docker-compose.yml

# Shared defaults applied to all services via <<: *common
# - logging: rotates logs (50MB x 5 files) to prevent unbounded disk growth
# - cap_drop: removes all Linux capabilities (services run as non-root)
# - security_opt: prevents privilege escalation via setuid binaries
# See docs/docker-architecture.md for rationale.
x-common: &common
  logging:
    driver: json-file
    options:
      max-size: "50m"
      max-file: "5"
  cap_drop: [ALL]
  security_opt: [no-new-privileges:true]

services:
  zebra:
    image: ${ZEBRA_IMAGE:-zfnd/zebra:4.3.0}
    platform: ${DOCKER_PLATFORM:-linux/amd64}
    build:
      context: ./zebra
      dockerfile: docker/Dockerfile
      target: runtime
      args:
        FEATURES: ${ZEBRA_BUILD_FEATURES:-default-release-binaries}
    container_name: z3_zebra
    restart: unless-stopped
    stop_grace_period: 30s
    <<: *common
    # Zebra's entrypoint runs mkdir/chown before dropping privileges via setpriv.
    # These operations need capabilities that cap_drop: [ALL] removes, so we add them back.
    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID]
    # Optional ZEBRA_* vars (metrics, OpenTelemetry) pass through from .env when set.
    # They must NOT be listed in environment: with empty defaults because config-rs
    # treats empty strings as values and fails to parse them (e.g., "" as a socket address).
    env_file:
      - path: ./.env
        required: false
    environment:
      RUST_LOG: ${Z3_ZEBRA_RUST_LOG:-info}
      ZEBRA_NETWORK__NETWORK: ${NETWORK_NAME:-Mainnet}
      ZEBRA_RPC__LISTEN_ADDR: 0.0.0.0:${Z3_ZEBRA_RPC_PORT:-18232}
      ZEBRA_RPC__ENABLE_COOKIE_AUTH: ${ENABLE_COOKIE_AUTH:-true}
      ZEBRA_RPC__COOKIE_DIR: ${COOKIE_AUTH_FILE_DIR:-/var/run/auth}
      ZEBRA_TRACING__FILTER: ${ZEBRA_TRACING__FILTER:-info}
      ZEBRA_STATE__CACHE_DIR: /home/zebra/.cache/zebra
      ZEBRA_HEALTH__LISTEN_ADDR: 0.0.0.0:8080
      ZEBRA_HEALTH__MIN_CONNECTED_PEERS: ${ZEBRA_HEALTH__MIN_CONNECTED_PEERS:-1}
      ZEBRA_HEALTH__READY_MAX_BLOCKS_BEHIND: ${ZEBRA_HEALTH__READY_MAX_BLOCKS_BEHIND:-2}
      ZEBRA_HEALTH__ENFORCE_ON_TEST_NETWORKS: ${ZEBRA_HEALTH__ENFORCE_ON_TEST_NETWORKS:-false}
    volumes:
      - ${Z3_ZEBRA_DATA_PATH:-zebra_data}:/home/zebra/.cache/zebra
      - ${Z3_COOKIE_PATH:-shared_cookie_volume}:${COOKIE_AUTH_FILE_DIR:-/var/run/auth}
    ports:
      - "${Z3_ZEBRA_HOST_RPC_PORT:-18232}:${Z3_ZEBRA_RPC_PORT:-18232}"
      - "${Z3_ZEBRA_HOST_HEALTH_PORT:-8080}:8080"
    networks:
      - z3_net
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://127.0.0.1:8080/ready || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 90s
      start_interval: 5s

