docker-compose.yml

volumes:
  postgres_data:
  prometheus_data:
  grafana_data:
  loki_data:
  backup_data:

services:
  # ── Database ─────────────────────────────────────
  postgres:
    image: postgres:16-alpine
    container_name: exeos-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    ports:
      - "127.0.0.1:5432:5432"
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "2", memory: "2G" }
        reservations: { cpus: "0.5", memory: "256M" }

  postgres-exporter:
    image: prometheuscommunity/postgres-exporter:latest
    container_name: exeos-pg-exporter
    environment:
      DATA_SOURCE_NAME: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable
    ports:
      - "127.0.0.1:9187:9187"
    depends_on: { postgres: { condition: service_healthy } }
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.2", memory: "64M" }

  # ── Cache ────────────────────────────────────────
  redis:
    image: redis:7-alpine
    container_name: exeos-redis
    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD}", "--appendonly", "no"]
    ports:
      - "127.0.0.1:6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 5s
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "512M" }
        reservations: { cpus: "0.25", memory: "128M" }

  redis-exporter:
    image: oliver006/redis_exporter:latest
    container_name: exeos-redis-exporter
    environment:
      REDIS_ADDR: redis://redis:6379
      REDIS_PASSWORD: ${REDIS_PASSWORD}
    ports:
      - "127.0.0.1:9121:9121"
    depends_on: { redis: { condition: service_healthy } }
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.2", memory: "64M" }

  # ── Message Broker ───────────────────────────────
  zookeeper:
    image: confluentinc/cp-zookeeper:7.6.1
    container_name: exeos-zookeeper
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000
    healthcheck:
      test: ["CMD", "nc", "-z", "127.0.0.1", "2181"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 20s
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.3", memory: "256M" }
        reservations: { cpus: "0.1", memory: "128M" }

  kafka:
    image: confluentinc/cp-kafka:7.6.1
    container_name: exeos-kafka
    depends_on:
      zookeeper: { condition: service_healthy }
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://127.0.0.1:9092
      KAFKA_LISTENERS: PLAINTEXT://0.0.0.0:9092
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_LOG_RETENTION_HOURS: 168
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
    ports:
      - "127.0.0.1:9092:9092"
    healthcheck:
      test: ["CMD", "nc", "-z", "127.0.0.1", "9092"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 30s
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "512M" }
        reservations: { cpus: "0.25", memory: "256M" }

  # ── API Gateway ──────────────────────────────────
  apisix:
    image: apache/apisix:3.17.0-debian
    container_name: exeos-apisix
    ports:
      - "80:9080"
      - "443:9443"
      - "127.0.0.1:9091:9091"
    volumes:
      - ./apisix/config.yaml:/usr/local/apisix/conf/config.yaml
      - ./apisix/apisix.yaml:/usr/local/apisix/conf/apisix.yaml:ro
      - ./certs/tls.crt:/usr/local/apisix/conf/cert/tls.crt:ro
      - ./certs/tls.key:/usr/local/apisix/conf/cert/tls.key:ro
    environment:
      JWT_SECRET: ${JWT_SECRET}
      API_KEY: ${API_KEY}
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      CORS_ORIGINS: ${CORS_ORIGINS}
    depends_on:
      redis: { condition: service_healthy }
    healthcheck:
      test: ["CMD", "curl", "-s", "-o", "/dev/null", "http://127.0.0.1:9080/"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 15s
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "1", memory: "512M" }
        reservations: { cpus: "0.5", memory: "256M" }

  # ── Microservices ────────────────────────────────
  identity:
    build:
      context: .
      dockerfile: apps/identity/Dockerfile
      args: { SERVICE: identity, PORT: 8081 }
    container_name: exeos-identity
    expose: ["8081"]
    environment:
      SERVER_HOST: 0.0.0.0
      SERVER_PORT: 8081
      RUST_LOG: ${RUST_LOG}
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/identity
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      KAFKA_BROKERS: kafka:9092
      KAFKA_TOPIC: exeos-events
    depends_on:
      postgres: { condition: service_started }
      redis: { condition: service_healthy }
      kafka: { condition: service_healthy }
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "256M" }
        reservations: { cpus: "0.25", memory: "64M" }

  notification:
    build:
      context: .
      dockerfile: apps/notification/Dockerfile
      args: { SERVICE: notification, PORT: 8084 }
    container_name: exeos-notification
    expose: ["8084"]
    environment:
      SERVER_HOST: 0.0.0.0
      SERVER_PORT: 8084
      RUST_LOG: ${RUST_LOG}
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/notification
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      KAFKA_BROKERS: kafka:9092
      KAFKA_TOPIC: exeos-events
      KAFKA_GROUP_ID: notification-consumer
    depends_on:
      postgres: { condition: service_started }
      redis: { condition: service_healthy }
      kafka: { condition: service_healthy }
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "256M" }
        reservations: { cpus: "0.25", memory: "64M" }

  audit:
    build:
      context: .
      dockerfile: apps/audit/Dockerfile
      args: { SERVICE: audit, PORT: 8082 }
    container_name: exeos-audit
    expose: ["8082"]
    environment:
      SERVER_HOST: 0.0.0.0
      SERVER_PORT: 8082
      RUST_LOG: ${RUST_LOG}
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/audit
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      KAFKA_BROKERS: kafka:9092
      KAFKA_TOPIC: exeos-events
      KAFKA_GROUP_ID: audit-consumer
    depends_on:
      postgres: { condition: service_started }
      redis: { condition: service_healthy }
      kafka: { condition: service_healthy }
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "256M" }
        reservations: { cpus: "0.25", memory: "64M" }

  analytics:
    build:
      context: .
      dockerfile: apps/analytics/Dockerfile
      args: { SERVICE: analytics, PORT: 8083 }
    container_name: exeos-analytics
    expose: ["8083"]
    environment:
      SERVER_HOST: 0.0.0.0
      SERVER_PORT: 8083
      RUST_LOG: ${RUST_LOG}
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/analytics
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
    depends_on:
      postgres: { condition: service_started }
      redis: { condition: service_healthy }
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "256M" }
        reservations: { cpus: "0.25", memory: "64M" }

  # ── Monitoring ───────────────────────────────────
  prometheus:
    image: prom/prometheus:v2.53.0
    container_name: exeos-prometheus
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=30d
      - --web.console.libraries=/etc/prometheus/console_libraries
      - --web.console.templates=/etc/prometheus/consoles
      - --web.enable-lifecycle
    volumes:
      - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./monitoring/prometheus/rules:/etc/prometheus/rules:ro
      - prometheus_data:/prometheus
    ports:
      - "127.0.0.1:9090:9090"
    depends_on:
      apisix: { condition: service_healthy }
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9090/-/ready"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "512M" }
        reservations: { cpus: "0.25", memory: "256M" }

  alertmanager:
    image: prom/alertmanager:v0.27.0
    container_name: exeos-alertmanager
    command:
      - --config.file=/etc/alertmanager/alertmanager.yml
      - --storage.path=/alertmanager
    volumes:
      - ./monitoring/alertmanager:/etc/alertmanager:ro
    ports:
      - "127.0.0.1:9093:9093"
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.2", memory: "128M" }

  grafana:
    image: grafana/grafana:11.1.0
    container_name: exeos-grafana
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-admin}
      GF_INSTALL_PLUGINS: ""
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      GF_SERVER_ROOT_URL: https://monitor.your-production-domain.com
      GF_UNIFIED_ALERTING_ENABLED: "true"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
    ports:
      - "127.0.0.1:3000:3000"
    depends_on:
      prometheus: { condition: service_healthy }
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/api/health"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 15s
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "512M" }
        reservations: { cpus: "0.25", memory: "128M" }

  # ── Logging ──────────────────────────────────────
  loki:
    image: grafana/loki:3.0.0
    container_name: exeos-loki
    command: -config.file=/etc/loki/loki-config.yml
    volumes:
      - ./monitoring/loki/loki-config.yml:/etc/loki/loki-config.yml:ro
      - loki_data:/loki
    ports:
      - "127.0.0.1:3100:3100"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3100/ready"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "256M" }
        reservations: { cpus: "0.25", memory: "128M" }

  promtail:
    image: grafana/promtail:3.0.0
    container_name: exeos-promtail
    command: -config.file=/etc/promtail/promtail-config.yml
    volumes:
      - ./monitoring/promtail/promtail-config.yml:/etc/promtail/promtail-config.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/log:/var/log:ro
    depends_on:
      loki: { condition: service_healthy }
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.3", memory: "128M" }
        reservations: { cpus: "0.1", memory: "64M" }

  # ── Host Monitoring ──────────────────────────────
  node-exporter:
    image: prom/node-exporter:v1.8.1
    container_name: exeos-node-exporter
    command:
      - --path.rootfs=/host
      - --path.procfs=/host/proc
      - --path.sysfs=/host/sys
      - --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)
    volumes:
      - /:/host:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
    ports:
      - "127.0.0.1:9100:9100"
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.2", memory: "128M" }
        reservations: { cpus: "0.1", memory: "64M" }

  # ── Backup ───────────────────────────────────────
  backup:
    image: postgres:16-alpine
    container_name: exeos-backup
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      PGHOST: postgres
      PGPORT: 5432
    volumes:
      - backup_data:/backups
      - ./scripts/backup.sh:/backup.sh:ro
    entrypoint: |
      sh -c '
        echo "0 3 * * * /backup.sh" | crontab -
        crond -f -l 2
      '
    depends_on:
      postgres: { condition: service_healthy }
    restart: unless-stopped
    deploy:
      resources:
        limits: { cpus: "0.5", memory: "128M" }