docker-compose.yml

version: "3.8"

# =============================================================================
# Nimaora CodeBattle Platform - Docker Compose Configuration
# Domain: nimaora.dwin.codes
# Designed for 1M+ concurrent users
# =============================================================================

x-backend-common: &backend-common
  build:
    context: .
    dockerfile: nimaora-infrastructure/docker/backend-unified.Dockerfile
  environment: &backend-env
    APP_NAME: Nimaora
    APP_ENV: ${APP_ENV:-production}
    APP_DEBUG: ${APP_DEBUG:-false}
    APP_URL: ${APP_URL:-https://nimaora.dwin.codes}
    APP_KEY: ${APP_KEY}
    DB_CONNECTION: pgsql
    DB_HOST: postgres-primary
    DB_PORT: 5432
    DB_DATABASE: ${DB_DATABASE:-nimaora}
    DB_USERNAME: ${DB_USERNAME:-nimaora}
    DB_PASSWORD: ${DB_PASSWORD}
    CACHE_STORE: redis
    QUEUE_CONNECTION: rabbitmq
    SESSION_DRIVER: redis
    BROADCAST_CONNECTION: reverb
    REDIS_HOST: redis-master
    REDIS_PORT: 6379
    REDIS_PASSWORD: ${REDIS_PASSWORD}
    REVERB_APP_ID: nimaora
    REVERB_APP_KEY: ${REVERB_APP_KEY:-nimaora-app-key}
    REVERB_APP_SECRET: ${REVERB_APP_SECRET}
    REVERB_HOST: 0.0.0.0
    REVERB_PORT: 8080
    FRONTEND_URL: ${FRONTEND_URL:-https://nimaora.dwin.codes}
    OCTANE_SERVER: swoole
    OCTANE_WORKERS: ${OCTANE_WORKERS:-8}
    OCTANE_TASK_WORKERS: ${OCTANE_TASK_WORKERS:-4}
    OCTANE_MAX_REQUESTS: 10000
    PULSE_ENABLED: true
    RABBITMQ_HOST: rabbitmq
    RABBITMQ_PORT: 5672
    RABBITMQ_USER: ${RABBITMQ_USER:-nimaora}
    RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD}
    RABBITMQ_VHOST: /nimaora
    FILESYSTEM_DISK: s3
    AWS_ACCESS_KEY_ID: ${MINIO_ACCESS_KEY:-nimaora}
    AWS_SECRET_ACCESS_KEY: ${MINIO_SECRET_KEY}
    AWS_DEFAULT_REGION: us-east-1
    AWS_BUCKET: nimaora
    AWS_ENDPOINT: http://minio:9000
    AWS_USE_PATH_STYLE_ENDPOINT: true
    LOG_CHANNEL: stderr
    TRUSTED_PROXIES: "*"
  volumes:
    - ./backend:/var/www/html
    - /var/www/html/vendor
  networks:
    - nimaora
  restart: unless-stopped
  depends_on:
    postgres-primary:
      condition: service_healthy
    redis-master:
      condition: service_healthy
    rabbitmq:
      condition: service_healthy

