compose.yaml

services:
  # ---------------------------------------------------------------------------
  # Reverse Proxy
  # ---------------------------------------------------------------------------
  traefik:
    image: traefik:v3.0
    container_name: foundation-traefik
    command:
      - --configfile=/etc/traefik/traefik.yml
    ports:
      - "80:80" # HTTP — routes to gateway-service
      - "443:443" # HTTPS
      - "8888:8080" # Traefik Dashboard (http://localhost:8888/dashboard/)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./docker/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - traefik_letsencrypt:/letsencrypt
    networks:
      - foundation-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`traefik.localhost`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.entrypoints=web"
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Databases
  # ---------------------------------------------------------------------------
  postgres-iam:
    image: postgres:17-alpine
    container_name: foundation-postgres-iam
    environment:
      POSTGRES_DB: ${IAM_DB_NAME:-iam}
      POSTGRES_USER: ${IAM_DB_USERNAME:-svc_iam_dba}
      POSTGRES_PASSWORD: ${IAM_DB_PASSWORD:-svc_iam_dba}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --lc-collate=C --lc-ctype=C"
      PGDATA: /var/lib/postgresql/data/pgdata
    expose:
      - "5432"
    volumes:
      - postgres_iam_data:/var/lib/postgresql/data
      - ./docker/postgres/init-iam.sql:/docker-entrypoint-initdb.d/init-iam.sql:ro
    networks:
      - foundation-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${IAM_DB_USERNAME:-svc_iam_dba} -d ${IAM_DB_NAME:-iam}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    restart: unless-stopped
    command: >
      postgres
      -c shared_preload_libraries=pg_stat_statements
      -c pg_stat_statements.track=all
      -c max_connections=100
      -c shared_buffers=256MB
      -c effective_cache_size=1GB
      -c maintenance_work_mem=64MB
      -c checkpoint_completion_target=0.9
      -c wal_buffers=16MB
      -c default_statistics_target=100
      -c random_page_cost=1.1
      -c effective_io_concurrency=200
      -c work_mem=4MB
      -c min_wal_size=1GB
      -c max_wal_size=4GB

  postgres-billing:
    image: postgres:17-alpine
    container_name: foundation-postgres-billing
    environment:
      POSTGRES_DB: ${BILLING_DB_NAME:-billing}
      POSTGRES_USER: ${BILLING_DB_USERNAME:-svc_billing_dba}
      POSTGRES_PASSWORD: ${BILLING_DB_PASSWORD:-svc_billing_dba}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --lc-collate=C --lc-ctype=C"
      PGDATA: /var/lib/postgresql/data/pgdata
    expose:
      - "5432"
    volumes:
      - postgres_billing_data:/var/lib/postgresql/data
      - ./docker/postgres/init-billing.sql:/docker-entrypoint-initdb.d/init-billing.sql:ro
    networks:
      - foundation-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${BILLING_DB_USERNAME:-svc_billing_dba} -d ${BILLING_DB_NAME:-billing}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    restart: unless-stopped
    command: >
      postgres
      -c shared_preload_libraries=pg_stat_statements
      -c pg_stat_statements.track=all
      -c max_connections=100
      -c shared_buffers=256MB
      -c effective_cache_size=1GB
      -c maintenance_work_mem=64MB
      -c checkpoint_completion_target=0.9
      -c wal_buffers=16MB
      -c default_statistics_target=100
      -c random_page_cost=1.1
      -c effective_io_concurrency=200
      -c work_mem=4MB
      -c min_wal_size=1GB
      -c max_wal_size=4GB

  # ---------------------------------------------------------------------------
  # Cache
  # ---------------------------------------------------------------------------
  redis:
    image: redis:7-alpine
    container_name: foundation-redis
    expose:
      - "6379"
    volumes:
      - redis_data:/data
    networks:
      - foundation-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    command: redis-server --appendonly yes
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Messaging
  # ---------------------------------------------------------------------------
  rabbitmq:
    image: rabbitmq:3.13-management-alpine
    container_name: foundation-rabbitmq
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_USERNAME:-svc_platform_rmq}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:-svc_platform_rmq}
      RABBITMQ_DEFAULT_VHOST: /
    expose:
      - "5672"
      - "15672"
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq
      - ./docker/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
      - ./docker/rabbitmq/definitions.json:/etc/rabbitmq/definitions.json:ro
    networks:
      - foundation-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rabbitmq.rule=Host(`rabbitmq.localhost`)"
      - "traefik.http.routers.rabbitmq.entrypoints=web"
      - "traefik.http.services.rabbitmq.loadbalancer.server.port=15672"
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Mail (local development only)
  # ---------------------------------------------------------------------------
  mailhog:
    image: mailhog/mailhog:v1.0.1
    container_name: foundation-mailhog
    expose:
      - "1025"
      - "8025"
    networks:
      - foundation-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mailhog.rule=Host(`mailhog.localhost`)"
      - "traefik.http.routers.mailhog.entrypoints=web"
      - "traefik.http.services.mailhog.loadbalancer.server.port=8025"
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # IAM Service
  # (internal — not directly exposed via Traefik; traffic arrives via gateway-service)
  # ---------------------------------------------------------------------------
  iam-service:
    build:
      context: ./foundation-iam-service
      dockerfile: Dockerfile
    image: iqkv/foundation-iam-service:local
    container_name: foundation-iam-service
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-local}

