docker-compose.yaml

services:
  # Shared base image for all Python backend services
  base:
    image: ghcr.io/hardmax71/integr8scode/base:${IMAGE_TAG:-latest}
    build:
      context: ./backend
      dockerfile: Dockerfile.base

  shared-ca:
    image: alpine:latest
    volumes:
      - shared_ca:/shared_ca
    command: sh -c "mkdir -p /shared_ca && chmod 777 /shared_ca && echo 'Shared CA directory ready'"
    networks:
      - app-network

  cert-generator:
    image: ghcr.io/hardmax71/integr8scode/cert-generator:${IMAGE_TAG:-latest}
    build:
      context: ./cert-generator
      dockerfile: Dockerfile
    volumes:
      - ./backend/certs:/backend-certs
      - ./frontend/certs:/frontend-certs
      - ~/.kube:/root/.kube
      - /etc/rancher/k3s:/etc/rancher/k3s:ro
      - shared_ca:/shared_ca
      - ./backend:/backend
    environment:
       - SHARED_CA_DIR=/shared_ca
       - BACKEND_CERT_DIR=/backend-certs
       - FRONTEND_CERT_DIR=/frontend-certs
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: "no"
    networks:
      - app-network
    depends_on:
      shared-ca:
        condition: service_completed_successfully

  mongo:
    image: mongo:8.0
    ports:
      - "27017:27017"
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USER:-root}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD:-rootpassword}
      MONGO_INITDB_DATABASE: integr8scode
    volumes:
      - mongo_data:/data/db
    networks:
      - app-network
    container_name: mongo
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    healthcheck:
      test: echo 'db.runCommand("ping").ok' | mongosh localhost/integr8scode -u ${MONGO_ROOT_USER:-root} -p ${MONGO_ROOT_PASSWORD:-rootpassword} --authenticationDatabase admin --quiet
      interval: 3s
      timeout: 5s
      retries: 15
      start_period: 5s

  redis:
    image: redis:7-alpine
    container_name: redis
    ports:
      - "6379:6379"
    command: redis-server --maxmemory 256mb --maxmemory-policy allkeys-lru --save ""
    volumes:
      - redis_data:/data
    networks:
      - app-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 2s
      timeout: 3s
      retries: 10
      start_period: 2s

  backend:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    build:
      context: ./backend
      dockerfile: Dockerfile
      additional_contexts:
        base: service:base
    depends_on:
      base:
        condition: service_completed_successfully
      cert-generator:
        condition: service_completed_successfully
      user-seed:
        condition: service_completed_successfully
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
      kafka:
        condition: service_healthy
    volumes:
      - ./backend/app:/app/app
      - ./backend/workers:/app/workers
      - ./backend/scripts:/app/scripts
      - ./backend/tests:/app/tests:ro
      - ./backend/certs:/app/certs:ro
      - ./backend/config.test.toml:/app/config.test.toml:ro
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
      - shared_ca:/shared_ca:ro
      - ./backend/kubeconfig.yaml:/app/kubeconfig.yaml:ro
    ports:
      - "443:443"
      - "9090:9090"  # Metrics port (host:container)
    networks:
      - app-network
    container_name: backend
    extra_hosts:
      - "host.docker.internal:host-gateway"
    healthcheck:
      test: ["CMD-SHELL", "curl -k -f -s https://localhost:443/api/v1/health/live >/dev/null || exit 1"]
      interval: 2s
      timeout: 3s
      retries: 30
      start_period: 3s

  frontend:
    image: ghcr.io/hardmax71/integr8scode/frontend-dev:${IMAGE_TAG:-latest}
    container_name: frontend
    build:
      context: ./frontend
      dockerfile: Dockerfile
    depends_on:
      cert-generator:
        condition: service_completed_successfully
      backend:
        condition: service_started
    volumes:
      - ./frontend:/app
      - /app/node_modules
      - ./frontend/certs:/app/certs:ro
      - shared_ca:/shared_ca:ro
    ports:
      - "5001:5001"
    networks:
      - app-network
    environment:
      - VITE_BACKEND_URL=https://backend:443
      - NODE_EXTRA_CA_CERTS=/shared_ca/ca.pem
    healthcheck:
      test: ["CMD-SHELL", "curl -k -f -s https://localhost:5001 >/dev/null || exit 1"]
      interval: 2s
      timeout: 3s
      retries: 30
      start_period: 3s