services:
  # =====================================
  # Traefik - Reverse Proxy & Load Balancer
  # =====================================
  traefik:
    image: traefik:v3.2
    container_name: nimaora-traefik
    command:
      # API and Dashboard
      - "--api=true"
      - "--api.dashboard=true"
      - "--api.insecure=false"
      # Docker provider
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=nimaora"
      # Entrypoints
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.traefik.address=:8090"
      # ACME/Let's Encrypt for SSL
      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:-admin@dwin.codes}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      # Logging
      - "--log.level=${LOG_LEVEL:-INFO}"
      - "--accesslog=true"
      - "--accesslog.format=json"
      # Metrics for Prometheus
      - "--metrics.prometheus=true"
      - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
      - "--metrics.prometheus.addEntryPointsLabels=true"
      - "--metrics.prometheus.addServicesLabels=true"
      # Health check
      - "--ping=true"
      - "--ping.entrypoint=traefik"
    ports:
      - "80:80"
      - "443:443"
      - "8090:8090"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_certs:/letsencrypt
    labels:
      - "traefik.enable=true"
      # Dashboard with TLS
      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.nimaora.dwin.codes`)"
      - "traefik.http.routers.traefik-dashboard.service=api@internal"
      - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
      - "traefik.http.routers.traefik-dashboard.tls=true"
      - "traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt"
      # Basic auth for dashboard
      - "traefik.http.routers.traefik-dashboard.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_DASHBOARD_AUTH}"
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Frontend - Next.js (Scalable)
  # =====================================
  frontend:
    build:
      context: .
      dockerfile: nimaora-infrastructure/docker/frontend.Dockerfile
      target: ${FRONTEND_TARGET:-production}
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-https://api.nimaora.dwin.codes}
        NEXT_PUBLIC_REVERB_APP_KEY: ${REVERB_APP_KEY:-nimaora-app-key}
        NEXT_PUBLIC_REVERB_HOST: ${REVERB_HOST:-ws.nimaora.dwin.codes}
        NEXT_PUBLIC_REVERB_PORT: ${REVERB_PORT:-443}
        NEXT_PUBLIC_REVERB_SCHEME: ${REVERB_SCHEME:-https}
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-https://api.nimaora.dwin.codes}
      - NEXT_PUBLIC_REVERB_APP_KEY=${REVERB_APP_KEY:-nimaora-app-key}
      - NEXT_PUBLIC_REVERB_HOST=${REVERB_HOST:-ws.nimaora.dwin.codes}
      - NEXT_PUBLIC_REVERB_PORT=${REVERB_PORT:-443}
      - NEXT_PUBLIC_REVERB_SCHEME=${REVERB_SCHEME:-https}
      - NEXT_PUBLIC_MINIO_ENDPOINT=${MINIO_ENDPOINT:-https://s3.nimaora.dwin.codes}
    deploy:
      mode: replicated
      replicas: ${FRONTEND_REPLICAS:-3}
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M
    labels:
      - "traefik.enable=true"
      # Main frontend
      - "traefik.http.routers.frontend.rule=Host(`nimaora.dwin.codes`)"
      - "traefik.http.routers.frontend.entrypoints=websecure"
      - "traefik.http.routers.frontend.tls=true"
      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"
      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
      # Sticky sessions
      - "traefik.http.services.frontend.loadbalancer.sticky.cookie=true"
      - "traefik.http.services.frontend.loadbalancer.sticky.cookie.name=nimaora_frontend"
      # Health check
      - "traefik.http.services.frontend.loadbalancer.healthcheck.path=/api/health"
      - "traefik.http.services.frontend.loadbalancer.healthcheck.interval=10s"
      # Compression
      - "traefik.http.middlewares.frontend-compress.compress=true"
      - "traefik.http.routers.frontend.middlewares=frontend-compress"
    depends_on:
      - backend
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Backend - Laravel API with Octane (High Performance)
  # Designed for 1M+ concurrent users with horizontal scaling
  # =====================================
  backend:
    <<: *backend-common
    container_name: nimaora-backend
    environment:
      <<: *backend-env
      APP_MODE: octane
    command: octane
    deploy:
      mode: replicated
      replicas: ${BACKEND_REPLICAS:-4}
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    labels:
      - "traefik.enable=true"
      # API routes
      - "traefik.http.routers.backend.rule=Host(`api.nimaora.dwin.codes`)"
      - "traefik.http.routers.backend.entrypoints=websecure"
      - "traefik.http.routers.backend.tls=true"
      - "traefik.http.routers.backend.tls.certresolver=letsencrypt"
      - "traefik.http.services.backend.loadbalancer.server.port=8000"
      # Rate limiting - 2000 RPS per IP for high load
      - "traefik.http.middlewares.backend-ratelimit.ratelimit.average=200"
      - "traefik.http.middlewares.backend-ratelimit.ratelimit.burst=100"
      - "traefik.http.middlewares.backend-ratelimit.ratelimit.period=1s"
      # CORS
      - "traefik.http.middlewares.backend-cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT,POST,DELETE,PATCH"
      - "traefik.http.middlewares.backend-cors.headers.accesscontrolallowheaders=*"
      - "traefik.http.middlewares.backend-cors.headers.accesscontrolalloworiginlist=https://nimaora.dwin.codes"
      - "traefik.http.middlewares.backend-cors.headers.accesscontrolmaxage=100"
      - "traefik.http.routers.backend.middlewares=backend-ratelimit,backend-cors"
      # Health check
      - "traefik.http.services.backend.loadbalancer.healthcheck.path=/api/health"
      - "traefik.http.services.backend.loadbalancer.healthcheck.interval=5s"
      - "traefik.http.services.backend.loadbalancer.healthcheck.timeout=3s"
    depends_on:
      postgres-primary:
        condition: service_healthy
      redis-master:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      minio:
        condition: service_healthy

  # =====================================
  # WebSocket Server - Laravel Reverb
  # Critical for real-time battle updates and attack notifications
  # =====================================
  websocket:
    <<: *backend-common
    container_name: nimaora-websocket
    environment:
      <<: *backend-env
      APP_MODE: websocket
      REVERB_SCALING_ENABLED: true
      REVERB_SCALING_CHANNEL: presence-battles
    command: websocket
    deploy:
      mode: replicated
      replicas: ${WEBSOCKET_REPLICAS:-3}
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M
    labels:
      - "traefik.enable=true"
      # WebSocket routes
      - "traefik.http.routers.websocket.rule=Host(`ws.nimaora.dwin.codes`)"
      - "traefik.http.routers.websocket.entrypoints=websecure"
      - "traefik.http.routers.websocket.tls=true"
      - "traefik.http.routers.websocket.tls.certresolver=letsencrypt"
      - "traefik.http.services.websocket.loadbalancer.server.port=8080"
      # Sticky sessions for WebSocket connections
      - "traefik.http.services.websocket.loadbalancer.sticky.cookie=true"
      - "traefik.http.services.websocket.loadbalancer.sticky.cookie.name=nimaora_ws"
      - "traefik.http.services.websocket.loadbalancer.sticky.cookie.httpOnly=true"
      # WebSocket headers
      - "traefik.http.middlewares.websocket-headers.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.websocket-headers.headers.customrequestheaders.Upgrade=websocket"
      - "traefik.http.routers.websocket.middlewares=websocket-headers"
      # Long timeout for WebSocket
      - "traefik.http.services.websocket.loadbalancer.responseforwarding.flushinterval=100ms"
    depends_on:
      - backend
      - redis-master