  zaino:
    # Image built by z3 CI from zingolabs/zaino@dev branch.
    # The sha-* tag is a z3 commit hash, not a zaino one.
    # Upstream: https://github.com/zingolabs/zaino (zainod 0.2.0 / Zebra 4.3.0 compatible)
    image: ${ZAINO_IMAGE:-ghcr.io/zcashfoundation/zaino:sha-83e41d7}
    platform: ${DOCKER_PLATFORM:-linux/amd64}
    build:
      context: ./zaino
      dockerfile: Dockerfile
    container_name: z3_zaino
    restart: unless-stopped
    stop_grace_period: 15s
    <<: *common
    # Zaino's entrypoint runs mkdir/chown before dropping privileges via setpriv.
    # These operations need capabilities that cap_drop: [ALL] removes, so we add them back.
    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID]
    command: ["start", "--config", "/etc/zaino/zindexer.toml"]
    depends_on:
      zebra:
        condition: service_healthy
    environment:
      RUST_LOG: ${ZAINO_RUST_LOG:-info,reqwest=warn,hyper_util=warn}
      RUST_BACKTRACE: ${ZAINO_RUST_BACKTRACE:-full}
      ZAINO_NETWORK: ${NETWORK_NAME:-Mainnet}
      ZAINO_VALIDATOR_SETTINGS__VALIDATOR_JSONRPC_LISTEN_ADDRESS: zebra:${Z3_ZEBRA_RPC_PORT:-18232}
      ZAINO_VALIDATOR_SETTINGS__VALIDATOR_COOKIE_PATH: ${COOKIE_AUTH_FILE_DIR:-/var/run/auth}/.cookie
      ZAINO_GRPC_SETTINGS__LISTEN_ADDRESS: 0.0.0.0:${ZAINO_GRPC_PORT:-8137}
      ZAINO_JSON_SERVER_SETTINGS__JSON_RPC_LISTEN_ADDRESS: 0.0.0.0:${ZAINO_JSON_RPC_PORT:-8237}
      ZAINO_GRPC_SETTINGS__TLS__CERT_PATH: ${ZAINO_GRPC_TLS_CERT_PATH:-/var/run/zaino/tls/zaino.crt}
      ZAINO_GRPC_SETTINGS__TLS__KEY_PATH: ${ZAINO_GRPC_TLS_KEY_PATH:-/var/run/zaino/tls/zaino.key}
    volumes:
      - ${Z3_ZAINO_DATA_PATH:-zaino_data}:/app/data
      - ${Z3_COOKIE_PATH:-shared_cookie_volume}:${COOKIE_AUTH_FILE_DIR:-/var/run/auth}:ro
      - ./config/zaino.toml:/etc/zaino/zindexer.toml:ro
    configs:
      - source: zaino_tls_cert
        target: ${ZAINO_GRPC_TLS_CERT_PATH:-/var/run/zaino/tls/zaino.crt}
      - source: zaino_tls_key
        target: ${ZAINO_GRPC_TLS_KEY_PATH:-/var/run/zaino/tls/zaino.key}
    ports:
      - "${ZAINO_HOST_GRPC_PORT:-8137}:${ZAINO_GRPC_PORT:-8137}"
      - "${ZAINO_HOST_JSONRPC_PORT:-8237}:${ZAINO_JSON_RPC_PORT:-8237}"
    networks:
      - z3_net
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/127.0.0.1/8137' 2>/dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
      start_interval: 5s

  zallet:
    image: ${ZALLET_IMAGE:-electriccoinco/zallet:v0.1.0-alpha.3}
    platform: ${DOCKER_PLATFORM:-linux/amd64}
    build:
      context: ./zallet
      dockerfile: Dockerfile
      target: runtime
      tags:
        - z3_zallet:local
    container_name: z3_zallet
    restart: unless-stopped
    stop_grace_period: 15s
    <<: *common
    user: "1000:1000"
    command: ["--datadir", "/var/lib/zallet", "--config", "/etc/zallet/zallet.toml", "start"]
    depends_on:
      zebra:
        condition: service_healthy
    environment:
      RUST_LOG: ${ZALLET_RUST_LOG:-info,hyper_util=warn,reqwest=warn}
    volumes:
      - ${Z3_ZALLET_DATA_PATH:-zallet_data}:/var/lib/zallet
      - ${Z3_COOKIE_PATH:-shared_cookie_volume}:${COOKIE_AUTH_FILE_DIR:-/var/run/auth}:ro
      - ./config/zallet.toml:/etc/zallet/zallet.toml:ro
      - ./config/zallet_identity.txt:/etc/zallet/identity.txt:ro
    ports:
      - "${ZALLET_HOST_RPC_PORT:-28232}:${ZALLET_RPC_PORT:-28232}"
    networks:
      - z3_net
    # No healthcheck: distroless image has no shell/curl

