docker-compose.dev.yml

---
# Development override for docker-compose.yml
# Note: version field is obsolete in Docker Compose v2+
# Usage: docker compose -f docker-compose.yml -f docker-compose.dev.yml up
# This file extends the base docker-compose.yml with development services
#
# REQUIRED ENVIRONMENT VARIABLES:
#   - POSTGRES_PASSWORD: PostgreSQL password
#   - REDIS_PASSWORD: Redis password
#   - RABBITMQ_PASSWORD: RabbitMQ password
#   - S3_SECRET_KEY: MinIO secret key
#   - DATABASE_URL: Full database connection URL (or will be constructed from POSTGRES_* vars)
#   - REDIS_URL: Full Redis connection URL (or will be constructed from REDIS_PASSWORD)
#   - RABBITMQ_URL: Full RabbitMQ connection URL (or will be constructed from RABBITMQ_* vars)
#
# For local development, create .env file with these variables.
# See docs/deployment/setup.md for example configuration.

services:
  # Gateway Service (Node.js API Gateway)
  gateway:
    build:
      context: .
      dockerfile: apps/gateway/Dockerfile
    container_name: accellens-gateway
    # Note: Using root user in dev for chown operations on mounted volumes
    # In production, this should use non-root user from Dockerfile
    user: root
    environment:
      NODE_ENV: development
      APP_ENV: dev
      GATEWAY_PORT: '8000'
      GATEWAY_HOST: '0.0.0.0'
      ENABLE_SWAGGER: 'true'
      DATABASE_URL: postgresql://${POSTGRES_USER:-accellens}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-accellens}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      RABBITMQ_URL: amqp://${RABBITMQ_USER:-accellens}:${RABBITMQ_PASSWORD}@rabbitmq:5672/
      S3_ENDPOINT: http://minio:9000
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-accellens}
      S3_SECRET_KEY: ${S3_SECRET_KEY}
      S3_BUCKET: accellens-artifacts
      LOG_LEVEL: DEBUG
      AUDIT_LOG_USE_POSTGRESQL: 'true'
      PYTHON_SERVICE_URL: http://services:8000
      GATEWAY_API_KEY: ${GATEWAY_API_KEY}
      JWT_SECRET: ${JWT_SECRET}
      # Node.js memory optimization (limit heap to 768MB)
      NODE_OPTIONS: '--max-old-space-size=768'
      # AI Providers Configuration
      OLLAMA_HOST: http://ollama:11434
      # SSO OIDC Configuration
      # Note: Issuer URL must be localhost:8080 because Keycloak returns tokens with issuer localhost:8080
      # (browser accesses Keycloak via localhost:8080, so tokens have that issuer)
      SSO_OIDC_ENABLED: 'true'
      SSO_OIDC_ISSUER_URL: http://localhost:8080/realms/accellens-dev
      SSO_OIDC_DISCOVERY_URL: http://keycloak:8080/realms/accellens-dev
      SSO_OIDC_CLIENT_ID: accellens-dev
      SSO_OIDC_CLIENT_SECRET: ${SSO_OIDC_CLIENT_SECRET}
      SSO_OIDC_REDIRECT_URI: http://localhost:8000/api/v1/auth/sso/oidc/callback
      SSO_OIDC_SCOPES: openid profile email
      # SSO Whitelist Configuration (optional)
      # SSO_WHITELIST_ENABLED: 'true'
      # SSO_WHITELIST_EMAILS: 'user1@example.com,user2@example.com'
      FRONTEND_URL: http://localhost:3002
      # SSO Configuration (SAML) - uncomment and configure if needed
      # SSO_SAML_ENABLED: "true"
      # SSO_SAML_ENTRY_POINT: https://your-idp.com/sso/saml
      # SSO_SAML_ISSUER: accellens
      # SSO_SAML_CERT: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
      # SSO_SAML_CALLBACK_URL: http://localhost:8000/api/v1/auth/sso/saml/callback
    ports:
      - '8000:8000'
    volumes:
      - .:/workspace
      - gateway_node_modules:/workspace/node_modules
      - gateway_app_node_modules:/workspace/apps/gateway/node_modules
    networks:
      - accellens-network
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      minio:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      services:
        condition: service_healthy
      ollama:
        condition: service_healthy
    working_dir: /workspace
    command: >
      sh -c "
      chown -R gateway:gateway /workspace 2>/dev/null || true;
      if [ ! -d 'node_modules' ] || [ ! -d 'apps/gateway/node_modules/fastify' ]; then
        echo 'Node modules missing or empty, running npm install...'
        HUSKY=0 npm install
      fi;
      cd apps/gateway && npm run dev
      "
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '1.5'
          memory: 2G
        reservations:
          cpus: '0.2'
          memory: 512M
    labels:
      - 'com.accellens.service=gateway'
      - 'com.accellens.environment=development'
      - 'com.accellens.version=dev'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    healthcheck:
      test:
        - CMD-SHELL
        # yamllint disable-line line-length
        - >-
          node -e "const h=require('http');h.get('http://localhost:8000/health',r=>{let d='';r.on('data',c=>d+=c);r.on('end',()=>process.exit(r.statusCode===200?0:1));}).on('error',()=>process.exit(1)).setTimeout(5000,()=>process.exit(1))" || exit 1
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 120s