  grafana:
    container_name: grafana
    image: grafana/grafana:12.3.1
    profiles: ["observability"]
    user: "472"
    ports:
      - "3000:3000"
    volumes:
      - ./backend/grafana/grafana.ini:/etc/grafana/grafana.ini:ro
      - ./backend/grafana/provisioning:/etc/grafana/provisioning:ro
      - grafana_data:/var/lib/grafana
    networks:
      - app-network
    environment:
      - GF_LOG_LEVEL=warn

  # Kafka Infrastructure for Event-Driven Design
  # Certificate generator for Zookeeper/Kafka SSL
  zookeeper-certgen:
    image: ghcr.io/hardmax71/integr8scode/zookeeper-certgen:${IMAGE_TAG:-latest}
    build:
      context: ./backend/zookeeper
      dockerfile: Dockerfile.certgen
    container_name: zookeeper-certgen
    volumes:
      - zookeeper_certs:/certs
    networks:
      - app-network
    restart: "no"

  zookeeper:
    image: confluentinc/cp-zookeeper:7.8.2
    container_name: zookeeper
    depends_on:
      zookeeper-certgen:
        condition: service_completed_successfully
    environment:
      # Basic configuration
      ZOOKEEPER_CLIENT_PORT: 2181
      # Enable TLS-secure client port to match zoo.cfg
      ZOOKEEPER_SECURE_CLIENT_PORT: 2281
      ZOOKEEPER_TICK_TIME: 2000
      
      # Production settings
      ZOOKEEPER_MAX_CLIENT_CNXNS: 60
      ZOOKEEPER_INIT_LIMIT: 10
      ZOOKEEPER_SYNC_LIMIT: 5
      
      # Security settings (plaintext + SASL only)
      ZOOKEEPER_AUTH_PROVIDER_1: org.apache.zookeeper.server.auth.DigestAuthenticationProvider
      ZOOKEEPER_SERVER_CNXN_FACTORY: org.apache.zookeeper.server.NettyServerCnxnFactory
      KAFKA_OPTS: '-Dzookeeper.serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory -Dzookeeper.4lw.commands.whitelist=* -Djava.security.auth.login.config=/etc/kafka/secrets/kafka_jaas.conf'

      # TLS settings for secure client port (keystore/truststore produced by certgen)
      ZOOKEEPER_SSL_KEYSTORE_LOCATION: /etc/kafka/certs/zookeeper.keystore.jks
      ZOOKEEPER_SSL_KEYSTORE_PASSWORD: zookeeper_keystore_password
      ZOOKEEPER_SSL_TRUSTSTORE_LOCATION: /etc/kafka/certs/zookeeper.truststore.jks
      ZOOKEEPER_SSL_TRUSTSTORE_PASSWORD: zookeeper_truststore_password
      ZOOKEEPER_SSL_CLIENT_AUTH: need
      
      # 4lw commands whitelist (minimal for security)
      ZOOKEEPER_4LW_COMMANDS_WHITELIST: '*'
      
      # Autopurge settings
      ZOOKEEPER_AUTOPURGE_SNAP_RETAIN_COUNT: 3
      ZOOKEEPER_AUTOPURGE_PURGE_INTERVAL: 24
      
      # JVM settings for production
      KAFKA_HEAP_OPTS: '-Xms1G -Xmx1G'
      KAFKA_JVM_PERFORMANCE_OPTS: '-server -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:InitiatingHeapOccupancyPercent=35 -XX:+ExplicitGCInvokesConcurrent -XX:+ParallelRefProcEnabled -Djute.maxbuffer=4194304'
      
