docker-compose.yaml

services:
  # --- INFRASTRUCTURE: IDENTITY & SESSION ---
  postgres-keycloak:
    image: postgres:17-alpine
    container_name: postgres-keycloak
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD_FILE: /run/secrets/db_kc_password
    volumes:
      - ./persistent_data/postgres-keycloak:/var/lib/postgresql/data
    secrets:
      - db_kc_password
    networks:
      - backend-net
    command: ["postgres", "-c", "wal_level=logical"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak"]
      interval: 10s
      timeout: 5s
      retries: 5

  keycloak:
    image: quay.io/keycloak/keycloak:26.5.4
    container_name: keycloak
    command: start-dev --import-realm
    environment:
      - KC_HOSTNAME_URL=http://keycloak:8080
      - KC_HOSTNAME_STRICT=false
      - KC_DB=postgres
      - KC_DB_URL=jdbc:postgresql://postgres-keycloak/keycloak
      - KC_DB_USERNAME=keycloak
      - KC_DB_PASSWORD=dev-password
      - KC_BOOTSTRAP_ADMIN_USERNAME=admin
      - KC_BOOTSTRAP_ADMIN_PASSWORD=admin
      - KC_IMPORT_STRATEGY=OVERWRITE_EXISTING
      - KC_HEALTH_ENABLED=true
      - KC_METRICS_ENABLED=true

    volumes:
    - ./secrets/keycloak/keycloak-realm.json:/opt/keycloak/data/import/realm.json
    ports:
      - "8080:8080"
    depends_on:
      postgres-keycloak:
        condition: service_healthy
    healthcheck:
      # Keycloak exposes health at /health/live, /health/ready, and /health/started
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | grep 'HTTP/1.1 200 OK'"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s # Keycloak takes a while to boot and import realms
    networks:
      - backend-net

  redis-session:
    image: redis:7.4-alpine
    container_name: redis-session
    networks:
      - backend-net
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s

  # --- INFRASTRUCTURE: MESSAGING & CDC ---
  kafka:
    image: confluentinc/cp-kafka:latest
    container_name: kafka
    ports:
      - "9092:9092"
    environment:
      - KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR=1
      - KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR=1
      - KAFKA_TRANSACTION_STATE_LOG_MIN_ISR=1
      - KAFKA_NODE_ID=1
      - KAFKA_PROCESS_ROLES=broker,controller
      - KAFKA_CONTROLLER_QUORUM_VOTERS=1@kafka:9094
      - KAFKA_CONTROLLER_LISTENER_NAMES=CONTROLLER
      - KAFKA_INTER_BROKER_LISTENER_NAME=PLAINTEXT
      - KAFKA_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:9094
      - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://kafka:9092
      - KAFKA_LISTENER_SECURITY_PROTOCOL_MAP=PLAINTEXT:PLAINTEXT,SSL:SSL,CONTROLLER:PLAINTEXT
      - CLUSTER_ID=MkU3OEVBNTcwNTJENDM2Qk
      - KAFKA_AUTO_CREATE_TOPICS_ENABLE=true
    volumes:
      - ./persistent_data/kafka:/var/lib/kafka/data
      - ./secrets/kafka:/etc/kafka/secrets
    networks:
      - backend-net
    healthcheck:
      test: ["CMD-SHELL", "kafka-topics --bootstrap-server localhost:9092 --list"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  kafka-ui:
    image: provectuslabs/kafka-ui:latest
    container_name: kafka-ui
    ports:
      - "8081:8080"
    environment:
      - KAFKA_CLUSTERS_0_NAME=local-cluster
      - KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=kafka:9092
      # Debezium/Connect visibility
      - KAFKA_CLUSTERS_0_KAFKACONNECT_0_NAME=debezium
      - KAFKA_CLUSTERS_0_KAFKACONNECT_0_ADDRESS=http://debezium-connector:8083
      - DYNAMIC_CONFIG_ENABLED=true
      # Optional: If eventually add a Schema Registry
      # - KAFKA_CLUSTERS_0_SCHEMAREGISTRY=http://schema-registry:8081
    depends_on:
      kafka:
        condition: service_healthy
      debezium:
        condition: service_healthy
    networks:
      - backend-net
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/actuator/health | grep -q 'UP' || exit 1"]
      interval: 15s
      timeout: 10s
      retries: 3
      start_period: 30s

  debezium-configurator:
    image: curlimages/curl:latest
    container_name: debezium-configurator
    volumes:
      - ./config/debezium/register-connectors.sh:/usr/bin/register-connectors.sh
    entrypoint: ["/bin/sh", "/usr/bin/register-connectors.sh"]
    depends_on:
      debezium:
        condition: service_healthy
    networks:
      - backend-net

  debezium:
    image: debezium/connect:2.7.3.Final
    container_name: debezium-connector
    environment:
      - BOOTSTRAP_SERVERS=kafka:9092
      - GROUP_ID=1
      - CONFIG_STORAGE_TOPIC=my_connect_configs
      - OFFSET_STORAGE_TOPIC=my_connect_offsets
      - STATUS_STORAGE_TOPIC=my_connect_statuses
      # Ensures the internal topics are created with correct replication
      - CONNECT_CONFIG_STORAGE_REPLICATION_FACTOR=1
      - CONNECT_OFFSET_STORAGE_REPLICATION_FACTOR=1
      - CONNECT_STATUS_STORAGE_REPLICATION_FACTOR=1
    ports:
      - "8083:8083"
    depends_on:
      kafka:
        condition: service_healthy
      postgres-keycloak:
        condition: service_healthy
    networks:
      - backend-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8083/"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
  
  pgadmin:
    container_name: pgadmin
    image: dpage/pgadmin4
    restart: always
    ports:
      - "8888:80"
    environment:
      PGADMIN_DEFAULT_EMAIL: example@example.com
      PGADMIN_DEFAULT_PASSWORD: password#11
    depends_on:
      postgres-asset-metadata:
        condition: service_healthy
      postgres-keycloak:
        condition: service_healthy
    networks:
      - backend-net
    healthcheck:
      test: ["CMD", "wget", "-O", "-", "http://localhost:80/misc/ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  # --- INFRASTRUCTURE: STORAGE & MAIL ---
  rustfs:
    image: rustfs/rustfs:1.0.0-alpha.83
    container_name: rustfs-s3
    environment:
      - RUSTFS_ROOT_USER=rustfsadmin
      - RUSTFS_ROOT_PASSWORD=rustfspassword
    volumes:
      - ./persistent_data/rustfs:/data
    ports:
      - "9000:9000"
      - "9001:9001"
    networks:
      - backend-net
    healthcheck:
      test:
        [
          "CMD",
          "sh", "-c",
          "curl -f http://127.0.0.1:9000/health && curl -f http://127.0.0.1:9001/rustfs/console/health"
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  mailpit:
    image: axllent/mailpit:latest
    container_name: mailpit
    ports:
      - "8025:8025" # Dashboard
      - "1025:1025" # SMTP
    networks:
      - backend-net
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8025/readyz > /dev/null || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 2
      start_period: 5s
    restart: on-failure

  # --- APPLICATION SERVICES ---
  postgres-asset-metadata:
    image: postgres:17-alpine
    container_name: postgres-asset-metadata
    environment:
      POSTGRES_DB: asset_metadata
      POSTGRES_USER: asset_admin
      POSTGRES_PASSWORD_FILE: /run/secrets/db_asset_password
    volumes:
      - ./persistent_data/postgres-image-metadata:/var/lib/postgresql/data
      - ./init-db/postgres-image-metadata:/docker-entrypoint-initdb.d
    secrets:
      - db_asset_password
    networks:
      - backend-net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U asset_admin -d asset_metadata -p 5432"]
      interval: 10s
      timeout: 5s
      retries: 5