      # Database
      DB_HOST: postgres-iam
      DB_PORT: 5432
      DB_NAME: ${IAM_DB_NAME:-iam}
      DB_USERNAME: ${IAM_DB_USERNAME:-svc_iam_dba}
      DB_PASSWORD: ${IAM_DB_PASSWORD:-svc_iam_dba}

      # RabbitMQ
      RABBITMQ_HOST: rabbitmq
      RABBITMQ_PORT: 5672
      RABBITMQ_USERNAME: ${RABBITMQ_USERNAME:-svc_platform_rmq}
      RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:-svc_platform_rmq}

      # Mail (MailHog)
      MAIL_HOST: mailhog
      MAIL_PORT: 1025
      MAIL_USERNAME: ""
      MAIL_PASSWORD: ""
      MAIL_FROM: ${MAIL_FROM:-noreply@iqkv.dev}
      MAIL_REPLY_TO: ${MAIL_REPLY_TO:-}

      # JWT RS256
      JWT_PRIVATE_KEY_PATH: classpath:keys/private.pem
      JWT_PUBLIC_KEY_PATH: classpath:keys/public.pem
      JWT_ISSUER: foundation-iam-service

      # Application
      APP_BASE_URL: ${APP_BASE_URL:-http://localhost:80}

      # Multi-tenancy
      ROLLOUT_MODE: ${ROLLOUT_MODE:-MULTI_TENANT}
      DEFAULT_TENANT_KEY: ${DEFAULT_TENANT_KEY:-}
      DEFAULT_TENANT_NAME: ${DEFAULT_TENANT_NAME:-Default Organization}

      # Observability
      OTEL_SERVICE_NAME: foundation-iam-service
      OTEL_RESOURCE_ATTRIBUTES: service.name=foundation-iam-service,deployment.environment=${SPRING_PROFILES_ACTIVE:-local}
    expose:
      - "8080" # Application API
      - "8081" # Management / Actuator
    depends_on:
      postgres-iam:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      mailhog:
        condition: service_started
    networks:
      - foundation-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8081/actuator/health/readiness"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 90s
    volumes:
      - iam_logs:/app/logs
      - iam_tmp:/app/tmp
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Billing Service
  # (internal — not directly exposed via Traefik; traffic arrives via gateway-service)
  # ---------------------------------------------------------------------------
  billing-service:
    build:
      context: ./foundation-billing-service
      dockerfile: Dockerfile
    image: iqkv/foundation-billing-service:local
    container_name: foundation-billing-service
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-local}

      # Database
      DB_HOST: postgres-billing
      DB_PORT: 5432
      DB_NAME: ${BILLING_DB_NAME:-billing}
      DB_USERNAME: ${BILLING_DB_USERNAME:-svc_billing_dba}
      DB_PASSWORD: ${BILLING_DB_PASSWORD:-svc_billing_dba}

      # RabbitMQ
      RABBITMQ_HOST: rabbitmq
      RABBITMQ_PORT: 5672
      RABBITMQ_USERNAME: ${RABBITMQ_USERNAME:-svc_platform_rmq}
      RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:-svc_platform_rmq}
      MESSAGING_ENABLED: ${MESSAGING_ENABLED:-true}

      # Mail (MailHog)
      MAIL_HOST: mailhog
      MAIL_PORT: 1025
      MAIL_USERNAME: ""
      MAIL_PASSWORD: ""
      MAIL_FROM: ${MAIL_FROM:-noreply@iqkv.dev}
      MAIL_FROM_NAME: ${MAIL_FROM_NAME:-IQ Key Value}
      MAIL_REPLY_TO: ${MAIL_REPLY_TO:-}

      # JWT RS256 (OAuth2 Resource Server — validates tokens from IAM)
      JWT_PUBLIC_KEY_PATH: classpath:keys/public.pem

      # Application
      APP_BASE_URL: ${APP_BASE_URL:-http://localhost:80}

      # Multi-tenancy
      ROLLOUT_MODE: ${ROLLOUT_MODE:-MULTI_TENANT}
      DEFAULT_BILLING_EMAIL: ${DEFAULT_BILLING_EMAIL:-}

      # Stripe (placeholders — override via .env)
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-sk_test_placeholder}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-whsec_placeholder}

      # Observability
      OTEL_SERVICE_NAME: foundation-billing-service
      OTEL_RESOURCE_ATTRIBUTES: service.name=foundation-billing-service,deployment.environment=${SPRING_PROFILES_ACTIVE:-local}
    expose:
      - "8080"
      - "8081"
    depends_on:
      postgres-billing:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      iam-service:
        condition: service_healthy
      mailhog:
        condition: service_started
    networks:
      - foundation-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8081/actuator/health/readiness"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 90s
    volumes:
      - billing_logs:/app/logs
      - billing_tmp:/app/tmp
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Gateway Service
  # (single external entry point — routes to iam-service and billing-service)
  # ---------------------------------------------------------------------------
  gateway-service:
    build:
      context: ./foundation-gateway-service
      dockerfile: Dockerfile
    image: iqkv/foundation-gateway-service:local
    container_name: foundation-gateway-service
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-local}