  # Keycloak (SSO Identity Provider)
  keycloak:
    image: quay.io/keycloak/keycloak:latest
    container_name: accellens-keycloak
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
      KC_HEALTH_ENABLED: 'true'
      KC_METRICS_ENABLED: 'true'
      # Disable HTTPS requirement for development
      KC_HTTP_RELATIVE_PATH: /
      KC_PROXY: edge
      KC_PROXY_ADDRESS_FORWARDING: 'true'
      # Don't set hostname - let Keycloak use request URL for redirects
      # This ensures redirects use localhost:8080 (accessible from browser)
    ports:
      - '8080:8080'
    volumes:
      - keycloak_data:/opt/keycloak/data
    networks:
      - accellens-network
    command: start-dev --http-relative-path=/
    healthcheck:
      test:
        - CMD-SHELL
        - >-
          bash -c "cat < /dev/null > /dev/tcp/localhost/8080" || exit 1
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 120s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 512M
    labels:
      - 'com.accellens.service=keycloak'
      - 'com.accellens.type=infrastructure'
      - 'com.accellens.environment=development'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'

  # Services (Python Microservices)
  services:
    build:
      context: .
      dockerfile: apps/services/Dockerfile
    container_name: accellens-services
    user: root
    environment:
      APP_ENV: dev
      PYTHONPATH: /workspace/apps/services
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-accellens}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-accellens}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      RABBITMQ_URL: amqp://${RABBITMQ_USER:-accellens}:${RABBITMQ_PASSWORD}@rabbitmq:5672/
      JWT_SECRET: ${JWT_SECRET}
      S3_ENDPOINT: http://minio:9000
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-accellens}
      S3_SECRET_KEY: ${S3_SECRET_KEY}
      S3_BUCKET: accellens-artifacts
      S3_PUBLIC_ENDPOINT: http://localhost:9010
      LOG_LEVEL: DEBUG

      GATEWAY_URL: http://gateway:8000
      GATEWAY_API_KEY: ${GATEWAY_API_KEY}
      # AI Providers Configuration
      # Qwen is the primary provider, Phi and Llama are fallback providers
      # All providers work through Ollama API (local, no API keys required)
      OLLAMA_HOST: http://ollama:11434
      QWEN_MODEL: qwen2.5-coder:3b-instruct
      PHI_MODEL: phi3:mini
      LLAMA_MODEL: llama3.2:3b
      AI_PRIMARY_PROVIDER: qwen
      AI_FALLBACK_PROVIDER: phi
    volumes:
      - .:/workspace
      - services_workspace_venv:/workspace/venv
      - services_app_venv:/workspace/apps/services/.venv
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - accellens-network
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      minio:
        condition: service_healthy
    working_dir: /workspace/apps/services
    command: uvicorn main:app --host 0.0.0.0 --port 8000 --reload
    restart: unless-stopped
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'python -c "import urllib.request; urllib.request.urlopen(\"http://localhost:8000/health/ready\")" || exit 1',
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 60s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.2'
          memory: 512M
    labels:
      - 'com.accellens.service=services'
      - 'com.accellens.environment=development'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    tmpfs:
      - /tmp:noexec,nosuid,size=100m

