docker-compose.yml

# docker-compose.yml
# SPECTRA-Lab Platform - Session 17 Development Environment
# (No `version:` key — obsolete in Compose v2 and ignored with a warning.)

services:
  # PostgreSQL Database
  db:
    image: postgres:15-alpine
    container_name: spectra-db
    environment:
      POSTGRES_USER: spectra
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD env var is required (see .env.example)}
      POSTGRES_DB: spectra
    ports:
      - "5435:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U spectra"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - spectra-network

  # Redis (for future sessions - caching, Celery)
  redis:
    image: redis:7-alpine
    container_name: spectra-redis
    ports:
      - "6381:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - spectra-network

  # Keycloak — local OIDC provider for Session 4.1.
  # Behind the `auth` Compose profile so it's opt-in:
  #   COMPOSE_PROFILES=auth docker compose up -d keycloak
  # Dev-mode (`start-dev`) uses an in-memory H2 database — zero config,
  # but state is lost on container removal. Production uses
  # `start --optimized` with an external Postgres. See docs/deployment/AUTH.md.
  keycloak:
    image: quay.io/keycloak/keycloak:25.0
    container_name: spectra-keycloak
    profiles: ["auth"]
    environment:
      # Admin credentials are env-driven — the hardcoded admin/admin literal
      # was a committed weak credential even behind the opt-in profile.
      # Defaults to EMPTY (not a `:?` hard-require: compose interpolates all
      # services at config time regardless of profiles, so `:?` would break
      # `docker compose up` for people not using the auth profile). Keycloak
      # itself refuses to bootstrap with an empty admin password, so this
      # still fails closed exactly when the profile is actually used.
      - KEYCLOAK_ADMIN=${KEYCLOAK_ADMIN:-admin}
      - KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD:-}
      - KC_HOSTNAME=localhost
      - KC_HOSTNAME_STRICT=false
      - KC_HTTP_ENABLED=true
    ports:
      - "8080:8080"
    volumes:
      # Dev realm auto-import (Phase 6.6): realm `spectra`, client
      # `spectra-backend`, role groups + demo SSO user. Dev-only — see
      # infra/keycloak/README.md.
      - ./infra/keycloak:/opt/keycloak/data/import:ro
    command: start-dev --import-realm
    networks:
      - spectra-network

  # Migration runner — Session 3.2.
  # One-shot service: runs `alembic upgrade head` and exits. Other
  # services declare `depends_on: migrate: { condition: service_completed_successfully }`
  # so they wait for migrations before booting. Mirrors the k8s init-container
  # pattern in k8s/base/analysis-deployment.yaml. See docs/deployment/MIGRATIONS.md.
  migrate:
    build:
      context: .
      dockerfile: services/analysis/Dockerfile
    container_name: spectra-migrate
    environment:
      - DATABASE_URL=postgresql+psycopg://spectra:${POSTGRES_PASSWORD}@db:5432/spectra
    depends_on:
      db:
        condition: service_healthy
    # No volume mounts: Phase 5.1 bakes alembic.ini, alembic/, the shared
    # package and seed_demo.py into the analysis image, so migrate runs the
    # image as-built (and the old file-over-dir nested binds broke on
    # docker-desktop virtiofs anyway).
    # Migrate, then seed the demo org + login users. seed_demo.py is
    # idempotent (no-ops if the Demo Lab org already exists), so this is
    # safe to run on every `docker compose up`. Without the seed step a
    # fresh stack has a schema but ZERO users, so login succeeds against
    # no one and every authenticated call 401s.
    command: sh -c "alembic upgrade head && python seed_demo.py"
    restart: "no"
    networks:
      - spectra-network