      # IAM service — routing target and JWKS endpoint for JWT validation
      IAM_SERVICE_URI: http://iam-service:8080
      IAM_JWKS_URI: http://iam-service:8080/.well-known/jwks.json

      # IAM service URL — used by PlatformModeGuardFilter to verify rollout mode consistency
      IAM_SERVICE_URL: http://iam-service:8080

      # Billing service — routing target
      BILLING_SERVICE_URI: http://billing-service:8080

      # CORS
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-*}

      # Server ports (defaults match Dockerfile EXPOSE)
      SERVER_PORT: 8080
      MANAGEMENT_PORT: 8081

      # Multi-tenancy
      ROLLOUT_MODE: ${ROLLOUT_MODE:-MULTI_TENANT}
      DEFAULT_TENANT_KEY: ${DEFAULT_TENANT_KEY:-}

      # Observability
      OTEL_SERVICE_NAME: foundation-gateway-service
      OTEL_RESOURCE_ATTRIBUTES: service.name=foundation-gateway-service,deployment.environment=${SPRING_PROFILES_ACTIVE:-local}
    expose:
      - "8080" # Gateway API (internal)
      - "8081" # Management / Actuator
    ports:
      - "80:8080" # Expose gateway as the platform entry point on host port 80
    depends_on:
      iam-service:
        condition: service_healthy
      billing-service:
        condition: service_healthy
    networks:
      - foundation-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.gateway.rule=Host(`localhost`) || Host(`gateway.localhost`)"
      - "traefik.http.routers.gateway.entrypoints=web"
      - "traefik.http.services.gateway.loadbalancer.server.port=8080"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8081/actuator/health/readiness"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    volumes:
      - gateway_logs:/app/logs
      - gateway_tmp:/app/tmp
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Observability Stack
  # ---------------------------------------------------------------------------
  prometheus:
    image: prom/prometheus:v2.54.1
    container_name: foundation-prometheus
    expose:
      - "9090"
    volumes:
      - ./docker/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    networks:
      - foundation-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.prometheus.rule=Host(`prometheus.localhost`)"
      - "traefik.http.routers.prometheus.entrypoints=web"
      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--web.console.libraries=/etc/prometheus/console_libraries"
      - "--web.console.templates=/etc/prometheus/consoles"
      - "--storage.tsdb.retention.time=200h"
      - "--web.enable-lifecycle"
    restart: unless-stopped

  grafana:
    image: grafana/grafana:11.3.0
    container_name: foundation-grafana
    expose:
      - "3000"
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
      GF_USERS_ALLOW_SIGN_UP: "false"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./docker/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./docker/grafana/dashboards:/var/lib/grafana/dashboards:ro
    networks:
      - foundation-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.grafana.rule=Host(`grafana.localhost`)"
      - "traefik.http.routers.grafana.entrypoints=web"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
    depends_on:
      - prometheus
      - loki
    restart: unless-stopped

  loki:
    image: grafana/loki:3.2.0
    container_name: foundation-loki
    expose:
      - "3100"
    volumes:
      - ./docker/loki/loki-config.yml:/etc/loki/local-config.yaml:ro
      - loki_data:/loki
    networks:
      - foundation-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.loki.rule=Host(`loki.localhost`)"
      - "traefik.http.routers.loki.entrypoints=web"
      - "traefik.http.services.loki.loadbalancer.server.port=3100"
    command: -config.file=/etc/loki/local-config.yaml
    restart: unless-stopped

  promtail:
    image: grafana/promtail:3.2.0
    container_name: foundation-promtail
    volumes:
      - ./docker/promtail/promtail-config.yml:/etc/promtail/config.yml:ro
      - /var/log:/var/log:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
    networks:
      - foundation-network
    depends_on:
      - loki
    command: -config.file=/etc/promtail/config.yml
    restart: unless-stopped

networks:
  foundation-network:
    driver: bridge
    name: foundation-network

volumes:
  traefik_letsencrypt:
    name: foundation_traefik_letsencrypt
  postgres_iam_data:
    name: foundation_postgres_iam_data
  postgres_billing_data:
    name: foundation_postgres_billing_data
  redis_data:
    name: foundation_redis_data
  rabbitmq_data:
    name: foundation_rabbitmq_data
  iam_logs:
    name: foundation_iam_logs
  iam_tmp:
    name: foundation_iam_tmp
  billing_logs:
    name: foundation_billing_logs
  billing_tmp:
    name: foundation_billing_tmp
  gateway_logs:
    name: foundation_gateway_logs
  gateway_tmp:
    name: foundation_gateway_tmp
  prometheus_data:
    name: foundation_prometheus_data
  grafana_data:
    name: foundation_grafana_data
  loki_data:
    name: foundation_loki_data