  # Celery Worker
  celery-worker:
    build:
      context: .
      dockerfile: apps/services/Dockerfile
    container_name: accellens-celery-worker
    user: root
    environment:
      APP_ENV: dev
      PYTHONPATH: /workspace/apps/services:/workspace
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-accellens}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-accellens}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      RABBITMQ_URL: amqp://${RABBITMQ_USER:-accellens}:${RABBITMQ_PASSWORD}@rabbitmq:5672/
      S3_ENDPOINT: http://minio:9000
      S3_ACCESS_KEY: accellens
      S3_SECRET_KEY: ${S3_SECRET_KEY}
      S3_BUCKET: accellens-artifacts
      S3_PUBLIC_ENDPOINT: http://localhost:9010
      LOG_LEVEL: DEBUG
      GATEWAY_URL: http://gateway:8000
      GATEWAY_API_KEY: ${GATEWAY_API_KEY}
      # AI Providers Configuration
      # Qwen is the primary provider, Phi and Llama are fallback providers
      # All providers work through Ollama API (local, no API keys required)
      OLLAMA_HOST: http://ollama:11434
      QWEN_MODEL: qwen2.5-coder:3b-instruct
      PHI_MODEL: phi3:mini
      LLAMA_MODEL: llama3.2:3b
      AI_PRIMARY_PROVIDER: qwen
      AI_FALLBACK_PROVIDER: phi
      # Prometheus Push Gateway for metrics from worker processes
      PUSHGATEWAY_URL: http://pushgateway:9091
    volumes:
      - .:/workspace
      - services_workspace_venv:/workspace/venv
      - services_app_venv:/workspace/apps/services/.venv
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - accellens-network
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      minio:
        condition: service_healthy
    working_dir: /workspace/apps/services
    command:
      - sh
      - -c
      - |
        # Install all dependencies from pyproject.toml
        # Volume mounts override installed packages, so we need to reinstall them
        echo "Installing dependencies from pyproject.toml..."
        cd /workspace/apps/services
        if [ -f "pyproject.toml" ]; then
          pip install --user -q -e . || pip install -q -e . || echo "Warning: pip install -e . failed, continuing..."
        else
          echo "Warning: pyproject.toml not found, skipping editable install"
        fi
        # Verify critical dependencies are available
        python -c "import docker; print(f'✓ docker module version: {docker.__version__}')" || {
          echo "ERROR: docker module not available"
          exit 1
        }
        python -c "import celery; print(f'✓ celery version: {celery.__version__}')" || {
          echo "ERROR: celery module not available"
          exit 1
        }
        python -c "import pydantic_settings; print('✓ pydantic_settings available')" || {
          echo "ERROR: pydantic_settings module not available"
          exit 1
        }
        # Verify celery_app can be imported
        # Add current directory to Python path explicitly
        export PYTHONPATH="/workspace/apps/services:/workspace:$$PYTHONPATH"
        python -c "import sys; sys.path.insert(0, '/workspace/apps/services'); import celery_app; print('✓ celery_app module found')" || {
          echo "ERROR: celery_app module not found"
          echo "PYTHONPATH: $$PYTHONPATH"
          echo "Current directory: $(pwd)"
          echo "Files in current directory:"
          ls -la | head -20
          echo "Checking celery_app.py:"
          ls -la celery_app.py || echo "celery_app.py not found"
          exit 1
        }
        # Wait for RabbitMQ to be fully ready (healthcheck may pass but broker not ready)
        echo "Waiting for RabbitMQ broker to be ready..."
        for i in $$(seq 1 30); do
          if python3 -c "import sys; sys.path.insert(0, '/workspace/apps/services'); from config import settings; from kombu import Connection; conn = Connection(settings.celery_broker); conn.ensure_connection(max_retries=1, timeout=2); print('✓ RabbitMQ broker is ready')" 2>/dev/null; then
            break
          fi
          echo "Waiting for RabbitMQ... (attempt $$i/30)"
          sleep 2
        done
        # Start celery worker listening to BOTH default and AI queues
        # The dedicated AI worker (celery-ai-worker) listens ONLY to ai_processing queue
        # This worker handles both, so AI tasks are processed even without dedicated worker
        exec python -m celery -A celery_app worker --loglevel=info --concurrency=4 --queues=celery,ai_processing
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.2'
          memory: 512M
    labels:
      - 'com.accellens.service=celery-worker'
      - 'com.accellens.environment=development'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    healthcheck:
      test:
        ['CMD-SHELL', 'cd /workspace/apps/services && python -m apps.services.healthcheck celery --timeout 5 || exit 1']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Celery Beat (Scheduler)
  celery-beat:
    build:
      context: .
      dockerfile: apps/services/Dockerfile
    container_name: accellens-celery-beat
    environment:
      APP_ENV: dev
      PYTHONPATH: /workspace/apps/services:/workspace
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-accellens}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-accellens}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      RABBITMQ_URL: amqp://${RABBITMQ_USER:-accellens}:${RABBITMQ_PASSWORD}@rabbitmq:5672/
      S3_ENDPOINT: http://minio:9000
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-accellens}
      S3_SECRET_KEY: ${S3_SECRET_KEY}
      S3_BUCKET: accellens-artifacts
      LOG_LEVEL: DEBUG
    volumes:
      - .:/workspace
      - services_workspace_venv:/workspace/venv
      - services_app_venv:/workspace/apps/services/.venv
    networks:
      - accellens-network
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    working_dir: /workspace/apps/services
    # Install dependencies on startup, then run celery beat
    # Dependencies from Dockerfile may not be accessible due to volume mounts
    # Use --user flag to install to user directory (no root required)
    command:
      - sh
      - -c
      - |
        # Check and install dependencies if needed
        if ! python -c "import pydantic_settings" 2>/dev/null || ! python -c "import docker" 2>/dev/null; then
          echo "Installing dependencies..."
          pip install --user -q -r /workspace/requirements.txt || pip install -q -r /workspace/requirements.txt