  # Analysis Service (FastAPI)
  analysis:
    build:
      context: .
      dockerfile: services/analysis/Dockerfile
    container_name: spectra-analysis
    environment:
      - DATABASE_URL=postgresql+psycopg://spectra:${POSTGRES_PASSWORD}@db:5432/spectra
      - REDIS_URL=redis://redis:6379/0
      - CELERY_BROKER_URL=redis://redis:6379/2
      - CELERY_RESULT_BACKEND=redis://redis:6379/2
      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET env var is required (see .env.example)}
      - JWT_ALGORITHM=HS256
      - JWT_ISSUER=spectra-lab
      # Phase 6.6: env-driven SSO. Off by default; flip via .env — see
      # infra/keycloak/README.md. Issuer/JWKS use the compose-internal
      # keycloak DNS so in-container JWKS fetches work; override for k8s.
      - OIDC_ENABLED=${OIDC_ENABLED:-false}
      - OIDC_ISSUER=${OIDC_ISSUER:-}
      - OIDC_ISSUER_INTERNAL=${OIDC_ISSUER_INTERNAL:-}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
      - OIDC_REDIRECT_URI=${OIDC_REDIRECT_URI:-}
      - OIDC_JWKS_URL=${OIDC_JWKS_URL_INTERNAL:-${OIDC_JWKS_URL:-}}
      - OIDC_DEFAULT_ORG_ID=${OIDC_DEFAULT_ORG_ID:-}
      - APP_REDIRECT_URL=${APP_REDIRECT_URL:-}
      - LOG_LEVEL=INFO
      # Object storage (Session 6.1)
      - OBJECT_STORE_ENDPOINT=http://minio:9000
      - OBJECT_STORE_BUCKET=${MINIO_BUCKET:-spectra-lab}
      - OBJECT_STORE_REGION=us-east-1
      - AWS_ACCESS_KEY_ID=${MINIO_ROOT_USER:-spectra-minio-admin}
      - AWS_SECRET_ACCESS_KEY=${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD env var is required}
      # Retention (Session 6.2) — dry-run is on by default. Flip the
      # var to "false" to make the nightly sweep actually delete.
      - RETENTION_DRY_RUN=${RETENTION_DRY_RUN:-true}
    ports:
      - "8001:8001"
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    volumes:
      - ./services/analysis:/app
      - ./services/shared:/app/services/shared
    command: uvicorn app.main:app --host 0.0.0.0 --port 8001 --reload
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8001/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - spectra-network

  # Celery Worker (CVD Background Tasks)
  celery-worker:
    build:
      context: .
      dockerfile: services/analysis/Dockerfile
    container_name: spectra-celery-worker
    environment:
      - DATABASE_URL=postgresql+psycopg://spectra:${POSTGRES_PASSWORD}@db:5432/spectra
      - REDIS_URL=redis://redis:6379/0
      - CELERY_BROKER_URL=redis://redis:6379/2
      - CELERY_RESULT_BACKEND=redis://redis:6379/2
      - LOG_LEVEL=INFO
      # Object storage (Session 6.1) — workers write CSV exports + telemetry blobs.
      - OBJECT_STORE_ENDPOINT=http://minio:9000
      - OBJECT_STORE_BUCKET=${MINIO_BUCKET:-spectra-lab}
      - OBJECT_STORE_REGION=us-east-1
      - AWS_ACCESS_KEY_ID=${MINIO_ROOT_USER:-spectra-minio-admin}
      - AWS_SECRET_ACCESS_KEY=${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD env var is required}
      # Retention dry-run (Session 6.2). Same default as the API.
      - RETENTION_DRY_RUN=${RETENTION_DRY_RUN:-true}
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - ./services/analysis:/app
      - ./services/shared:/app/services/shared
    # Workers consume from all three run queues plus the default
    # queue. To run a dedicated worker per process module in production
    # (recommended for isolation), launch separate worker processes with
    # --queues=cvd_runs / --queues=diffusion_runs / --queues=oxidation_runs.
    command: celery -A app.tasks worker --loglevel=info --concurrency=4 --queues=cvd_runs,diffusion_runs,oxidation_runs,monitoring,default
    healthcheck:
      test: ["CMD-SHELL", "celery -A app.tasks inspect ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    networks:
      - spectra-network

