docker-compose.yml

services:
  # Traefik reverse proxy
  traefik:
    image: traefik:v2.10
    container_name: ai-hr-traefik
    command:
      - "--api.insecure=true"  # Enable web UI (for development only)
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
    ports:
      - "80:80"     # HTTP
      - "443:443"   # HTTPS
      - "8080:8080" # Traefik dashboard
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - ai-hr-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`traefik.localhost`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.entrypoints=web"

  # PostgreSQL database
  postgresql:
    build:
      context: ./postgresql
      dockerfile: ./Dockerfile
    container_name: ai-hr-postgres
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_USER=${DB_USERNAME:-postgres}
      - POSTGRES_PASSWORD=${DB_PASSWORD:-postgres}
    volumes:
      - ai-hr-postgres-data:/var/lib/postgresql/data
    networks:
      - ai-hr-network
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "PGPASSWORD=$$POSTGRES_PASSWORD psql -U $$POSTGRES_USER -d postgres -tAc \"SELECT 1 FROM pg_database WHERE datname='ai_db';\" | grep -q 1"
        ]
      interval: 10s
      timeout: 5s
      retries: 5
    labels:
      - "traefik.enable=false"

  # Authentication service
  service-auth:
    build:
      context: .
      dockerfile: ./service-auth/Dockerfile
    container_name: ai-hr-auth
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - ai-hr-network
    environment:
      - SERVER_PORT=${AUTH_SERVER_PORT:-8080}
      - DB_HOST=${DB_HOST:-postgresql}
      - DB_PORT=${DB_PORT:-5432}
      - DB_USERNAME=${DB_USERNAME:-postgres}
      - DB_PASSWORD=${DB_PASSWORD:-postgres}
      - JWT_PRIVATE_KEY=${JWT_PRIVATE_KEY:------BEGIN PRIVATE KEY-----MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCqDezswS8yNAoZHLUF3oE/dnvH3Z1Jga80GJr7mv45dQNdnkzYLFtq87hb/ocIZoiE87fgprejQPDeC732gtfcEJxqHPtYIJDe4Db+bsPRDm7lKBQOchef0wYilH57mgG/iia5nYH61naq0qmHJdFeRYzRCxpQR3n9EXXomV5gfvxLZZZtNk1Up4oTDzRLsTT2OVAlLR2ccYqeS55PcK7ny1M1EeXOBEo4OMfkwdc4f+n2osRNRfLInIlCvOToChxWX8knYmVMWl8afnvSqo6NJCTg0A3RMcEic7+gdTgRSuA9dzkWlymRwUgWhMDMkDS6l7TFIwx9tIT2dp6JYO3DAgMBAAECggEAVPFfx2M4D/uuj5ynT6c1KF4mtk8cofsFaSBhSgzBsDGi3MCV4eVGRMY48LrS+H8+8ipLTwv37rQhnMiAuwHgkSw69UZExmB9/NZCohTx+xsaiZzbZ9vVsR/XkK5b/6GN/f8kGNN0ebdmzy0rQTbCvjQ/gqvpGPCbHq36F5WEbu4udzoISi+cDkivDuujs8UfwPBi0MFYo8gvpskjxdvT2AumtTTPF7D2mp+V+QXnGuNoncmptpNRJ+72Q8DNqqLy5ZvLG+EkorpgaCeawd9RGUdYiC58RErkD9inLv/UtzG5emRrzrPqXP9GOsUMQHBoN2yfIgYpGKTHpKVYPZCvAQKBgQDejQtpgZFCh1fcXgXQ74durXFo6iej+0OtvgvgCXZD6N/W8GafCaLdsklQdbnYBMD63URC3646mCMPn8/uGo9rhDCqr0Uru5DsTa7rMbgLl5VR3lenRqSZKrnR8nakJDTMuz70r85g+ZbDNG8eLf4vyhNSVPnJfuMyNhZkH5LvvQKBgQDDnQDXjd3MgfNb8WMUiaN9qoANwl79N9HfAtbO7CTCLPgB5FwqZElJ5hshKD6MlYJY8W/2ynTgA+4aZa+EmgyaO2wMRDe/KnHWoLSECtjWmUbdZgNAW3MQvHGtjqi3B8/gnUM6vh8sDzUBDQnRn1jlWPTRbp5KAvabf7YWGuhrfwKBgQC9nJQVjzPQ5/k+osj3y6yq6pFOnvmpJ+HwvJPnjIg7scRMn8P/Sjl+A3GdYMA3QU2eLzkCdQs/lvGAVVvV9MEvDJBeTDh12zfNbR5T+qdhEQRCnVo3BeQlL5bkPl1A2iw2Jm6sEMGYM+50YE8v+mWwF85Afm/XcglmdVi8c35ATQKBgQC4+b2zGBc2bWhIeHH+GM2+Zr2ixTv37ZILde7VS17TM5zuhRhWifD37Z2X9Ct522OgYedDk12D/JNq6N9Z4CasriZVTyj8H9H4aI1rE6rK+7SUZgQLFq8vk1NYEMAgHEYKHAxX/zMRAexYaxDu5eU1M7KGXTlXuYejsdfo/VbtVwKBgAS9ZEStN17V9N+v4vCb2tnkHagXx/bKOZ9TwG3OjhRofL5mftsVeWMSnofBjQX7fpvQIn/CUREpRGCgivYs6MB79GbemhY7NlSHc+z8y1oHmPxgiizTNTImGLCCgRTS9c58KkGdm1kdkR6IbJe4cExvlndP/IPvJxUQ/WBmdk3M-----END PRIVATE KEY-----}
      - JWT_PUBLIC_KEY=${JWT_PUBLIC_KEY:------BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqg3s7MEvMjQKGRy1Bd6BP3Z7x92dSYGvNBia+5r+OXUDXZ5M2CxbavO4W/6HCGaIhPO34Ka3o0Dw3gu99oLX3BCcahz7WCCQ3uA2/m7D0Q5u5SgUDnIXn9MGIpR+e5oBv4omuZ2B+tZ2qtKphyXRXkWM0QsaUEd5/RF16JleYH78S2WWbTZNVKeKEw80S7E09jlQJS0dnHGKnkueT3Cu58tTNRHlzgRKODjH5MHXOH/p9qLETUXyyJyJQrzk6AocVl/JJ2JlTFpfGn570qqOjSQk4NAN0THBInO/oHU4EUrgPXc5FpcpkcFIFoTAzJA0upe0xSMMfbSE9naeiWDtwwIDAQAB-----END PUBLIC KEY-----}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-"http://localhost:3000,http://localhost:5173,http://localhost:4200"}
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8080/actuator/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.auth.rule=Host(`localhost`) && PathPrefix(`/api/v1/auth`)"
      - "traefik.http.routers.auth.entrypoints=web"
      - "traefik.http.services.auth.loadbalancer.server.port=8080"