      # Logging
      ZOOKEEPER_LOG4J_ROOT_LOGLEVEL: 'WARN'
      ZOOKEEPER_LOG4J_LOGGERS: 'org.apache.zookeeper.server.auth=INFO,org.apache.zookeeper.audit=INFO'
      
      # Disable admin server for security
      ZOOKEEPER_ADMIN_ENABLE_SERVER: 'false'
      ZOOKEEPER_ADMIN_SERVER_PORT: 0
      
      # Metrics
      ZOOKEEPER_METRICS_PROVIDER_CLASS_NAME: org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider
      ZOOKEEPER_METRICS_PROVIDER_HTTP_PORT: 7070
      
    volumes:
      - ./backend/zookeeper/conf:/etc/kafka/conf:ro
      - ./backend/zookeeper/secrets:/etc/kafka/secrets:ro
      - zookeeper_certs:/etc/kafka/certs:ro
      - zookeeper_data:/var/lib/zookeeper/data
      - zookeeper_log:/var/lib/zookeeper/log
      - zookeeper_logs:/var/log/zookeeper
    ports:
      - "2181:2181"
      - "2281:2281"  # Secure TLS client port
      - "7070:7070"  # Metrics port
    networks:
      - app-network
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    healthcheck:
      test: ["CMD-SHELL", "echo ruok | nc localhost 2181 | grep imok"]
      interval: 3s
      timeout: 5s
      retries: 15
      start_period: 5s

  kafka:
    image: confluentinc/cp-kafka:7.8.2
    container_name: kafka
    depends_on:
      zookeeper:
        condition: service_healthy
    ports:
      - "9092:9092"
      - "29092:29092"
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT,SASL_PLAINTEXT:SASL_PLAINTEXT
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:29092,PLAINTEXT_HOST://localhost:9092
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: 'true'  # Needed for initial setup
      KAFKA_DELETE_TOPIC_ENABLE: 'true'
      KAFKA_LOG_RETENTION_HOURS: 168
      
      # Security settings for Zookeeper connection (SASL/Digest over plaintext)
      KAFKA_OPTS: '-Dzookeeper.sasl.client=true -Dzookeeper.sasl.clientconfig=Client -Djava.security.auth.login.config=/etc/kafka/secrets/kafka_jaas.conf'
      KAFKA_ZOOKEEPER_SET_ACL: 'false'
      # KAFKA_AUTHORIZER_CLASS_NAME: 'kafka.security.authorizer.AclAuthorizer'
      # KAFKA_SUPER_USERS: 'User:admin;User:kafka'
      
      # Production settings
      KAFKA_COMPRESSION_TYPE: 'gzip'
      KAFKA_NUM_NETWORK_THREADS: 8
      KAFKA_NUM_IO_THREADS: 8
      KAFKA_SOCKET_SEND_BUFFER_BYTES: 102400
      KAFKA_SOCKET_RECEIVE_BUFFER_BYTES: 102400
      KAFKA_SOCKET_REQUEST_MAX_BYTES: 104857600
      
      # Log settings
      KAFKA_LOG_SEGMENT_BYTES: 1073741824
      KAFKA_LOG_RETENTION_CHECK_INTERVAL_MS: 300000
      KAFKA_LOG_CLEANUP_POLICY: 'delete'
      
      # JVM settings
      KAFKA_HEAP_OPTS: '-Xms2G -Xmx2G'
      KAFKA_JVM_PERFORMANCE_OPTS: '-server -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:InitiatingHeapOccupancyPercent=35 -XX:+ExplicitGCInvokesConcurrent -Djava.awt.headless=true'
      
    volumes:
      - ./backend/zookeeper/secrets/kafka_jaas.conf:/etc/kafka/secrets/kafka_jaas.conf:ro
      - kafka_data:/var/lib/kafka/data
      - kafka_logs:/var/log/kafka
    networks:
      - app-network
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    healthcheck:
      test: ["CMD-SHELL", "kafka-broker-api-versions --bootstrap-server localhost:9092"]
      interval: 3s
      timeout: 10s
      retries: 15
      start_period: 3s

  kafdrop:
    image: obsidiandynamics/kafdrop:3.31.0
    container_name: kafdrop
    profiles: ["debug"]
    depends_on:
      - kafka
    ports:
      - "9000:9000"
    environment:
      KAFKA_BROKERCONNECT: kafka:29092
      JVM_OPTS: "-Xms256M -Xmx512M"
    networks:
      - app-network

