docker-compose.yml

services:
  # Authentication & Identity Management

  # PostgreSQL for Keycloak shared database
  postgres:
    image: postgres:15.3-alpine
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-keycloak}
      # Security hardening
      POSTGRES_HOST_AUTH_METHOD: md5
      POSTGRES_INITDB_ARGS: "--auth-host=md5 --auth-local=md5"
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./auth/postgres-init.sql:/docker-entrypoint-initdb.d/init.sql:ro
      - ssl-certs:/certs:ro
    ports:
      - "127.0.0.1:5432:5432"  # Bind to localhost only
    networks:
      internal:
        aliases:
          - postgres
      backend:
        aliases:
          - postgres
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1'
        reservations:
          memory: 256M
          cpus: '0.5'
    # Security: Run as non-root user
    user: postgres

  # Infinispan for distributed caching
  # infinispan:
  #   image: infinispan/server:14.0.21.Final
  #   user: "1000:1000"
  #   environment:
  #     USER: admin
  #     PASS: admin
  #   ports:
  #     - "11222:11222"
  #   volumes:
  #     - infinispan-data:/opt/infinispan/server/data
  #   networks:
  #     backend:
  #       aliases:
  #         - infinispan
  #   healthcheck:
  #     test: ["CMD", "curl", "-f", "http://localhost:11222/rest/v2/cache-managers"]
  #     interval: 30s
  #     timeout: 10s
  #     retries: 3

  # Keycloak instances (horizontally scalable)
  keycloak-1:
    image: quay.io/keycloak/keycloak:22.0.1
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
      KC_HOSTNAME_STRICT: false
      KC_HOSTNAME_STRICT_HTTPS: false
      KC_HTTP_ENABLED: true
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_PROXY: edge
      KC_HOSTNAME_URL: https://localhost:8443
      KC_HOSTNAME_ADMIN_URL: https://localhost:8443
      KC_SPI_TRUSTSTORE_FILE_FILE: ""
      KC_SPI_TRUSTSTORE_FILE_PASSWORD: ""
    ports:
      - "8090:8080"
    volumes:
      - ./auth/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
    command: ["start", "--import-realm"]
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      backend:
        aliases:
          - keycloak-1
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/realms/master || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '2'
        reservations:
          memory: 512M
          cpus: '1'

  keycloak-2:
    image: quay.io/keycloak/keycloak:22.0.1
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
      KC_HOSTNAME_STRICT: false
      KC_HOSTNAME_STRICT_HTTPS: false
      KC_HTTP_ENABLED: true
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_PROXY: edge
      KC_HOSTNAME_URL: https://localhost:8443
      KC_HOSTNAME_ADMIN_URL: https://localhost:8443
      KC_SPI_TRUSTSTORE_FILE_FILE: ""
      KC_SPI_TRUSTSTORE_FILE_PASSWORD: ""
    ports:
      - "8091:8080"
    command: ["start"]
    depends_on:
      postgres:
        condition: service_healthy
      keycloak-1:
        condition: service_started
    networks:
      backend:
        aliases:
          - keycloak-2
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/realms/master || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '2'
        reservations:
          memory: 512M
          cpus: '1'

  # Prometheus for monitoring
  prometheus:
    image: prom/prometheus:v2.45.0
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./monitoring/alert-rules.yml:/etc/prometheus/alert-rules.yml:ro
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=200h'
      - '--web.enable-lifecycle'
      - '--web.enable-admin-api'
    networks:
      backend:
        aliases:
          - prometheus
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:9090/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: '2'
        reservations:
          memory: 512M
          cpus: '0.5'