  # Job management service
  service-job:
    build:
      context: .
      dockerfile: ./service-job/Dockerfile
    container_name: ai-hr-job
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - ai-hr-network
    environment:
      - SERVER_PORT=${JOB_SERVER_PORT:-8081}
      - DB_HOST=${DB_HOST:-postgresql}
      - DB_PORT=${DB_PORT:-5432}
      - DB_USERNAME=${DB_USERNAME:-postgres}
      - DB_PASSWORD=${DB_PASSWORD:-postgres}
      - JWT_PUBLIC_KEY=${JWT_PUBLIC_KEY:------BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqg3s7MEvMjQKGRy1Bd6BP3Z7x92dSYGvNBia+5r+OXUDXZ5M2CxbavO4W/6HCGaIhPO34Ka3o0Dw3gu99oLX3BCcahz7WCCQ3uA2/m7D0Q5u5SgUDnIXn9MGIpR+e5oBv4omuZ2B+tZ2qtKphyXRXkWM0QsaUEd5/RF16JleYH78S2WWbTZNVKeKEw80S7E09jlQJS0dnHGKnkueT3Cu58tTNRHlzgRKODjH5MHXOH/p9qLETUXyyJyJQrzk6AocVl/JJ2JlTFpfGn570qqOjSQk4NAN0THBInO/oHU4EUrgPXc5FpcpkcFIFoTAzJA0upe0xSMMfbSE9naeiWDtwwIDAQAB-----END PUBLIC KEY-----}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-"http://localhost:3000,http://localhost:5173,http://localhost:4200"}
      - AUTH_BASE_URL=${AUTH_BASE_URL:-http://service-auth:8080}
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8081/actuator/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.job.rule=Host(`localhost`) && PathPrefix(`/api/v1/jobs`)"
      - "traefik.http.routers.job.entrypoints=web"
      - "traefik.http.services.job.loadbalancer.server.port=8081"