  # Kafka topic initialization
  kafka-init:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    container_name: kafka-init
    depends_on:
      kafka:
        condition: service_healthy
    environment:
      - KAFKA_BOOTSTRAP_SERVERS=kafka:29092
    volumes:
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
    command: ["python", "-m", "scripts.create_topics"]
    networks:
      - app-network
    restart: "no"  # Run once and exit

  # Seed default users (runs once after mongo is ready)
  user-seed:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    container_name: user-seed
    depends_on:
      mongo:
        condition: service_healthy
    environment:
      - DEFAULT_USER_PASSWORD=${DEFAULT_USER_PASSWORD:-user123}
      - ADMIN_USER_PASSWORD=${ADMIN_USER_PASSWORD:-admin123}
    volumes:
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
    command: ["python", "-m", "scripts.seed_users"]
    networks:
      - app-network
    restart: "no"  # Run once and exit

  # Event-driven workers
  coordinator:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    container_name: coordinator
    command: ["python", "workers/run_coordinator.py"]
    depends_on:
      kafka-init:
        condition: service_completed_successfully
      mongo:
        condition: service_started
    volumes:
      - ./backend/app:/app/app:ro
      - ./backend/workers:/app/workers:ro
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
      - ./backend/config.coordinator.toml:/app/config.coordinator.toml:ro
    networks:
      - app-network
    restart: unless-stopped

  k8s-worker:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    container_name: k8s-worker
    command: ["python", "workers/run_k8s_worker.py"]
    depends_on:
      kafka-init:
        condition: service_completed_successfully
      mongo:
        condition: service_started
    volumes:
      - ./backend/app:/app/app:ro
      - ./backend/workers:/app/workers:ro
      - ./backend/kubeconfig.yaml:/app/kubeconfig.yaml:ro
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
      - ./backend/config.k8s-worker.toml:/app/config.k8s-worker.toml:ro
    networks:
      - app-network
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped

  pod-monitor:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    container_name: pod-monitor
    command: ["python", "workers/run_pod_monitor.py"]
    depends_on:
      kafka-init:
        condition: service_completed_successfully
    volumes:
      - ./backend/app:/app/app:ro
      - ./backend/workers:/app/workers:ro
      - ./backend/kubeconfig.yaml:/app/kubeconfig.yaml:ro
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
      - ./backend/config.pod-monitor.toml:/app/config.pod-monitor.toml:ro
    networks:
      - app-network
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped

  result-processor:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    container_name: result-processor
    command: ["python", "workers/run_result_processor.py"]
    depends_on:
      kafka-init:
        condition: service_completed_successfully
      mongo:
        condition: service_started
    volumes:
      - ./backend/app:/app/app:ro
      - ./backend/workers:/app/workers:ro
      - ./backend/kubeconfig.yaml:/app/kubeconfig.yaml:ro
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
      - ./backend/config.result-processor.toml:/app/config.result-processor.toml:ro
    networks:
      - app-network
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped

  saga-orchestrator:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    container_name: saga-orchestrator
    command: ["python", "workers/run_saga_orchestrator.py"]
    depends_on:
      kafka-init:
        condition: service_completed_successfully
      mongo:
        condition: service_started
    volumes:
      - ./backend/app:/app/app:ro
      - ./backend/workers:/app/workers:ro
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
      - ./backend/config.saga-orchestrator.toml:/app/config.saga-orchestrator.toml:ro
    networks:
      - app-network
    restart: unless-stopped