  # =============================================================================
  # Monitoring Stack (enabled with --profile monitoring)
  # =============================================================================
  # Usage: docker compose --profile monitoring up -d
  # Access:
  #   - Grafana:      http://localhost:3000 (admin/admin)
  #   - Prometheus:   http://localhost:9094
  #   - Jaeger:       http://localhost:16686
  #   - AlertManager: http://localhost:9093

  jaeger:
    image: jaegertracing/jaeger:2.1.0
    container_name: z3_jaeger
    profiles: [monitoring]
    restart: unless-stopped
    <<: *common
    volumes:
      - ./observability/jaeger/config.yaml:/etc/jaeger/config.yaml:ro
    command:
      - --config=/etc/jaeger/config.yaml
    ports:
      - "${JAEGER_UI_PORT:-16686}:16686"
      - "${JAEGER_OTLP_GRPC_PORT:-4317}:4317"
      - "${JAEGER_OTLP_HTTP_PORT:-4318}:4318"
      - "${JAEGER_SPANMETRICS_PORT:-8889}:8889"
    networks:
      - z3_net
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:16686/ || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 10

  prometheus:
    image: prom/prometheus:v3.2.0
    container_name: z3_prometheus
    profiles: [monitoring]
    restart: unless-stopped
    <<: *common
    volumes:
      - prometheus_data:/prometheus
      - ./observability/prometheus/rules:/etc/prometheus/rules:ro
    configs:
      - source: prometheus_config
        target: /etc/prometheus/prometheus.yml
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.enable-lifecycle'
      - '--web.enable-admin-api'
    ports:
      - "${PROMETHEUS_PORT:-9094}:9090"
    networks:
      - z3_net
    depends_on:
      jaeger:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:9090/-/healthy || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3

  grafana:
    image: grafana/grafana:11.5.1
    container_name: z3_grafana
    profiles: [monitoring]
    restart: unless-stopped
    <<: *common
    volumes:
      - ./observability/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - ./observability/grafana/provisioning:/etc/grafana/provisioning:ro
      - grafana_data:/var/lib/grafana
    environment:
      GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH: /var/lib/grafana/dashboards/zebra_overview.json
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
    ports:
      - "${GRAFANA_PORT:-3000}:3000"
    networks:
      - z3_net
    depends_on:
      prometheus:
        condition: service_healthy
      jaeger:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:3000/api/health || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  alertmanager:
    image: prom/alertmanager:v0.28.1
    container_name: z3_alertmanager
    profiles: [monitoring]
    restart: unless-stopped
    <<: *common
    volumes:
      - ./observability/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - alertmanager_data:/alertmanager
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
    ports:
      - "${ALERTMANAGER_PORT:-9093}:9093"
    networks:
      - z3_net
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:9093/-/healthy || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3

volumes:
  zebra_data:
  zaino_data:
  zallet_data:
  shared_cookie_volume:
  prometheus_data:
  grafana_data:
  alertmanager_data:

networks:
  z3_net:
    driver: bridge

configs:
  zaino_tls_cert:
    file: ./config/tls/zaino.crt
  zaino_tls_key:
    file: ./config/tls/zaino.key
  prometheus_config:
    file: ./observability/prometheus/prometheus.yaml