  # Application management service
  service-application:
    build:
      context: .
      dockerfile: ./service-application/Dockerfile
    container_name: ai-hr-application
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - ai-hr-network
    environment:
      - SERVER_PORT=${APPLICATION_SERVER_PORT:-8082}
      - DB_HOST=${DB_HOST:-postgresql}
      - DB_PORT=${DB_PORT:-5432}
      - DB_USERNAME=${DB_USERNAME:-postgres}
      - DB_PASSWORD=${DB_PASSWORD:-postgres}
      - JWT_PUBLIC_KEY=${JWT_PUBLIC_KEY:------BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqg3s7MEvMjQKGRy1Bd6BP3Z7x92dSYGvNBia+5r+OXUDXZ5M2CxbavO4W/6HCGaIhPO34Ka3o0Dw3gu99oLX3BCcahz7WCCQ3uA2/m7D0Q5u5SgUDnIXn9MGIpR+e5oBv4omuZ2B+tZ2qtKphyXRXkWM0QsaUEd5/RF16JleYH78S2WWbTZNVKeKEw80S7E09jlQJS0dnHGKnkueT3Cu58tTNRHlzgRKODjH5MHXOH/p9qLETUXyyJyJQrzk6AocVl/JJ2JlTFpfGn570qqOjSQk4NAN0THBInO/oHU4EUrgPXc5FpcpkcFIFoTAzJA0upe0xSMMfbSE9naeiWDtwwIDAQAB-----END PUBLIC KEY-----}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-"http://localhost:3000,http://localhost:5173,http://localhost:4200"}
      - GRPC_GEN_AI_SERVICE_HOST=${GRPC_GEN_AI_SERVICE_HOST:-service-genai}
      - GRPC_GEN_AI_SERVICE_PORT=${GRPC_GEN_AI_SERVICE_PORT:-8079}
      - AUTH_BASE_URL=${AUTH_BASE_URL:-http://service-auth:8080}
      - JOB_BASE_URL=${JOB_BASE_URL:-http://service-job:8081}
    volumes:
      - resume-uploads:/app/uploads/resumes
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8082/actuator/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.application.rule=Host(`localhost`) && (PathPrefix(`/api/v1/applications`) || PathPrefix(`/api/v1/chat`) || PathPrefix(`/api/v1/assessments`) || PathPrefix(`/api/v1/files`))"
      - "traefik.http.routers.application.entrypoints=web"
      - "traefik.http.services.application.loadbalancer.server.port=8082"

  # GenAI service
  service-genai:
    build:
      context: ./service-genai
      dockerfile: ./Dockerfile
    container_name: ai-hr-genai
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - ai-hr-network
    environment:
      - PYTHONDONTWRITEBYTECODE=1
      - PYTHONUNBUFFERED=1
      - DB_HOST=${DB_HOST:-postgresql}
      - DB_PORT=${DB_PORT:-5432}
      - DB_USERNAME=${DB_USERNAME:-postgres}
      - DB_PASSWORD=${DB_PASSWORD:-postgres}
      - OLLAMA_BASE_URL=${OLLAMA_BASE_URL}
      - OLLAMA_MODEL=${OLLAMA_MODEL}
      - OLLAMA_API_KEY=${OLLAMA_API_KEY}

  # Frontend
  frontend:
    build:
      context: ./frontend
      dockerfile: ./Dockerfile
      args:
        - VITE_API_BASE_URL=${VITE_API_BASE_URL:-}
    container_name: ai-hr-frontend
    networks:
      - ai-hr-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=Host(`localhost`)"
      - "traefik.http.routers.frontend.entrypoints=web"
      - "traefik.http.services.frontend.loadbalancer.server.port=80"

networks:
  ai-hr-network:
    driver: bridge
    name: ai-hr-network

volumes:
  ai-hr-postgres-data:
    driver: local
    name: ai-hr-postgres-data
  resume-uploads:
    driver: local
    name: ai-hr-resume-uploads