=/etc/postgresql/postgresql.conf", "-c", "hba_file=/etc/postgresql/pg_hba.conf"]
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    security_opt: [no-new-privileges:true]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
      resources:
        reservations:
          cpus: '0.1'
          memory: '128M'
        limits:
          cpus: '0.25'
          memory: '256M'
    networks:
      - api-obs

  inference:
    build:
      context: .
      dockerfile: services/inference/Dockerfile
    container_name: api-obs-inference
    environment:
      DATABASE_URL: postgresql+asyncpg://postgres:${INFERENCE_DB_PASSWORD:-postgres}@inference-db:5432/inference
    ports:
      - '8001:8001'
    depends_on:
      inference-db:
        condition: service_healthy
    healthcheck:
      test: ['CMD', 'python', '-c', 'import urllib.request; urllib.request.urlopen("http://127.0.0.1:8001/health", timeout=3)']
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 15s
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
      resources:
        reservations:
          cpus: '0.25'
          memory: '384M'
        limits:
          cpus: '0.5'
          memory: '768M'
    networks:
      - api-obs

  dashboard:
    build:
      context: .
      dockerfile: services/dashboard/Dockerfile
    container_name: api-obs-dashboard
    environment:
      INGESTOR_URL: http://ingestor:8000
    ports:
      - '8501:8501'
    depends_on:
      ingestor:
        condition: service_healthy
    security_opt: [no-new-privileges:true]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      resources:
        reservations:
          cpus: '0.1'
          memory: '128M'
        limits:
          cpus: '0.25'
          memory: '256M'
    networks:
      - api-obs

  edge:
    image: nginx:1.27-alpine
    container_name: api-obs-edge
    profiles: [ingress]
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - ./infra/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./infra/certs:/etc/nginx/certs:ro
    depends_on:
      ingestor:
        condition: service_healthy
      dashboard:
        condition: service_healthy
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://127.0.0.1:80/edge-status']
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    security_opt: [no-new-privileges:true]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      resources:
        reservations:
          cpus: '0.1'
          memory: '64M'
        limits:
          cpus: '0.25'
          memory: '128M'
    networks:
      - api-obs

  trivy:
    image: aquasec/trivy:0.56.2
    container_name: api-obs-trivy
    profiles: [security]
    entrypoint: ["trivy"]
    command: ["--help"]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./.local-dev/tmp/trivy-cache:/root/.cache/trivy
    security_opt: [no-new-privileges:true]
    networks:
      - api-obs

  checkov:
    image: bridgecrew/checkov:3.2.360
    container_name: api-obs-checkov
    profiles: [security]
    entrypoint: ["checkov"]
    command: ["--help"]
    working_dir: /repo
    volumes:
      - .:/repo
    security_opt: [no-new-privileges:true]

  gitleaks:
    image: ghcr.io/gitleaks/gitleaks:v8.21.2
    container_name: api-obs-gitleaks
    profiles: [security]
    entrypoint: ["gitleaks"]
    command: ["--help"]
    working_dir: /repo
    volumes:
      - .:/repo
    security_opt: [no-new-privileges:true]

  hadolint:
    image: hadolint/hadolint:v2.12.0
    container_name: api-obs-hadolint
    profiles: [security]
    entrypoint: ["hadolint"]
    command: ["--help"]
    working_dir: /repo
    volumes:
      - .:/repo
    security_opt: [no-new-privileges:true]

  # ── Monitoring (optional; started via: just up-monitoring) ────────────────

  prometheus:
    image: prom/prometheus:v3.2.1
    profiles: [monitoring]
    container_name: api-obs-prometheus
    volumes:
      - ./infra/monitoring/prometheus.local.yml:/etc/prometheus/prometheus.yml:ro
      - ./infra/monitoring/rules/alert.local.rules.yml:/etc/prometheus/rules/alert.rules.yml:ro
    ports:
      - '127.0.0.1:9090:9090'
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
      - '--web.enable-lifecycle'
    security_opt: [no-new-privileges:true]
    networks:
      - api-obs

  grafana:
    image: grafana/grafana:11.5.2
    profiles: [monitoring]
    container_name: api-obs-grafana
    volumes:
      - ./infra/monitoring/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
      - ./infra/monitoring/grafana/provisioning/dashboards/dashboards.yml:/etc/grafana/provisioning/dashboards/dashboards.yml:ro
      - ./infra/monitoring/grafana/dashboards:/etc/grafana/dashboards:ro
    ports:
      - '127.0.0.1:3000:3000'
    environment:
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Admin
    security_opt: [no-new-privileges:true]
    networks:
      - api-obs

  loki:
    image: grafana/loki:3.4.2
    profiles: [monitoring]
    container_name: api-obs-loki
    ports:
      - '127.0.0.1:3100:3100'
    command: ['-config.file=/etc/loki/local-config.yaml']
    security_opt: [no-new-privileges:true]
    networks:
      - api-obs

  promtail:
    image: grafana/promtail:3.4.2
    profiles: [monitoring]
    container_name: api-obs-promtail
    volumes:
      - ./infra/monitoring/promtail.yml:/etc/promtail/promtail.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock
    command: ['-config.file=/etc/promtail/promtail.yml']
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    networks:
      - api-obs

  alertmanager:
    image: prom/alertmanager:v0.28.1
    profiles: [monitoring]
    container_name: api-obs-alertmanager
    volumes:
      - ./infra/monitoring/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
    ports:
      - '127.0.0.1:9093:9093'
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
    security_opt: [no-new-privileges:true]
    networks:
      - api-obs

  mailpit:
    image: axllent/mailpit:v1.24
    profiles: [monitoring]
    container_name: api-obs-mailpit
    ports:
      - '127.0.0.1:8025:8025'
    security_opt: [no-new-privileges:true]
    networks:
      - api-obs