  asset-service:
    build:
      context: .
      dockerfile: docker/asset-service.Dockerfile
    container_name: asset-service
    environment:
      - DATABASE_URL=postgresql+asyncpg://asset_admin:dev-asset-password@postgres-asset-metadata:5432/asset_metadata
      - KAFKA_BOOTSTRAP_SERVERS=kafka:9092
      - S3_ENDPOINT_URL=http://rustfs:9000
      - S3_ACCESS_KEY=rustfsadmin
      - S3_SECRET_KEY=rustfspassword
      - RAW_BUCKET=raw-images
      - PROCESSED_BUCKET=processed-images
      - KEYCLOAK_URL=http://keycloak:8080
      - REALM=image-platform
      - USER_REGISTRATION_EVENT_TOPIC=keycloak_events.public.user_entity
    depends_on:
      postgres-asset-metadata:
        condition: service_healthy
      kafka:
        condition: service_healthy
      rustfs:
        condition: service_healthy
    networks:
      - backend-net
    healthcheck:
      # We use localhost because the command runs INSIDE the container
      test: curl -s http://localhost:8000/health | grep -q '{"status":"ok"}' || exit 1
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  bff-token-handler:
    build:
      context: .
      dockerfile: docker/bff-token-handler.Dockerfile
    container_name: bff-token-handler
    environment:
      - KEYCLOAK_URL=http://keycloak:8080
      - REALM=image-platform
      - CLIENT_ID=bff-client
      - CLIENT_SECRET_FILE=/run/secrets/bff_client_secret
      - REDIRECT_URI=http://localhost:80/api/authorization-code/callback
      - REDIS_URL=redis://redis-session:6379/0
      - ASSET_SERVICE_URL=http://asset-service:8000
      - SESSION_COOKIE_NAME=sid
      - SESSION_TTL_SECONDS=3600
    depends_on:
      redis-session:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      asset-service:
        condition: service_healthy
    ports:
      - "8000:8000"
    secrets:
      - bff_client_secret
    networks:
      - backend-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 5s

  cleanup-buckets-worker:
    build:
      context: .
      dockerfile: docker/cleanup-buckets-worker.Dockerfile
      target: production
    container_name: cleanup-buckets-worker
    restart: unless-stopped
    environment:
      # Kafka Config
      - KAFKA_BOOTSTRAP_SERVERS=kafka:9092
      - INPUT_TOPIC=image.raw.uploaded
      - SUCCESS_TOPIC=image.avif.ready
      - DLQ_TOPIC=image.raw.failed
      
      # S3 / RustFS Config
      - S3_ENDPOINT_URL=http://rustfs:9000
      - S3_AWS_ACCESS_KEY_ID=${S3_ACCESS_KEY:-minioadmin}
      - S3_AWS_SECRET_ACCESS_KEY=${S3_SECRET_KEY:-minioadmin}
      - RAW_BUCKET_NAME=raw-images
      - PROCESSED_BUCKET_NAME=processed-images
      
      # Python Config
      - PYTHONUNBUFFERED=1
    networks:
      - backend-net
    depends_on:
      kafka:
        condition: service_healthy
      rustfs:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s # Give Python time to boot up

  image-processor:
    build:
      context: .
      dockerfile: docker/image-processor.Dockerfile
      target: production
    container_name: image-processor-worker
    restart: unless-stopped
    environment:
      # Kafka Config
      - KAFKA_BOOTSTRAP_SERVERS=kafka:9092
      - INPUT_TOPIC=image.raw.uploaded
      - SUCCESS_TOPIC=image.avif.ready
      - DLQ_TOPIC=image.raw.failed
      
