docker-compose.yml

# ===========================================================================
# ProfPlan — development stack (single-command infrastructure)
#
# Profiles:
#   dev           -> core services + dev tooling (adminer)
#   production    -> core services only
#   observability -> prometheus, grafana, loki, otel-collector
#   tools         -> one-off tasks (ruff lint), run via `docker compose run`
#
# Examples:
#   docker compose --profile dev up
#   docker compose --profile dev --profile observability up
#   docker compose run --rm lint
# ===========================================================================

x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "3"

services:

  # -------------------------------------------------------------------------
  # PostgreSQL + pgvector — never exposed to the host, backend network only.
  # -------------------------------------------------------------------------
  postgres:
    image: pgvector/pgvector:pg17
    profiles: ["dev", "production"]
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1g
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Redis — cache and Celery broker/result backend.
  # -------------------------------------------------------------------------
  redis:
    image: redis:8-alpine
    profiles: ["dev", "production"]
    restart: unless-stopped
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - backend
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512m
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Ollama — local embedding model server (bge-m3). Pull the model once with:
  #   docker compose exec ollama ollama pull bge-m3
  # -------------------------------------------------------------------------
  ollama:
    image: ollama/ollama:0.31.2
    profiles: ["dev", "production"]
    restart: unless-stopped
    volumes:
      - ollama_data:/root/.ollama
    networks:
      - backend
    healthcheck:
      test: ["CMD", "ollama", "list"]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 20s
    deploy:
      resources:
        limits:
          cpus: "4.0"
          memory: 6g
    logging: *default-logging

  # -------------------------------------------------------------------------
  # FastAPI application — only receives requests; heavy work goes to the worker.
  # -------------------------------------------------------------------------
  api:
    build:
      context: .
      dockerfile: docker/api/Dockerfile
    image: profplan-backend:latest
    profiles: ["dev", "production"]
    restart: unless-stopped
    env_file: .env
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - backend
      - frontend
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.localhost`)"
      - "traefik.http.routers.api.entrypoints=web"
      - "traefik.http.services.api.loadbalancer.server.port=8000"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1g
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Celery worker — same image as the API, different command.
  # -------------------------------------------------------------------------
  worker:
    image: profplan-backend:latest
    profiles: ["dev", "production"]
    restart: unless-stopped
    command:
      ["celery", "-A", "app.infrastructure.celery.worker:celery_app",
       "worker", "--loglevel=info"]
    env_file: .env
    depends_on:
      api:
        condition: service_started
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
    networks:
      - backend
    healthcheck:
      test:
        ["CMD", "celery", "-A", "app.infrastructure.celery.worker:celery_app",
         "inspect", "ping"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1g
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Flower — Celery monitoring dashboard.
  # -------------------------------------------------------------------------
  flower:
    image: profplan-backend:latest
    profiles: ["dev", "production"]
    restart: unless-stopped
    command:
      ["celery", "-A", "app.infrastructure.celery.worker:celery_app",
       "flower", "--port=5555"]
    env_file: .env
    depends_on:
      redis:
        condition: service_healthy
    networks:
      - backend
      - frontend
    ports:
      - "5555:5555"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5555/healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512m
    logging: *default-logging

  # -------------------------------------------------------------------------
  # MinIO — S3-compatible object storage for documents. Official image.
  # -------------------------------------------------------------------------
  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    profiles: ["dev", "production"]
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    volumes:
      - minio_data:/data
    networks:
      - backend
    ports:
      - "9000:9000"
      - "9001:9001"
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512m
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Traefik — edge router. Only this and the frontend touch the internet.
  # -------------------------------------------------------------------------
  traefik:
    image: traefik:v3.3
    profiles: ["dev", "production"]
    restart: unless-stopped
    command: --configFile=/etc/traefik/traefik.yml
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./docker/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./docker/traefik/dynamic.yml:/etc/traefik/dynamic/dynamic.yml:ro
      - ./docker/traefik/certs:/etc/traefik/certs:ro
    networks:
      - frontend
    ports:
      - "80:80"
      - "443:443"
      # No public 8080 (the dashboard's old unauthenticated listener) — see
      # traefik.yml's `api.insecure: false` and dynamic.yml's commented
      # basic-auth dashboard router.
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 15s
      timeout: 5s
      retries: 5
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Adminer — lightweight DB UI, development only.
  # -------------------------------------------------------------------------
  adminer:
    image: adminer:5.4.2
    profiles: ["dev"]
    restart: unless-stopped
    environment:
      ADMINER_DEFAULT_SERVER: postgres
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - backend
    ports:
      - "8081:8080"
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Loki — log aggregation.
  # -------------------------------------------------------------------------
  loki:
    image: grafana/loki:3.7.3
    profiles: ["observability"]
    restart: unless-stopped
    command: -config.file=/etc/loki/loki-config.yml
    volumes:
      - ./docker/loki/loki-config.yml:/etc/loki/loki-config.yml:ro
    networks:
      - backend
    ports:
      - "3100:3100"
    # The Loki image is distroless (no shell/wget), so it has no container
    # healthcheck; readiness is observed via /ready from other services.
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Tempo — distributed trace backend (queried by Grafana).
  # -------------------------------------------------------------------------
  tempo:
    image: grafana/tempo:3.0.2
    profiles: ["observability"]
    restart: unless-stopped
    command: ["-config.file=/etc/tempo/tempo.yml"]
    volumes:
      - ./docker/tempo/tempo.yml:/etc/tempo/tempo.yml:ro
      - tempo_data:/var/tempo
    networks:
      - backend
    logging: *default-logging