  # ── Cloud Emulators (optional; started via: just sandbox-up CLOUD=azure|aws|gcp)

  # Floci-gcp — GCP emulator (wire-compatible with Google Cloud SDKs and gcloud CLI).
  # Emulates: Cloud Storage, Pub/Sub, Firestore, Datastore, Secret Manager, IAM,
  # Managed Kafka, Cloud Tasks, Cloud Run, Cloud SQL, Cloud Functions, Cloud KMS,
  # Cloud Logging, Cloud Monitoring, Cloud Scheduler, GKE, and Operations.
  floci-gcp:
    image: floci/floci-gcp:latest
    container_name: api-obs-floci-gcp
    profiles: [gcp]
    ports:
      - '127.0.0.1:4588:4588'
    environment:
      CLOUDSDK_CORE_PROJECT: ${GCP_PROJECT_ID:-floci-local}
    volumes:
      - ./.local-dev/tmp/floci-gcp-data:/tmp/floci-gcp
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:4588/health']
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 15s
    security_opt: [no-new-privileges:true]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      resources:
        reservations:
          cpus: '0.1'
          memory: '128M'
        limits:
          cpus: '0.5'
          memory: '512M'
    networks:
      - api-obs

  # Floci-aws — AWS emulator (wire-compatible with AWS SDKs and CLI).
  # Emulates: S3, EC2, IAM, STS, SQS, SNS, DynamoDB, Lambda, RDS, ECS,
  # CloudWatch, Secrets Manager, SSM, CloudFormation, Route 53, and more.
  floci-aws:
    image: floci/floci-aws:latest
    container_name: api-obs-floci-aws
    profiles: [aws]
    ports:
      - '127.0.0.1:4566:4566'
    environment:
      AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION:-eu-central-1}
    volumes:
      - ./.local-dev/tmp/floci-aws-data:/tmp/floci-aws
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:4566/health']
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 15s
    security_opt: [no-new-privileges:true]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      resources:
        reservations:
          cpus: '0.1'
          memory: '128M'
        limits:
          cpus: '0.5'
          memory: '512M'
    networks:
      - api-obs

  # Floci-az — Azure emulator (wire-compatible with Azure SDKs and Azurite).
  # Emulates: Blob Storage, Queue Storage, Table Storage, Key Vault, Event Hubs,
  # Service Bus, Cosmos DB, AKS, Azure SQL, Container Registry, Cache for Redis,
  # App Configuration, Azure Monitor, Entra ID, Container Apps, and more.
  floci-az:
    image: floci/floci-az:latest
    container_name: api-obs-floci-az
    profiles: [azure]
    ports:
      - '127.0.0.1:4577:4577'
      - '127.0.0.1:5672:5672'
      - '127.0.0.1:5673:5673'
    environment:
      AZURE_REGION: ${AZURE_REGION:-polandcentral}
    volumes:
      - ./.local-dev/tmp/floci-az-data:/tmp/floci-az
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:4577/health']
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 10s
    security_opt: [no-new-privileges:true]
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      resources:
        reservations:
          cpus: '0.1'
          memory: '128M'
        limits:
          cpus: '0.5'
          memory: '512M'
    networks:
      - api-obs

# ─── NETWORK ────────────────────────────────────────────────────────────────
# All services (microservices + infrastructure emulators) share this network
# for inter-container communication.
#
# Services on `api-obs`:
#   - db (PostgreSQL)
#   - cache
#   - broker (message broker)
#   - ingestor (FastAPI microservice)
#   - edge (HTTPS ingress proxy, started by default with `just up`)
#   - prometheus, grafana, loki, promtail, alertmanager, mailpit (monitoring, optional via `just up-monitoring`)
#   - floci-az (Azure emulator, optional via --profile azure)
#   - floci-aws (AWS emulator, optional via --profile aws)
#   - floci-gcp (GCP emulator, optional via --profile gcp)
#
# Host access:
#   - edge:80, 443 → localhost:80, 443 — primary entrypoint (HTTPS via nginx)
#   - ingestor:8000 → localhost:8000 — direct HTTP (debug only, not prod-like)
#   - dashboard:8501 → localhost:8501 — direct HTTP (debug only, not prod-like)
#   - db:5432 → localhost:5432
#   - cache:6379 → localhost:6379 (loopback only; ingestor connects via Docker network at redis://cache:6379)
#   - broker:9092 (Kafka), 8082 (HTTP) → localhost:9092, 8082
#   - floci-az:4577 → 127.0.0.1:4577 (local only)
networks:
  api-obs:
    driver: bridge