        fi
        # Verify critical dependencies
        python -c "import docker; print(f'✓ docker module version: {docker.__version__}')" || {
          echo "ERROR: docker module not available"
          exit 1
        }
        # Verify celery_app can be imported
        # Add current directory to Python path explicitly
        export PYTHONPATH="/workspace/apps/services:/workspace:$$PYTHONPATH"
        python -c "import sys; sys.path.insert(0, '/workspace/apps/services'); import celery_app; print('✓ celery_app module found')" || {
          echo "ERROR: celery_app module not found"
          echo "PYTHONPATH: $$PYTHONPATH"
          echo "Current directory: $(pwd)"
          echo "Files in current directory:"
          ls -la | head -20
          echo "Checking celery_app.py:"
          ls -la celery_app.py || echo "celery_app.py not found"
          exit 1
        }
        exec celery -A celery_app beat --loglevel=info --schedule=/tmp/celerybeat-schedule.db
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.1'
          memory: 256M
    labels:
      - 'com.accellens.service=celery-beat'
      - 'com.accellens.environment=development'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    healthcheck:
      test:
        ['CMD-SHELL', 'cd /workspace/apps/services && python -m apps.services.healthcheck celery --timeout 5 || exit 1']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Celery AI Worker (Dedicated worker for AI processing tasks)
  # This worker ONLY processes AI-related tasks from the ai_processing queue
  # Can be horizontally scaled: docker compose up --scale celery-ai-worker=3
  celery-ai-worker:
    build:
      context: .
      dockerfile: apps/services/Dockerfile
    container_name: accellens-celery-ai-worker
    user: root
    environment:
      APP_ENV: dev
      PYTHONPATH: /workspace/apps/services:/workspace
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-accellens}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-accellens}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      RABBITMQ_URL: amqp://${RABBITMQ_USER:-accellens}:${RABBITMQ_PASSWORD}@rabbitmq:5672/
      S3_ENDPOINT: http://minio:9000
      S3_ACCESS_KEY: accellens
      S3_SECRET_KEY: ${S3_SECRET_KEY}
      S3_BUCKET: accellens-artifacts
      S3_PUBLIC_ENDPOINT: http://localhost:9010
      LOG_LEVEL: DEBUG
      GATEWAY_URL: http://gateway:8000
      GATEWAY_API_KEY: ${GATEWAY_API_KEY}
      # AI Providers Configuration
      OLLAMA_HOST: http://ollama:11434
      QWEN_MODEL: qwen2.5-coder:3b-instruct
      PHI_MODEL: phi3:mini
      LLAMA_MODEL: llama3.2:3b
      AI_PRIMARY_PROVIDER: qwen
      AI_FALLBACK_PROVIDER: phi
      # AI Queue Configuration
      AI_QUEUE_ENABLED: 'true'
      AI_QUEUE_NAME: ai_processing
      AI_PROCESSING_CONCURRENCY: '2'
      AI_ENABLE_BATCH_PROCESSING: 'true'
      # Prometheus Push Gateway for metrics from worker processes
      PUSHGATEWAY_URL: http://pushgateway:9091
    volumes:
      - .:/workspace
      - services_workspace_venv:/workspace/venv
      - services_app_venv:/workspace/apps/services/.venv
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - accellens-network
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      minio:
        condition: service_healthy
      ollama:
        condition: service_healthy
    working_dir: /workspace/apps/services
    command:
      - sh
      - -c
      - |
        # Install all dependencies from pyproject.toml
        echo "Installing dependencies from pyproject.toml..."
        cd /workspace/apps/services
        if [ -f "pyproject.toml" ]; then
          pip install --user -q -e . || pip install -q -e . || echo "Warning: pip install -e . failed, continuing..."
        else
          echo "Warning: pyproject.toml not found, skipping editable install"
        fi
        # Verify critical dependencies are available
        python -c "import celery; print(f'✓ celery version: {celery.__version__}')" || {
          echo "ERROR: celery module not available"
          exit 1
        }
        # Verify celery_app can be imported
        export PYTHONPATH="/workspace/apps/services:/workspace:$$PYTHONPATH"
        python -c "import sys; sys.path.insert(0, '/workspace/apps/services'); import celery_app; print('✓ celery_app module found')" || {
          echo "ERROR: celery_app module not found"
          exit 1
        }
        # Wait for RabbitMQ to be fully ready
        echo "Waiting for RabbitMQ broker to be ready..."
        for i in $$(seq 1 30); do
          if python3 -c "import sys; sys.path.insert(0, '/workspace/apps/services'); from config import settings; from kombu import Connection; conn = Connection(settings.celery_broker); conn.ensure_connection(max_retries=1, timeout=2); print('✓ RabbitMQ broker is ready')" 2>/dev/null; then
            break
          fi
          echo "Waiting for RabbitMQ... (attempt $$i/30)"
          sleep 2
        done
        # Start celery worker for AI queue ONLY
        # Uses --queues to listen only to the ai_processing queue
        echo "Starting AI worker listening on queue: ai_processing"
        exec python -m celery -A celery_app worker --loglevel=info --concurrency=2 --queues=ai_processing --hostname=ai-worker@%h
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 1G
    labels:
      - 'com.accellens.service=celery-ai-worker'
      - 'com.accellens.type=ai'
      - 'com.accellens.environment=development'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    healthcheck:
      test:
        ['CMD-SHELL', 'cd /workspace/apps/services && python -m apps.services.healthcheck celery --timeout 5 || exit 1']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # Unleash Feature Flags (PostgreSQL)
  unleash-db:
    image: postgres:15-alpine
    container_name: accellens-unleash-db
    environment:
      POSTGRES_DB: unleash
      POSTGRES_USER: unleash_user
      POSTGRES_PASSWORD: ${UNLEASH_DB_PASSWORD:-unleash_password}
    ports:
      - '5434:5432'
    volumes:
      - unleash_db_data:/var/lib/postgresql/data
    networks:
      - accellens-network
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U unleash_user -d unleash']
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.1'
          memory: 256M
    labels:
      - 'com.accellens.service=unleash-db'
      - 'com.accellens.environment=development'