  # Celery Beat (Scheduled Tasks)
  celery-beat:
    build:
      context: .
      dockerfile: services/analysis/Dockerfile
    container_name: spectra-celery-beat
    environment:
      - DATABASE_URL=postgresql+psycopg://spectra:${POSTGRES_PASSWORD}@db:5432/spectra
      - REDIS_URL=redis://redis:6379/0
      - CELERY_BROKER_URL=redis://redis:6379/2
      - CELERY_RESULT_BACKEND=redis://redis:6379/2
      - LOG_LEVEL=INFO
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - ./services/analysis:/app
      - ./services/shared:/app/services/shared
    command: celery -A app.tasks beat --loglevel=info
    networks:
      - spectra-network

  # Flower (Celery Monitoring)
  flower:
    build:
      context: .
      dockerfile: services/analysis/Dockerfile
    container_name: spectra-flower
    environment:
      - CELERY_BROKER_URL=redis://redis:6379/2
      - CELERY_RESULT_BACKEND=redis://redis:6379/2
    ports:
      - "5555:5555"
    depends_on:
      - redis
      - celery-worker
    volumes:
      - ./services/analysis:/app
    command: celery -A app.tasks flower --port=5555
    networks:
      - spectra-network

  # LIMS Service (FastAPI)
  lims:
    build:
      context: .
      dockerfile: services/lims/Dockerfile
    container_name: spectra-lims
    environment:
      - DATABASE_URL=postgresql+psycopg://spectra:${POSTGRES_PASSWORD}@db:5432/spectra
      - REDIS_URL=redis://redis:6379/1
      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET env var is required (see .env.example)}
      - JWT_ALGORITHM=HS256
      - JWT_ISSUER=spectra-lab
      # Outbound email (Phase 7 — account lifecycle). Unset SMTP_HOST =
      # dev mode: emails are logged, not sent (reset links readable via
      # `docker logs spectra-lims`).
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_USERNAME=${SMTP_USERNAME:-}
      - SMTP_PASSWORD=${SMTP_PASSWORD:-}
      - SMTP_STARTTLS=${SMTP_STARTTLS:-true}
      - SMTP_FROM=${SMTP_FROM:-no-reply@spectra-lab.local}
      - APP_BASE_URL=${APP_BASE_URL:-http://localhost:3012}
      # Phase 6.6: env-driven SSO. Off by default; flip via .env — see
      # infra/keycloak/README.md. Issuer/JWKS use the compose-internal
      # keycloak DNS so in-container JWKS fetches work; override for k8s.
      - OIDC_ENABLED=${OIDC_ENABLED:-false}
      - OIDC_ISSUER=${OIDC_ISSUER:-}
      - OIDC_ISSUER_INTERNAL=${OIDC_ISSUER_INTERNAL:-}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
      - OIDC_REDIRECT_URI=${OIDC_REDIRECT_URI:-}
      - OIDC_JWKS_URL=${OIDC_JWKS_URL_INTERNAL:-${OIDC_JWKS_URL:-}}
      - OIDC_DEFAULT_ORG_ID=${OIDC_DEFAULT_ORG_ID:-}
      - APP_REDIRECT_URL=${APP_REDIRECT_URL:-}
      - LOG_LEVEL=INFO
      # Object storage (Session 6.1)
      - OBJECT_STORE_ENDPOINT=http://minio:9000
      - OBJECT_STORE_BUCKET=${MINIO_BUCKET:-spectra-lab}
      - OBJECT_STORE_REGION=us-east-1
      - AWS_ACCESS_KEY_ID=${MINIO_ROOT_USER:-spectra-minio-admin}
      - AWS_SECRET_ACCESS_KEY=${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD env var is required}
    ports:
      - "8002:8002"
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    volumes:
      - ./services/lims:/app
      - ./services/shared:/app/services/shared
    command: uvicorn app.main:app --host 0.0.0.0 --port 8002 --reload
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8002/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - spectra-network