  # -------------------------------------------------------------------------
  # OpenTelemetry Collector — receives traces/metrics/logs from the app.
  # -------------------------------------------------------------------------
  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.156.0
    profiles: ["observability"]
    restart: unless-stopped
    command: ["--config=/etc/otel/collector-config.yaml"]
    volumes:
      - ./docker/otel/collector-config.yaml:/etc/otel/collector-config.yaml:ro
    networks:
      - backend
    ports:
      - "4317:4317"
      - "4318:4318"
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Prometheus — metrics.
  # -------------------------------------------------------------------------
  prometheus:
    image: prom/prometheus:v3.13.0
    profiles: ["observability"]
    restart: unless-stopped
    volumes:
      - ./docker/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    networks:
      - backend
    ports:
      - "9090:9090"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O- http://localhost:9090/-/healthy || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Grafana — dashboards (datasources provisioned for Prometheus + Loki).
  # -------------------------------------------------------------------------
  grafana:
    image: grafana/grafana:11.6.16
    profiles: ["observability"]
    restart: unless-stopped
    depends_on:
      prometheus:
        condition: service_healthy
      loki:
        condition: service_started
    volumes:
      - grafana_data:/var/lib/grafana
      - ./docker/grafana/datasources.yml:/etc/grafana/provisioning/datasources/datasources.yml:ro
      - ./docker/grafana/dashboards.yml:/etc/grafana/provisioning/dashboards/dashboards.yml:ro
    networks:
      - backend
    ports:
      - "3000:3000"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O- http://localhost:3000/api/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 20s
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Node Exporter — host-level metrics (CPU, memory, disk, network) for
  # Prometheus. Reads the host filesystem read-only via bind mounts.
  # -------------------------------------------------------------------------
  node-exporter:
    image: prom/node-exporter:v1.11.1
    profiles: ["observability"]
    restart: unless-stopped
    command:
      - "--path.procfs=/host/proc"
      - "--path.sysfs=/host/sys"
      - "--path.rootfs=/host"
      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/host:ro,rslave
    networks:
      - backend
    ports:
      - "9100:9100"
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Promtail — tails every container's logs (Docker service discovery) and
  # ships them to Loki. The app logs structured JSON, queryable via `| json`.
  # -------------------------------------------------------------------------
  promtail:
    image: grafana/promtail:3.6.11
    profiles: ["observability"]
    restart: unless-stopped
    command: -config.file=/etc/promtail/promtail.yml
    depends_on:
      loki:
        condition: service_started
    volumes:
      - ./docker/promtail/promtail.yml:/etc/promtail/promtail.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - backend
    logging: *default-logging

  # -------------------------------------------------------------------------
  # Ruff — lint / PEP 8, run on demand: `docker compose run --rm lint`
  # -------------------------------------------------------------------------
  lint:
    image: ghcr.io/astral-sh/ruff:0.9.6
    profiles: ["tools"]
    working_dir: /io
    volumes:
      - .:/io
    command: ["check", "."]

  # -------------------------------------------------------------------------
  # Integration tests — pytest against a throwaway test DB and Redis db,
  # on the backend network. Run with: `docker compose run --rm test`
  # -------------------------------------------------------------------------
  test:
    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
    profiles: ["tools"]
    working_dir: /app
    env_file: .env
    environment:
      UV_LINK_MODE: copy
      # Isolated test database and Redis logical db — never touch dev data.
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}_test
      REDIS_URL: redis://redis:6379/15
      # Rate limiting is disabled under test so shared-client bursts don't 429;
      # it is exercised explicitly by test_rate_limit_flow with its own limiter.
      RATE_LIMIT_ENABLED: "false"
      # CI has no LLM configured: create plain plans (no AI call / fan-out).
      # Generation is exercised locally with a real LLM (Ollama/Gemini).
      PLAN_GENERATION_ENABLED: "false"
    volumes:
      - .:/app
    networks:
      - backend
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    command:
      ["uv", "run", "--frozen", "--extra", "dev", "pytest", "-m",
       "integration", "tests/integration", "-q"]

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  minio_data:
  grafana_data:
  ollama_data:
  tempo_data: