docker-compose.yml

# Core application services + infra dependencies.
services:
  # Spring Cloud Gateway BFF (OIDC login + TokenRelay).
  gateway:
    build:
      context: ./backend
      dockerfile: ./gateway/Dockerfile
    image: ai-knowledge/gateway:latest
    environment:
      - GATEWAY_MAX_IN_MEMORY_SIZE=${GATEWAY_MAX_IN_MEMORY_SIZE:-20MB}
      - SERVICES_RAG_URI=http://rag-service:8080
      - SERVICES_DOCUMENT_URI=http://document-service:8080
      - SERVICES_USER_URI=http://user-service:8080
      # OIDC issuer served by Keycloak over HTTPS.
      - OIDC_ISSUER_URI=${OIDC_ISSUER_URI:-https://keycloak.local:8443/realms/knowledge}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-gateway-bff}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-gateway-bff-secret}
      - OIDC_POST_LOGOUT_REDIRECT_URI=${OIDC_POST_LOGOUT_REDIRECT_URI:-http://localhost:4200/}
      - OIDC_REDIRECT_URI=${OIDC_REDIRECT_URI:-http://localhost:4200/login/oauth2/code/keycloak}
      # Debug logging for OIDC login + token relay troubleshooting.
      - LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY=DEBUG
      - LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY_OAUTH2=DEBUG
      - LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY_OAUTH2_CLIENT=DEBUG
      - LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_CLOUD_GATEWAY_FILTER_FACTORY_TOKENRELAYGATEWAYFILTERFACTORY=DEBUG
      # Trust the local root CA for HTTPS OIDC discovery.
      # Truststore needed for JVMs to validate Keycloak HTTPS certificates.
      - JAVA_OPTS=-Djavax.net.ssl.trustStore=/opt/certs/truststore.p12 -Djavax.net.ssl.trustStorePassword=${ROOT_CA_TRUSTSTORE_PASS:-changeit} -Djavax.net.ssl.trustStoreType=PKCS12
    volumes:
      # Root CA truststore generated by keycloak/certgen.sh.
      - ./.certs/truststore.p12:/opt/certs/truststore.p12:ro
    ports:
      - "8080:8080"
    profiles: [dev, prod]
    depends_on:
      keycloak:
        condition: service_healthy
      rag-service:
        condition: service_healthy
      document-service:
        condition: service_healthy
      user-service:
        condition: service_healthy
    networks:
      - knowledge-net
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/actuator/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  # RAG pipeline service (Qdrant + model runner).
  rag-service:
    build:
      context: ./backend
      dockerfile: ./rag-service/Dockerfile
    image: ai-knowledge/rag-service:latest
    environment:
      - OPENAI_BASE_URL=${OPENAI_BASE_URL:-http://host.docker.internal:12434}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-local}
      - OPENAI_MODEL=ai/qwen2.5:latest
      - OPENAI_EMBEDDING_MODEL=ai/mxbai-embed-large:latest
      - RAG_INGEST_CHUNK_SIZE=${RAG_INGEST_CHUNK_SIZE:-256}
      - RAG_INGEST_MIN_CHARS=${RAG_INGEST_MIN_CHARS:-200}
      - RAG_INGEST_MIN_CHUNK_LENGTH=${RAG_INGEST_MIN_CHUNK_LENGTH:-5}
      - RAG_INGEST_MAX_CHUNKS=${RAG_INGEST_MAX_CHUNKS:-1000}
      - RAG_INGEST_KEEP_SEPARATOR=${RAG_INGEST_KEEP_SEPARATOR:-true}
      - QDRANT_URL=http://qdrant:6333
      # OIDC issuer served by Keycloak over HTTPS.
      - OIDC_ISSUER_URI=${OIDC_ISSUER_URI:-https://keycloak.local:8443/realms/knowledge}
      # Trust the local root CA for HTTPS OIDC discovery.
      # Truststore needed for JVMs to validate Keycloak HTTPS certificates.
      - JAVA_OPTS=-Djavax.net.ssl.trustStore=/opt/certs/truststore.p12 -Djavax.net.ssl.trustStorePassword=${ROOT_CA_TRUSTSTORE_PASS:-changeit} -Djavax.net.ssl.trustStoreType=PKCS12
    volumes:
      # Root CA truststore generated by keycloak/certgen.sh.
      - ./.certs/truststore.p12:/opt/certs/truststore.p12:ro
    profiles: [dev, prod]
    models:
      - qwen2_5
    depends_on:
      keycloak:
        condition: service_healthy
      qdrant:
        condition: service_started
    networks:
      - knowledge-net
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/actuator/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  # Document CRUD + ingestion client to RAG (client credentials).