  # Process Control Service (FastAPI) — Session 2.2
  # RTP, Ion Implantation, SPC, and Virtual Metrology endpoints. Drivers
  # operate in SIMULATION_MODE=true by default for local dev (real
  # hardware paths are imported but not wired to the wire).
  process_control:
    build:
      context: .
      dockerfile: services/process_control/Dockerfile
    container_name: spectra-process_control
    environment:
      - DATABASE_URL=postgresql+psycopg://spectra:${POSTGRES_PASSWORD}@db:5432/spectra
      - REDIS_URL=redis://redis:6379/2
      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET env var is required (see .env.example)}
      - SIMULATION_MODE=true
      - LOG_LEVEL=INFO
      # Object storage (Session 6.1) — VM model artifact storage.
      - OBJECT_STORE_ENDPOINT=http://minio:9000
      - OBJECT_STORE_BUCKET=${MINIO_BUCKET:-spectra-lab}
      - OBJECT_STORE_REGION=us-east-1
      - AWS_ACCESS_KEY_ID=${MINIO_ROOT_USER:-spectra-minio-admin}
      - AWS_SECRET_ACCESS_KEY=${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD env var is required}
    ports:
      - "8003:8003"
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    volumes:
      - ./services/process_control:/app
      - ./services/shared:/app/services/shared
    command: uvicorn app.main:app --host 0.0.0.0 --port 8003 --reload
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8003/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - spectra-network

  # Celery worker for process_control's ion/rtp queues (Phase 1.2). The pc
  # service has ALWAYS enqueued execute_ion_run/execute_rtp_run onto its own
  # Celery app ("ion"/"rtp" queues on redis db 2) — but no service consumed
  # them, so every submitted run sat QUEUED forever. Job state is shared with
  # the API via the pc_jobs table (migration 0016), which is what makes the
  # worker's progress updates visible to /api/v1/jobs.
  pc-worker:
    build:
      context: .
      dockerfile: services/process_control/Dockerfile
    container_name: spectra-pc-worker
    environment:
      - DATABASE_URL=postgresql+psycopg://spectra:${POSTGRES_PASSWORD}@db:5432/spectra
      - REDIS_URL=redis://redis:6379/2
      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET env var is required (see .env.example)}
      - SIMULATION_MODE=true
      - LOG_LEVEL=INFO
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    volumes:
      - ./services/process_control:/app
      - ./services/shared:/app/services/shared
    command: celery -A app.celery_app worker --loglevel=info --concurrency=2 --queues=ion,rtp,default
    healthcheck:
      test: ["CMD-SHELL", "celery -A app.celery_app inspect ping -d celery@$$HOSTNAME"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    networks:
      - spectra-network

  # Web Frontend (Next.js) — dev mode with bind mounts and hot reload.
  # The production image is built from apps/web/Dockerfile; this dev compose
  # entry uses apps/web/Dockerfile.dev.
  web:
    # DoD fix: this used to run the DEV server (Dockerfile.dev + `npm run
    # dev`) which listens on 3000 — while compose mapped 3012:3012, so the
    # containerized web was unreachable. Now it runs the PRODUCTION
    # standalone image (apps/web/Dockerfile, PORT=3012) with its proxy
    # rewrites pointed at the compose service DNS names.
    build:
      context: ./apps/web
      dockerfile: Dockerfile
    container_name: spectra-web
    environment:
      - NODE_ENV=production
      - ANALYSIS_INTERNAL_URL=http://analysis:8001
      - LIMS_INTERNAL_URL=http://lims:8002
      - PC_INTERNAL_URL=http://process_control:8003
    ports:
      - "3012:3012"
    depends_on:
      - analysis
      - lims
      - process_control
    networks:
      - spectra-network

  # MinIO (Object Storage - for Session 18)
  minio:
    image: minio/minio:latest
    container_name: spectra-minio
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-spectra-minio-admin}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD env var is required (see .env.example)}
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio_data:/data
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 15s
      timeout: 10s
      retries: 3
    networks:
      - spectra-network