  # Unleash Feature Flags (Server)
  unleash:
    image: unleashorg/unleash-server:latest
    container_name: accellens-unleash
    environment:
      DATABASE_HOST: unleash-db
      DATABASE_NAME: unleash
      DATABASE_USERNAME: unleash_user
      DATABASE_PASSWORD: ${UNLEASH_DB_PASSWORD:-unleash_password}
      DATABASE_PORT: 5432
      DATABASE_SSL: 'false'
      LOG_LEVEL: info
      INIT_ADMIN_API_TOKENS: '*:*.unleash-insecure-admin-api-token'
      INIT_CLIENT_API_TOKENS: 'default:development.unleash-insecure-client-api-token'
      INIT_FRONTEND_API_TOKENS: 'default:development.unleash-insecure-frontend-api-token'
    ports:
      - '4242:4242'
    networks:
      - accellens-network
    depends_on:
      unleash-db:
        condition: service_healthy
    healthcheck:
      test: ['CMD', 'nc', '-z', 'localhost', '4242']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.2'
          memory: 512M
    labels:
      - 'com.accellens.service=unleash'
      - 'com.accellens.environment=development'

  # Scanner Web
  scanner-web:
    build:
      context: .
      dockerfile: apps/scanner-web/Dockerfile
    container_name: accellens-scanner-web
    # Note: Using root user in dev for chown operations on mounted volumes
    # In production, this should use non-root user from Dockerfile
    user: root
    environment:
      NODE_ENV: development
      APP_ENV: dev
      NPM_CONFIG_IGNORE_SCRIPTS: 'true'
      S3_ENDPOINT: http://minio:9000
      S3_ACCESS_KEY: accellens
      S3_SECRET_KEY: ${S3_SECRET_KEY}
      S3_BUCKET: accellens-artifacts
      SCANNER_MAX_CONCURRENCY: 2
      SCANNER_TIMEOUT_MS: 30000
      LOG_LEVEL: DEBUG
      PLAYWRIGHT_BROWSERS_PATH: /app/.playwright
    volumes:
      - .:/workspace
      - scanner_node_modules:/workspace/node_modules
      - scanner_app_node_modules:/workspace/apps/scanner-web/node_modules
    networks:
      - accellens-network
    depends_on:
      minio:
        condition: service_healthy
    working_dir: /workspace/apps/scanner-web
    command: sh -c '/workspace/apps/scanner-web/start-dev.sh'
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 1G
    labels:
      - 'com.accellens.service=scanner-web'
      - 'com.accellens.environment=development'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'node -e "const h=require(\"http\");h.get(\"http://localhost:3000/healthz\",r=>{let d=\"\";r.on(\"data\",c=>d+=c);r.on(\"end\",()=>process.exit(r.statusCode===200?0:1));}).on(\"error\",()=>process.exit(1)).setTimeout(5000,()=>process.exit(1))" || exit 1',
        ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    tmpfs:
      - /tmp:noexec,nosuid,size=500m
      - /home/scanner/.cache:size=1g