  # Grafana for visualization
  grafana:
    image: grafana/grafana:10.0.0
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
      - GF_INSTALL_PLUGINS=grafana-piechart-panel
    volumes:
      - grafana-data:/var/lib/grafana
      - ./monitoring/grafana-datasources.yml:/etc/grafana/provisioning/datasources/datasources.yml:ro
      - ./monitoring/grafana-dashboards.yml:/etc/grafana/provisioning/dashboards/dashboards.yml:ro
      - ./monitoring/dashboards:/var/lib/grafana/dashboards:ro
    depends_on:
      - prometheus
    networks:
      - backend
      - grafana
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1'
        reservations:
          memory: 256M
          cpus: '0.5'

  # Jaeger - Distributed Tracing
  jaeger:
    image: jaegertracing/all-in-one:1.50
    ports:
      - "16686:16686"  # Jaeger UI
      - "14268:14268"  # Jaeger collector HTTP endpoint
      - "9411:9411"    # Zipkin collector HTTP endpoint (for Spring Boot compatibility)
      - "6831:6831/udp"  # Jaeger agent UDP endpoint
      - "6832:6832/udp"  # Jaeger agent UDP endpoint  
      - "5778:5778"   # Jaeger agent HTTP endpoint
    environment:
      - COLLECTOR_OTLP_ENABLED=true
      - COLLECTOR_ZIPKIN_HOST_PORT=:9411
      - SPAN_STORAGE_TYPE=memory
    networks:
      - backend
      - grafana
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:16686/"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '1'
        reservations:
          memory: 256M
          cpus: '0.25'

  # Alertmanager for alert handling
  alertmanager:
    image: prom/alertmanager:v0.26.0
    ports:
      - "9093:9093"
    volumes:
      - ./monitoring/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - alertmanager-data:/alertmanager
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
      - '--web.external-url=http://localhost:9093'
      - '--cluster.advertise-address=0.0.0.0:9093'
    networks:
      - backend
    depends_on:
      - prometheus
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:9093/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
        reservations:
          memory: 128M
          cpus: '0.25'

  # pgBackRest for database backup and replication (commented out for initial testing)
  # pgbackrest:
  #   image: woblerr/pgbackrest:latest
  #   environment:
  #     PGBACKREST_CONFIG: /etc/pgbackrest/pgbackrest.conf
  #     POSTGRES_PASSWORD: keycloak
  #   volumes:
  #     - ./auth/pgbackrest.conf:/etc/pgbackrest/pgbackrest.conf:ro
  #     - pgbackrest-data:/var/lib/pgbackrest
  #     - postgres-data:/var/lib/postgresql/data:ro
  #   depends_on:
  #     - postgres
  #   networks:
  #     backend:
  #       aliases:
  #         - pgbackrest

  message-queue:
    image: rabbitmq:3.11.16-management-alpine
    ports:
      - "127.0.0.1:5672:5672"  # Bind to localhost only
      - "127.0.0.1:15672:15672"  # Management UI localhost only
      - "127.0.0.1:15692:15692"  # Prometheus metrics port
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-admin}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-admin}
      RABBITMQ_CONFIG_FILE: /etc/rabbitmq/rabbitmq
    volumes:
      - rabbitmq-data:/var/lib/rabbitmq
      - ./monitoring/rabbitmq_prometheus.conf:/etc/rabbitmq/conf.d/20-prometheus.conf:ro
      - ./config/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
    networks:
      backend:
        aliases:
          - message-queue
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '2'
        reservations:
          memory: 512M
          cpus: '0.5'

  write-layer:
    build:
      context: .
      dockerfile: write_layer/Dockerfile
    ports:
      - "8081:8081"
    environment:
      SPRING_RABBITMQ_HOST: message-queue
      RABBITMQ_USERNAME: admin
      RABBITMQ_PASSWORD: admin
      SPRING_REDIS_HOST: redis
      SPRING_REDIS_PORT: 6379
      SPRING_REDIS_PASSWORD: ${REDIS_PASSWORD:-secure_redis_password}
      SERVER_PORT: 8081
      KEYCLOAK_URL: https://haproxy:8443
      KEYCLOAK_REALM: event-system
      KEYCLOAK_CLIENT_ID: event-system-api
    depends_on:
      - message-queue
      - redis
      - keycloak-1
    networks:
      backend:
        aliases:
          - write-layer