  document-service:
    build:
      context: ./backend
      dockerfile: ./document-service/Dockerfile
    image: ai-knowledge/document-service:latest
    environment:
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_DB=knowledge
      - POSTGRES_USER=knowledge
      - POSTGRES_PASSWORD=knowledge
      - DOC_MAX_FILE_SIZE=${DOC_MAX_FILE_SIZE:-20MB}
      - DOC_MAX_REQUEST_SIZE=${DOC_MAX_REQUEST_SIZE:-20MB}
      # OIDC issuer served by Keycloak over HTTPS.
      - OIDC_ISSUER_URI=${OIDC_ISSUER_URI:-https://keycloak.local:8443/realms/knowledge}
      # Client credentials used for rag ingestion.
      - OIDC_RAG_CLIENT_ID=${OIDC_RAG_CLIENT_ID:-document-service}
      - OIDC_RAG_CLIENT_SECRET=${OIDC_RAG_CLIENT_SECRET:-document-service-secret}
      # Trust the local root CA for HTTPS OIDC discovery.
      # Truststore needed for JVMs to validate Keycloak HTTPS certificates.
      - JAVA_OPTS=-Djavax.net.ssl.trustStore=/opt/certs/truststore.p12 -Djavax.net.ssl.trustStorePassword=${ROOT_CA_TRUSTSTORE_PASS:-changeit} -Djavax.net.ssl.trustStoreType=PKCS12
    volumes:
      # Root CA truststore generated by keycloak/certgen.sh.
      - ./.certs/truststore.p12:/opt/certs/truststore.p12:ro
    profiles: [dev, prod]
    depends_on:
      keycloak:
        condition: service_healthy
      postgres:
        condition: service_healthy
    networks:
      - knowledge-net
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/actuator/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  # User profile service (OIDC resource server).
  user-service:
    build:
      context: ./backend
      dockerfile: ./user-service/Dockerfile
    image: ai-knowledge/user-service:latest
    environment:
      # OIDC issuer served by Keycloak over HTTPS.
      - OIDC_ISSUER_URI=${OIDC_ISSUER_URI:-https://keycloak.local:8443/realms/knowledge}
      # Trust the local root CA for HTTPS OIDC discovery.
      # Truststore needed for JVMs to validate Keycloak HTTPS certificates.
      - JAVA_OPTS=-Djavax.net.ssl.trustStore=/opt/certs/truststore.p12 -Djavax.net.ssl.trustStorePassword=${ROOT_CA_TRUSTSTORE_PASS:-changeit} -Djavax.net.ssl.trustStoreType=PKCS12
    volumes:
      # Root CA truststore generated by keycloak/certgen.sh.
      - ./.certs/truststore.p12:/opt/certs/truststore.p12:ro
    profiles: [dev, prod]
    depends_on:
      keycloak:
        condition: service_healthy
    networks:
      - knowledge-net
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/actuator/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  # Angular UI served by nginx (proxies /api + /oauth2 to gateway).
  frontend:
    build:
      context: ./frontend
      dockerfile: ./Dockerfile
    image: ai-knowledge/frontend:latest
    ports:
      - "4200:80"
    profiles: [dev, prod]
    depends_on:
      gateway:
        condition: service_healthy
    networks:
      - knowledge-net
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:80 || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  # PostgreSQL persistence for documents.
  postgres:
    image: postgres:16-alpine
    environment:
      - POSTGRES_USER=knowledge
      - POSTGRES_PASSWORD=knowledge
      - POSTGRES_DB=knowledge
    volumes:
      - pgdata:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    profiles: [dev, prod]
    networks:
      - knowledge-net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-knowledge} -d ${POSTGRES_DB:-knowledge}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  # Vector DB for embeddings.
  qdrant:
    image: qdrant/qdrant:latest
    volumes:
      - qdrant-data:/qdrant/storage
    ports:
      - "6333:6333"
      - "6334:6334"
    profiles: [dev, prod]
    networks:
      - knowledge-net
# Pas trouvé de technique viable pour un healthcheck sur qdrant...
#    healthcheck:
#      test: ["CMD-SHELL", "[ \"$(cat /proc/1/comm 2>/dev/null)\" = \"qdrant\" ]"]
#      interval: 10s
#      timeout: 5s
#      retries: 5
#      start_period: 15s