  # MinIO bootstrap — Session 6.1.
  # Creates the application bucket on first boot and applies the
  # lifecycle policy from infra/minio/lifecycle.json (telemetry blobs
  # expire after 90 days; export files after 7 days). Idempotent —
  # subsequent runs are no-ops.
  minio-init:
    image: minio/mc:latest
    container_name: spectra-minio-init
    depends_on:
      minio:
        condition: service_healthy
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-spectra-minio-admin}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD env var is required}
      - MINIO_BUCKET=${MINIO_BUCKET:-spectra-lab}
    volumes:
      - ./infra/minio:/etc/minio:ro
    entrypoint: >
      /bin/sh -c "
        set -e;
        mc alias set local http://minio:9000 \"$$MINIO_ROOT_USER\" \"$$MINIO_ROOT_PASSWORD\";
        mc mb --ignore-existing local/$$MINIO_BUCKET;
        mc ilm rule add --expire-days 90 --prefix telemetry/ local/$$MINIO_BUCKET 2>/dev/null || true;
        mc ilm rule add --expire-days  7 --prefix exports/   local/$$MINIO_BUCKET 2>/dev/null || true;
        mc ilm rule add --abort-multipart-days 1               local/$$MINIO_BUCKET 2>/dev/null || true;
        echo 'minio-init complete';
      "
    restart: "no"
    networks:
      - spectra-network

  # Pushgateway — Session 6.3.
  # Receives `backup_last_success_timestamp_seconds` from the backup
  # CronJobs (k8s) or the manual scripts/backup_postgres.sh runs (dev).
  # Prometheus scrapes it at /metrics. Without this in compose, dev
  # operators have nowhere to test the alert path end-to-end before
  # production.
  pushgateway:
    image: prom/pushgateway:latest
    container_name: spectra-pushgateway
    ports:
      - "9091:9091"
    command:
      - --persistence.file=/data/pushgateway.dat
      - --persistence.interval=5m
    volumes:
      - pushgateway_data:/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:9091/-/healthy"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - spectra-network

  # Celery exporter — Phase 5.2.
  # Publishes Celery queue depth + task counters as Prometheus metrics
  # on port 9540. Reads broker state directly from Redis. Sidesteps
  # the need to expose /metrics from the worker container itself.
  celery-exporter:
    image: danihodovic/celery-exporter:latest
    container_name: spectra-celery-exporter
    environment:
      - CE_BROKER_URL=redis://redis:6379/2
      - CE_LOG_LEVEL=INFO
    ports:
      - "9540:9540"
    depends_on:
      redis:
        condition: service_healthy
    networks:
      - spectra-network

  # Prometheus (Metrics)
  prometheus:
    image: prom/prometheus:latest
    container_name: spectra-prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./infra/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - ./infra/prometheus/alerts.yml:/etc/prometheus/alerts.yml
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.enable-lifecycle'
    networks:
      - spectra-network

  # Alertmanager — Phase 5.3.
  # Receives firing alerts from Prometheus, deduplicates them, and
  # routes to webhook receivers (default: a no-op httpbin endpoint
  # for local dev). Production wiring lives in
  # docs/deployment/ALERTING.md.
  alertmanager:
    image: prom/alertmanager:latest
    container_name: spectra-alertmanager
    ports:
      - "9093:9093"
    volumes:
      - ./infra/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
    networks:
      - spectra-network

  # Grafana (Dashboards)
  grafana:
    image: grafana/grafana:latest
    container_name: spectra-grafana
    ports:
      - "3001:3000"
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=${GF_SECURITY_ADMIN_PASSWORD:?GF_SECURITY_ADMIN_PASSWORD env var is required (see .env.example)}
      - GF_USERS_ALLOW_SIGN_UP=false
    volumes:
      - grafana_data:/var/lib/grafana
      - ./infra/grafana/dashboards:/etc/grafana/provisioning/dashboards
      - ./infra/grafana/datasources:/etc/grafana/provisioning/datasources
    depends_on:
      - prometheus
    networks:
      - spectra-network

networks:
  spectra-network:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  minio_data:
  prometheus_data:
  grafana_data:
  pushgateway_data: