compose.yml

services:
  # PostgreSQL 18 - Main Database
  postgres:
    image: postgres:18-alpine@sha256:f898ac406e1a9e05115cc2efcb3c3abb3a92a4c0263f3b6f6aaae354cbb1953a
    container_name: node-pulse-postgres
    restart: unless-stopped
    env_file:
      - .env
    volumes:
      - ./postgres_data:/var/lib/postgresql
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready -U ${POSTGRES_USER:-postgres}
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - node-pulse-admiral

  # Valkey - Redis alternative for caching and sessions
  valkey:
    image: valkey/valkey:latest@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
    container_name: node-pulse-valkey
    restart: unless-stopped
    env_file:
      - .env
    command:
      - valkey-server
      - --appendonly
      - "yes"
      - --appendfsync
      - "everysec"
      - --maxmemory
      - "512mb"
      - --maxmemory-policy
      - "noeviction"
      - --requirepass
      - "${VALKEY_PASSWORD:-valkeypassword}"
    volumes:
      - ./valkey_data:/data
    healthcheck:
      test:
        - CMD
        - valkey-cli
        - --raw
        - incr
        - ping
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - node-pulse-admiral

  # Flagship Migration - Run database migrations (idempotent)
  flagship-migrate:
    image: ghcr.io/node-pulse/node-pulse-migrate:latest
    container_name: node-pulse-flagship-migrate
    env_file:
      - .env
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - node-pulse-admiral
    restart: "no"

  # Go-Gin Submarines Ingest - Agent Metrics Ingestion (HTTP -> Valkey Stream)
  submarines-ingest:
    image: ghcr.io/node-pulse/node-pulse-submarines-ingest:latest
    container_name: node-pulse-submarines-ingest
    restart: unless-stopped
    env_file:
      - .env
    environment:
      MASTER_KEY_PATH: /secrets/master.key
    ports:
      - "8080:8080"
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
    volumes:
      - ./secrets:/secrets:ro
    networks:
      - node-pulse-admiral

  # Go Submarines Digest - Background processor (Valkey Stream -> PostgreSQL)
  submarines-digest:
    image: ghcr.io/node-pulse/node-pulse-submarines-digest:latest
    container_name: node-pulse-submarines-digest
    restart: unless-stopped
    env_file:
      - .env
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
    networks:
      - node-pulse-admiral

  # Go Submarines Deployer - Ansible deployment worker (Valkey Stream -> Ansible)
  submarines-deployer:
    image: ghcr.io/node-pulse/node-pulse-submarines-deployer:latest
    container_name: node-pulse-submarines-deployer
    restart: unless-stopped
    env_file:
      - .env
    environment:
      MASTER_KEY_PATH: /secrets/master.key
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
      flagship-migrate:
        condition: service_completed_successfully
    volumes:
      - ./ansible:/app/ansible # Mount Ansible playbooks (writable for custom playbooks)
      - ./secrets:/secrets:ro # Mount master key for SSH key decryption (read-only)
    networks:
      - node-pulse-admiral

  # Go Submarines SSH WebSocket - Interactive terminal access
  submarines-sshws:
    image: ghcr.io/node-pulse/node-pulse-submarines-sshws:latest
    container_name: node-pulse-submarines-sshws
    restart: unless-stopped
    env_file:
      - .env
    environment:
      MASTER_KEY_PATH: /secrets/master.key
    ports:
      - "127.0.0.1:6001:6001" # Localhost only - not exposed publicly
    depends_on:
      postgres:
        condition: service_healthy
      flagship-migrate:
        condition: service_completed_successfully
    volumes:
      - ./secrets:/secrets:ro
    networks:
      - node-pulse-admiral

  # Laravel Flagship - Admin Dashboard (PHP-FPM only)
  flagship:
    image: ghcr.io/node-pulse/node-pulse-flagship:latest
    container_name: node-pulse-flagship
    restart: unless-stopped
    env_file:
      - .env
    entrypoint:
      - /usr/local/bin/docker-entrypoint.sh
    command:
      - /usr/bin/supervisord
      - -c
      - /etc/supervisor/conf.d/supervisord.conf
    expose:
      - "8090" # Nginx port (not exposed to host, only to Caddy)
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
      flagship-migrate:
        condition: service_completed_successfully
      submarines-ingest:
        condition: service_started
    volumes:
      - ./flagship/docker-entrypoint.sh:/usr/local/bin/docker-entrypoint.sh:ro
      - ./ansible:/var/www/html/ansible # Mount Ansible playbooks (writable for community/custom playbooks)
      - ./logs/flagship:/var/www/html/storage/logs # Mount logs for persistence
      - ./secrets:/secrets:rw # Mount shared secrets directory (writable for mTLS setup)
      - ./compose.yml:/config/compose.yml:rw # For mTLS setup (uncomment CA mount)
      - ./caddy:/caddy:rw # For mTLS setup (uncomment TLS block)
      - /var/run/docker.sock:/var/run/docker.sock:rw # For container restart via Docker API
    networks:
      - node-pulse-admiral
    healthcheck:
      test:
        - CMD
        - pidof
        - php-fpm
      interval: 30s
      timeout: 3s
      retries: 3

  # Caddy - Reverse Proxy and Web Server
  caddy:
    image: caddy:2-alpine
    container_name: node-pulse-caddy
    restart: unless-stopped
    env_file:
      - .env
    environment:
      # Domain configuration (use env vars for flexibility)
      FLAGSHIP_DOMAIN: ${FLAGSHIP_DOMAIN}
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp" # HTTP/3
    volumes:
      # Caddyfile configuration (production)
      - ./caddy/Caddyfile.prod:/etc/caddy/Caddyfile:ro

      # mTLS CA certificate for client cert validation
      # NOTE: Commented out by default. Uncomment after running setup-mtls.sh
      # - ./secrets/certs/ca.crt:/certs/ca.crt:ro

      # Caddy data (certificates, etc.) - bind mount for persistence
      # Let's Encrypt certificates are stored here automatically
      - ./caddy_data:/data
      - ./caddy_config:/config

      # Logs
      - ./logs/caddy:/var/log/caddy
    depends_on:
      - flagship
      - submarines-ingest
    networks:
      - node-pulse-admiral
    healthcheck:
      test:
        - CMD
        - wget
        - --no-verbose
        - --tries=1
        - --spider
        - http://127.0.0.1:2019/metrics
      interval: 30s
      timeout: 3s
      retries: 3

networks:
  node-pulse-admiral:
    driver: bridge
    name: node-pulse-admiral