  # Frontend (Next.js Dashboard)
  frontend:
    build:
      context: .
      dockerfile: apps/frontend/Dockerfile
      target: dev
    container_name: accellens-frontend
    # Note: Using root user in dev for chown operations on mounted volumes
    # In production, this should use non-root user from Dockerfile
    user: root
    environment:
      NODE_ENV: development
      APP_ENV: dev
      NEXT_PUBLIC_API_URL: http://localhost:8000
      GATEWAY_URL: http://gateway:8000
      NEXT_PUBLIC_UNLEASH_URL: http://localhost:4242/api/frontend
      NEXT_PUBLIC_UNLEASH_CLIENT_KEY: '*:development.19f57454e465f3f39a14dba00e215dc88d5f0625e0b13f4e9c790b47'
      PORT: 3002
      # Optimize Next.js compilation
      NEXT_TELEMETRY_DISABLED: '1'
      WATCHPACK_POLLING: 'false'
      # Disable polling for file changes (more efficient, uses inotify)
      CHOKIDAR_USEPOLLING: 'false'
      # Node.js memory optimization (limit heap to 1.5GB)
      # Enable GC statistics for debugging memory issues
      NODE_OPTIONS: '--max-old-space-size=1536 --expose-gc'
      # Improve stability with faster GC
      NODE_ENV_GARBAGE_COLLECT_INTERVAL: '30000'
    ports:
      - '3002:3002'
    volumes:
      - .:/workspace
      - frontend_node_modules:/workspace/node_modules
      - frontend_app_node_modules:/workspace/apps/frontend/node_modules
      - frontend_next_cache:/workspace/apps/frontend/.next
      # Keep Next.js cache inside container volume to avoid host FS issues
      # The cache is pruned automatically when container is removed
    networks:
      - accellens-network
    depends_on:
      gateway:
        condition: service_started
    working_dir: /workspace
    command: |
      sh -c '
        # Setup signal handling for graceful shutdown
        trap "echo Shutting down Next.js dev server...; exit 0" SIGTERM SIGINT