  # Distributed tracing with Jaeger
  jaeger:
    image: jaegertracing/all-in-one:1.52
    container_name: jaeger
    profiles: ["observability"]
    ports:
      - "5775:5775/udp"   # Zipkin/thrift compact
      - "6831:6831/udp"   # Thrift compact
      - "6832:6832/udp"   # Thrift binary
      - "5778:5778"       # HTTP config
      - "16686:16686"     # Jaeger UI
      - "14268:14268"     # HTTP collector
      - "14250:14250"     # gRPC collector
      - "9411:9411"       # Zipkin compatible endpoint
    environment:
      - COLLECTOR_ZIPKIN_HOST_PORT=:9411
      - COLLECTOR_OTLP_ENABLED=true
    networks:
      - app-network

  # Event replay service
  event-replay:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    container_name: event-replay
    command: ["python", "workers/run_event_replay.py"]
    depends_on:
      kafka-init:
        condition: service_completed_successfully
      mongo:
        condition: service_started
    volumes:
      - ./backend/app:/app/app:ro
      - ./backend/workers:/app/workers:ro
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
      - ./backend/config.event-replay.toml:/app/config.event-replay.toml:ro
    networks:
      - app-network
    restart: unless-stopped

  # DLQ Processor Service
  dlq-processor:
    image: ghcr.io/hardmax71/integr8scode/backend:${IMAGE_TAG:-latest}
    container_name: dlq-processor
    command: ["python", "workers/run_dlq_processor.py"]
    depends_on:
      kafka-init:
        condition: service_completed_successfully
      mongo:
        condition: service_started
    volumes:
      - ./backend/app:/app/app:ro
      - ./backend/workers:/app/workers:ro
      - ./backend/config.toml:/app/config.toml:ro
      - ./backend/secrets.toml:/app/secrets.toml:ro
      - ./backend/config.dlq-processor.toml:/app/config.dlq-processor.toml:ro
    networks:
      - app-network
    restart: unless-stopped

  # Monitoring Stack
  # Victoria Metrics - Time series database
  victoria-metrics:
    image: victoriametrics/victoria-metrics:v1.96.0
    container_name: victoria-metrics
    profiles: ["observability"]
    ports:
      - "8428:8428"
    volumes:
      - victoria_metrics_data:/victoria-metrics-data
    command:
      - "--storageDataPath=/victoria-metrics-data"
      - "--httpListenAddr=0.0.0.0:8428"
      - "--retentionPeriod=30d"
    networks:
      - app-network
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8428/-/healthy"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s

  # Kafka Exporter for metrics
  kafka-exporter:
    image: danielqsj/kafka-exporter:latest
    container_name: kafka-exporter
    profiles: ["observability"]
    command:
      - "--kafka.server=kafka:29092"
      - "--web.listen-address=:9308"
      - "--topic.filter=.*"
      - "--group.filter=.*"
    ports:
      - "9308:9308"
    networks:
      - app-network
    depends_on:
      kafka:
        condition: service_healthy
    restart: unless-stopped

  # OpenTelemetry Collector
  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.91.0
    container_name: otel-collector
    profiles: ["observability"]
    command: ["--config=/etc/otel-collector-config.yaml"]
    volumes:
      - ./backend/otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "4317:4317"   # OTLP gRPC
      - "4318:4318"   # OTLP HTTP
      - "13133:13133" # Health check
    networks:
      - app-network
    depends_on:
      - victoria-metrics
      - jaeger
    # Note: otel-collector uses scratch image - no wget/curl available for healthcheck
    # The service exposes health endpoint at :13133 but we can't check it from inside container

volumes:
  mongo_data:
  redis_data:
  grafana_data:
  victoria_metrics_data:
  shared_ca:
  kafka_data:
  kafka_logs:
  zookeeper_data:
  zookeeper_log:
  zookeeper_logs:
  zookeeper_certs:

networks:
  app-network:
    driver: bridge