      # S3 / RustFS Config
      - S3_ENDPOINT_URL=http://rustfs:9000
      - S3_AWS_ACCESS_KEY_ID=${S3_ACCESS_KEY:-minioadmin}
      - S3_AWS_SECRET_ACCESS_KEY=${S3_SECRET_KEY:-minioadmin}
      - RAW_BUCKET_NAME=raw-images
      - PROCESSED_BUCKET_NAME=processed-images
      
      # Python Config
      - PYTHONUNBUFFERED=1
    networks:
      - backend-net
    depends_on:
      kafka:
        condition: service_healthy
      rustfs:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s # Give Python time to boot up
    # Optional: Deploy multiple replicas if you have multiple Kafka partitions
    # deploy:
    #   replicas: 2
    #   resources:
    #     limits:
    #       cpus: '1.0'
    #       memory: 512M

  notification-worker:
    build:
      context: .
      dockerfile: docker/email-notification.Dockerfile
      target: production
    container_name: notification-worker
    environment:
      - KAFKA_BOOTSTRAP_SERVERS=kafka:9092
      - TOPIC=image.avif.ready
      - SMTP_HOST=mailpit
      - SMTP_PORT=1025
      - FROM_EMAIL=noreply@image-platform.local
      - FRONTEND_BASE_URL=http://localhost
    depends_on:
      kafka:
        condition: service_healthy
      mailpit:
        condition: service_healthy
    networks:
      - backend-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s # Give Python time to boot up

  # --- FRONTEND & EDGE ---
  nginx-proxy:
    build:
      context: .
      dockerfile: docker/nginx-proxy.Dockerfile
    container_name: nginx-gateway
    ports:
      - "80:80"
    depends_on:
      bff-token-handler:
        condition: service_healthy
    networks:
      - backend-net
    healthcheck:
      # We check the local port 80. -f ensures failure on 4xx/5xx errors.
      test: ["CMD-SHELL", "curl -f http://localhost:80/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
  
  # --- MONITORING: LOGS & METRICS ---

  loki:
    image: grafana/loki:main-e569e10
    container_name: loki
    ports:
      - "3100:3100"
    command: -config.file=/etc/loki/local-config.yaml
    networks:
      - backend-net
    healthcheck:
      test: wget --quiet --tries=1 --output-document=- http://localhost:3100/ready | grep -q -w ready || exit 1
      start_period: 20s
      interval: 10s
      timeout: 5s
      retries: 12  

  alloy:
    image: grafana/alloy:v1.14.0
    hostname: srv-test-1
    container_name: alloy
    # user: root
    volumes:
      # Map the local config file to the container path
      - ./config/grafana_alloy/config.alloy:/etc/alloy/config.alloy:ro
      # Map the Docker socket so Alloy can discover other containers
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # Map the log directory (where Docker stores container output)
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - ./persistent_data/alloy:/var/lib/alloy/data # Persists the write-ahead log (WAL)
    command: [
      "run",
      "--server.http.listen-addr=0.0.0.0:12345",
      "--storage.path=/var/lib/alloy/data",
      "--stability.level=experimental",
      "--disable-reporting",
      "/etc/alloy/config.alloy"
    ]
    ports:
      - "12345:12345" # Alloy UI for debugging pipelines
    networks:
      - backend-net
    depends_on:
      - loki

  grafana:
    image: grafana/grafana:12.3
    container_name: grafana
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
    # Persists users, dashboards, and data source configurations
    volumes:
      - ./persistent_data/grafana:/var/lib/grafana
    depends_on:
      - loki
    networks:
      - backend-net
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:3000/api/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5

networks:
  backend-net:
    driver: bridge
    name: backend-net

secrets:
  db_kc_password:
    file: ./secrets/keycloak/db_kc_password.txt
  kc_admin_password:
    file: ./secrets/keycloak/kc_admin_password.txt
  db_asset_password:
    file: ./secrets/postgres-asset-metadata/db_asset_password.txt
  bff_client_secret:
    file: ./secrets/bff/bff_client_secret.txt