        chown -R frontend:frontend /workspace 2>/dev/null || true
        rm -rf apps/frontend/.next/cache 2>/dev/null || true
        rm -rf apps/frontend/.next/turbopack 2>/dev/null || true
        if [ ! -d node_modules ] || [ ! -f node_modules/.package-lock.json ]; then
          echo "Node modules missing or empty, running npm install..."
          npm install --include=optional
        fi
        cd apps/frontend && PORT=3002 npx next dev -p 3002 --turbopack
      '
    restart: unless-stopped
    healthcheck:
      test:
        - CMD-SHELL
        # yamllint disable-line line-length
        - >-
          node -e "const h=require('http');h.get('http://localhost:3002/api/health',r=>{let d='';r.on('data',c=>d+=c);r.on('end',()=>process.exit(r.statusCode===200?0:1));}).on('error',()=>process.exit(1)).setTimeout(5000,()=>process.exit(1))" || exit 1
      # Increased interval and retries to be more tolerant of HMR restarts
      interval: 15s
      timeout: 10s
      retries: 8
      start_period: 180s
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 4G
        reservations:
          cpus: '0.5'
          memory: 1G
    labels:
      - 'com.accellens.service=frontend'
      - 'com.accellens.environment=development'
    logging:
      driver: 'json-file'
      options:
        max-size: '10m'
        max-file: '3'
    tmpfs:
      - /tmp:noexec,nosuid,size=100m