  write-layer-2:
    build:
      context: .
      dockerfile: write_layer/Dockerfile
    ports:
      - "8083:8081"
    environment:
      SPRING_RABBITMQ_HOST: message-queue
      RABBITMQ_USERNAME: admin
      RABBITMQ_PASSWORD: admin
      SPRING_REDIS_HOST: redis
      SPRING_REDIS_PORT: 6379
      SPRING_REDIS_PASSWORD: ${REDIS_PASSWORD:-secure_redis_password}
      SERVER_PORT: 8081
      KEYCLOAK_URL: https://haproxy:8443
      KEYCLOAK_REALM: event-system
      KEYCLOAK_CLIENT_ID: event-system-api
    depends_on:
      - message-queue
      - redis
      - keycloak-1
    networks:
      backend:
        aliases:
          - write-layer-2

  public-api:
    build:
      context: .
      dockerfile: public_api/Dockerfile
    ports:
      - "8082:8082"
    environment:
      SPRING_REDIS_HOST: redis
      SPRING_REDIS_PORT: 6379
      SERVER_PORT: 8082
    depends_on:
      - redis
    networks:
      backend:
        aliases:
          - public-api

  cache-sync:
    build:
      context: .
      dockerfile: cache-sync-service/Dockerfile
    environment:
      SPRING_REDIS_HOST: redis
      SPRING_REDIS_PORT: 6379
      KAFKA_BOOTSTRAP_SERVERS: kafka:9092
    depends_on:
      - redis
      - kafka
    networks:
      backend:
        aliases:
          - cache-sync

  coupon-service:
    build:
      context: .
      dockerfile: coupon_service/Dockerfile
    ports:
      - "8086:8086"
    environment:
      SPRING_RABBITMQ_HOST: message-queue
      RABBITMQ_USERNAME: admin
      RABBITMQ_PASSWORD: admin
      AWS_ACCESS_KEY_ID: dummy
      AWS_SECRET_ACCESS_KEY: dummy
      AWS_REGION: us-east-1
      AWS_DYNAMODB_ENDPOINT: http://dynamodb-local:8000
      KAFKA_BOOTSTRAP_SERVERS: kafka:9092
      SPRING_REDIS_HOST: redis
      SPRING_REDIS_PORT: 6379
      SERVER_PORT: 8086
    depends_on:
      - message-queue
      - dynamodb-local
      - dynamodb-init
      - kafka
      - redis
    networks:
      backend:
        aliases:
          - coupon-service

  # Web application (React)
  web-app:
    build:
      context: ./web_app
      dockerfile: Dockerfile
    ports:
      - "3001:80"
    environment:
      - REACT_APP_API_URL=https://localhost:8443
      - REACT_APP_KEYCLOAK_URL=https://localhost:8443
      - REACT_APP_JAEGER_ENDPOINT=http://localhost:16686
    depends_on:
      - haproxy
      - write-layer
    networks:
      backend:
        aliases:
          - web-app
    extra_hosts:
      - "app.eventualconsistent.local:127.0.0.1"

  redis:
    image: redis:7.0.11-alpine
    ports:
      - "127.0.0.1:6379:6379"  # Bind to localhost only
    environment:
      - REDIS_PASSWORD=${REDIS_PASSWORD:-secure_redis_password}
    volumes:
      - redis-data:/data
      - ssl-certs:/certs:ro
      - ./config/redis.conf:/usr/local/etc/redis/redis.conf:ro
    command: redis-server /usr/local/etc/redis/redis.conf --requirepass ${REDIS_PASSWORD:-secure_redis_password}
    networks:
      backend:
        aliases:
          - redis
      internal:
        aliases:
          - redis
    healthcheck:
      test: ["CMD", "redis-cli", "--no-auth-warning", "-a", "${REDIS_PASSWORD:-secure_redis_password}", "ping"]
      interval: 30s
      timeout: 5s
      retries: 3
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
        reservations:
          memory: 128M
          cpus: '0.25'