  # One-shot cert generation for Keycloak HTTPS (server cert only).
  keycloak-certgen:
    # One-shot cert generation: server cert under .certs/.
    image: alpine:3.20
    command: ["sh", "-c", "apk add --no-cache openssl && sh /scripts/certgen.sh"]
    environment:
      - ROOT_CA_DIR=/certs
      - ROOT_CA_TRUSTSTORE_PASS=${ROOT_CA_TRUSTSTORE_PASS:-changeit}
      - KEYCLOAK_HOST=${KEYCLOAK_HOST:-keycloak.local}
      - KEYCLOAK_CERT_DIR=/certs/keycloak
      - KEYSTORE_PASS=${KEYSTORE_PASS:-changeit}
    volumes:
      - ./.certs:/certs
      - ./keycloak/certgen.sh:/scripts/certgen.sh:ro
    profiles: [dev, prod]
    networks:
      - knowledge-net

  # Keycloak OIDC provider over HTTPS only (requires a keystore).
  keycloak:
    # HTTPS-only Keycloak using the generated keystore.
    image: quay.io/keycloak/keycloak:25.0.6
    command: ["start-dev", "--import-realm", "--health-enabled=true", "--hostname=${KEYCLOAK_HOST:-keycloak.local}", "--hostname-strict=true", "--https-key-store-file=/opt/keycloak/certs/keystore.p12", "--https-key-store-type=PKCS12", "--https-key-store-password=${KEYSTORE_PASS:-changeit}", "--https-port=8443", "--http-enabled=false"]
    environment:
      - KEYCLOAK_ADMIN=${KEYCLOAK_ADMIN:-admin}
      - KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD:-admin}
    volumes:
      # TLS material created by keycloak-certgen.
      - ./.certs/keycloak:/opt/keycloak/certs:ro
      - ./keycloak/realm.json:/opt/keycloak/data/import/realm.json:ro
    ports:
      # Expose HTTPS for OIDC discovery and login.
      - "8443:8443"
    profiles: [dev, prod]
    depends_on:
      keycloak-certgen:
        condition: service_completed_successfully
    networks:
      knowledge-net:
        aliases:
          # DNS alias used by OIDC issuer.
          - keycloak.local
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/127.0.0.1/8443'"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s

  # Utility container for ad-hoc network calls.
  toolbox:
    image: curlimages/curl:latest
    command: ["sleep", "infinity"]
    profiles: [dev]
    networks:
      - knowledge-net

# Docker Model Runner artifacts.
models:
  qwen2_5:
    model: qwen2.5

# Named volumes for stateful services.
volumes:
  pgdata:
  qdrant-data:

# Private network for service-to-service communication.
networks:
  knowledge-net:
    driver: bridge