  # Ollama (Local LLM for AI explanations)
  # Qwen is the primary provider, Phi and Llama are fallback providers
  ollama:
    image: ollama/ollama:latest
    container_name: accellens-ollama
    environment:
      OLLAMA_HOST: 0.0.0.0:11434
    ports:
      - '11434:11434'
    volumes:
      - ollama_data:/root/.ollama
    networks:
      - accellens-network
    restart: unless-stopped
    healthcheck:
      test: ['CMD-SHELL', 'bash -c "cat < /dev/null > /dev/tcp/localhost/11434" || exit 1']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # Ollama Models Init (loads models after Ollama is ready)
  ollama-init:
    image: ollama/ollama:latest
    container_name: accellens-ollama-init
    depends_on:
      ollama:
        condition: service_healthy
    networks:
      - accellens-network
    entrypoint: ['/bin/sh', '-c']
    command:
      - |
        echo "Waiting for Ollama to be ready..."
        export OLLAMA_HOST=http://ollama:11434
        for i in $$(seq 1 30); do
          if ollama list > /dev/null 2>&1; then
            echo "Ollama is ready, loading models..."
            break
          fi
          echo "Waiting for Ollama... (attempt $$i/30)"
          sleep 2
        done
        echo "Loading Qwen model (primary provider)..."
        ollama pull qwen2.5-coder:3b-instruct || echo "Warning: Failed to pull qwen2.5-coder:3b-instruct"
        echo "Loading Phi model (first fallback provider)..."
        ollama pull phi3:mini || echo "Warning: Failed to pull phi3:mini"
        echo "Loading Llama model (second fallback provider)..."
        ollama pull llama3.2:3b || echo "Warning: Failed to pull llama3.2:3b"
        echo "All models loaded. Checking installed models..."
        ollama list
    labels:
      - 'com.accellens.service=ollama-init'
      - 'com.accellens.type=ai'
      - 'com.accellens.environment=development'
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 2G
        reservations:
          cpus: '0.25'
          memory: 512M

  # Prometheus (Metrics Collection)
  prometheus:
    image: prom/prometheus:v2.48.1
    container_name: accellens-prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.enable-lifecycle'
    ports:
      - '9090:9090'
    volumes:
      - ./infra/observability/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    networks:
      - accellens-network
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.1'
          memory: 256M
    labels:
      - 'com.accellens.service=prometheus'
      - 'com.accellens.type=observability'
      - 'com.accellens.environment=development'
    healthcheck:
      test: ['CMD', 'wget', '-q', '--spider', 'http://localhost:9090/-/healthy']
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 10s

  # Prometheus Push Gateway (for Celery workers to push metrics)
  pushgateway:
    image: prom/pushgateway:v1.6.2
    container_name: accellens-pushgateway
    ports:
      - '9091:9091'
    networks:
      - accellens-network
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 128M
        reservations:
          cpus: '0.05'
          memory: 64M
    labels:
      - 'com.accellens.service=pushgateway'
      - 'com.accellens.type=observability'
      - 'com.accellens.environment=development'
    healthcheck:
      test: ['CMD', 'wget', '-q', '--spider', 'http://localhost:9091/-/healthy']
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 5s

  # Grafana (Metrics Visualization & Dashboards)
  grafana:
    image: grafana/grafana:10.2.3
    container_name: accellens-grafana
    ports:
      - '3003:3000'
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: admin
      GF_USERS_ALLOW_SIGN_UP: 'false'
      GF_SERVER_ROOT_URL: http://localhost:3003
      GF_INSTALL_PLUGINS: ''
      # Provisioning paths
      GF_PATHS_PROVISIONING: /etc/grafana/provisioning
    volumes:
      - grafana_data:/var/lib/grafana
      - ./infra/observability/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./infra/observability/grafana/provisioning:/etc/grafana/provisioning/datasources:ro
    networks:
      - accellens-network
    depends_on:
      prometheus:
        condition: service_healthy
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.1'
          memory: 256M
    labels:
      - 'com.accellens.service=grafana'
      - 'com.accellens.type=observability'
      - 'com.accellens.environment=development'
    healthcheck:
      test: ['CMD-SHELL', 'wget -q --spider http://localhost:3000/api/health || exit 1']
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 30s

volumes:
  postgres_data:
  redis_data:
  rabbitmq_data:
  minio_data:
  keycloak_data:
  gateway_node_modules:
  gateway_app_node_modules:
  services_workspace_venv:
  services_app_venv:
  scanner_node_modules:
  scanner_app_node_modules:
  frontend_node_modules:
  frontend_app_node_modules:
  frontend_next_cache:
  ollama_data:
  prometheus_data:
  grafana_data:
  unleash_db_data:

networks:
  accellens-network:
    # Network is defined in docker-compose.yml, no need to mark as external