  dynamodb-local:
    image: amazon/dynamodb-local:1.21.0
    command: -jar DynamoDBLocal.jar -sharedDb -inMemory
    ports:
      - "8000:8000"
    networks:
      backend:
        aliases:
          - dynamodb-local

  dynamodb-init:
    build:
      context: .
      dockerfile: scripts/Dockerfile.init
    depends_on:
      - dynamodb-local
    networks:
      backend:
    restart: "no"

  zookeeper:
    image: confluentinc/cp-zookeeper:7.3.2
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000
    networks:
      backend:
        aliases:
          - zookeeper

  kafka:
    image: confluentinc/cp-kafka:7.3.2
    depends_on:
      - zookeeper
    ports:
      - "9092:9092"
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
    networks:
      backend:
        aliases:
          - kafka

  haproxy:
    image: haproxy:2.7.3-alpine
    ports:
      - "8080:8080"   # HTTP port (will redirect to HTTPS)
      - "8443:8443"   # HTTPS port
    volumes:
      - ./load_balancer/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
      - ssl-certs:/certs:ro
    depends_on:
      - ssl-cert-generator
      - write-layer
      - public-api
      - keycloak-1
      - keycloak-2
    networks:
      backend:
        aliases:
          - haproxy
      internal:
        aliases:
          - haproxy
    healthcheck:
      test: ["CMD", "nc", "-z", "localhost", "8443"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

# SSL/TLS Certificate Generation Service
  ssl-cert-generator:
    image: alpine:latest
    volumes:
      - ssl-certs:/certs
      - ./scripts/generate-backend-ssl.sh:/generate-ssl.sh:ro
    command: >
      sh -c "
        apk add --no-cache openssl &&
        if [ ! -f /certs/backend.pem ]; then
          echo 'Generating SSL certificates for backend services...' &&
          
          # Generate private key
          openssl genrsa -out /certs/backend.key 2048 &&
          
          # Create OpenSSL config for SAN
          cat > /certs/openssl.conf << 'EOF'
      [req]
      distinguished_name = req_distinguished_name
      req_extensions = v3_req
      prompt = no

      [req_distinguished_name]
      C = US
      ST = State
      L = City
      O = EventualConsistent
      CN = localhost

      [v3_req]
      keyUsage = keyEncipherment, dataEncipherment
      extendedKeyUsage = serverAuth
      subjectAltName = @alt_names

      [alt_names]
      DNS.1 = localhost
      DNS.2 = app.eventualconsistent.local
      DNS.3 = haproxy
      IP.1 = 127.0.0.1
      IP.2 = ::1
      EOF
          
          # Generate certificate with SAN
          openssl req -new -key /certs/backend.key -out /certs/backend.csr -config /certs/openssl.conf &&
          openssl x509 -req -in /certs/backend.csr -signkey /certs/backend.key -out /certs/backend.crt -extensions v3_req -extfile /certs/openssl.conf -days 365 &&
          
          # Combine certificate and key for HAProxy
          cat /certs/backend.crt /certs/backend.key > /certs/backend.pem &&
          
          # Set proper permissions
          chmod 644 /certs/*.crt /certs/*.pem &&
          chmod 600 /certs/*.key &&
          
          echo 'SSL certificates generated successfully!'
        else
          echo 'SSL certificates already exist, skipping generation.'
        fi
      "
    networks:
      - internal
    restart: "no"

volumes:
  dynamodb-data:
  postgres-data:
  infinispan-data:
  prometheus-data:
  grafana-data:
  pgbackrest-data:
  rabbitmq-data:
  alertmanager-data:
  ssl-certs:
  redis-data:

networks:
  backend:
    driver: bridge
  grafana:
    driver: bridge
  internal:
    driver: bridge