  # =====================================
  # Laravel Horizon - Queue Workers (Critical for attack processing)
  # =====================================
  horizon:
    <<: *backend-common
    container_name: nimaora-horizon
    environment:
      <<: *backend-env
      APP_MODE: horizon
      HORIZON_BALANCE: auto
      HORIZON_MAX_PROCESSES: ${HORIZON_MAX_PROCESSES:-20}
      HORIZON_MIN_PROCESSES: ${HORIZON_MIN_PROCESSES:-5}
    command: horizon
    deploy:
      mode: replicated
      replicas: ${HORIZON_REPLICAS:-2}
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.horizon.rule=Host(`horizon.nimaora.dwin.codes`)"
      - "traefik.http.routers.horizon.entrypoints=websecure"
      - "traefik.http.routers.horizon.tls=true"
      - "traefik.http.routers.horizon.tls.certresolver=letsencrypt"
      - "traefik.http.services.horizon.loadbalancer.server.port=8000"
      - "traefik.http.routers.horizon.middlewares=traefik-auth"
    depends_on:
      - backend
      - rabbitmq
      - redis-master

  # =====================================
  # Laravel Pulse - Application Monitoring
  # =====================================
  pulse:
    <<: *backend-common
    container_name: nimaora-pulse
    environment:
      <<: *backend-env
      APP_MODE: pulse
      PULSE_ENABLED: true
    command: pulse
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pulse.rule=Host(`pulse.nimaora.dwin.codes`)"
      - "traefik.http.routers.pulse.entrypoints=websecure"
      - "traefik.http.routers.pulse.tls=true"
      - "traefik.http.routers.pulse.tls.certresolver=letsencrypt"
      - "traefik.http.services.pulse.loadbalancer.server.port=8000"
      - "traefik.http.routers.pulse.middlewares=traefik-auth"
    depends_on:
      - backend

  # =====================================
  # Scheduler - Cron Jobs
  # =====================================
  scheduler:
    <<: *backend-common
    container_name: nimaora-scheduler
    environment:
      <<: *backend-env
      APP_MODE: scheduler
    command: scheduler
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    depends_on:
      - backend

  # =====================================
  # PostgreSQL Primary - High Performance Database
  # Optimized for 1M+ users with connection pooling
  # =====================================
  postgres-primary:
    image: postgres:16-alpine
    container_name: nimaora-postgres-primary
    environment:
      POSTGRES_USER: ${DB_USERNAME:-nimaora}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ${DB_DATABASE:-nimaora}
      # Performance tuning for high load
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C"
    volumes:
      - postgres_primary_data:/var/lib/postgresql/data
      - ./nimaora-infrastructure/docker/postgres/postgresql.conf:/etc/postgresql/postgresql.conf:ro
      - ./nimaora-infrastructure/docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    command: >
      postgres 
      -c max_connections=1000
      -c shared_buffers=2GB
      -c effective_cache_size=6GB
      -c maintenance_work_mem=512MB
      -c checkpoint_completion_target=0.9
      -c wal_buffers=64MB
      -c default_statistics_target=100
      -c random_page_cost=1.1
      -c effective_io_concurrency=200
      -c work_mem=16MB
      -c huge_pages=off
      -c min_wal_size=1GB
      -c max_wal_size=4GB
      -c max_worker_processes=8
      -c max_parallel_workers_per_gather=4
      -c max_parallel_workers=8
      -c max_parallel_maintenance_workers=4
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 8G
        reservations:
          cpus: '2'
          memory: 4G
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USERNAME:-nimaora}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # PgBouncer - Connection Pooler
  # Required for handling 1M+ connections
  # =====================================
  pgbouncer:
    image: bitnami/pgbouncer:latest
    container_name: nimaora-pgbouncer
    environment:
      POSTGRESQL_HOST: postgres-primary
      POSTGRESQL_PORT: 5432
      POSTGRESQL_USERNAME: ${DB_USERNAME:-nimaora}
      POSTGRESQL_PASSWORD: ${DB_PASSWORD}
      POSTGRESQL_DATABASE: ${DB_DATABASE:-nimaora}
      PGBOUNCER_POOL_MODE: transaction
      PGBOUNCER_MAX_CLIENT_CONN: 10000
      PGBOUNCER_DEFAULT_POOL_SIZE: 100
      PGBOUNCER_MIN_POOL_SIZE: 20
      PGBOUNCER_RESERVE_POOL_SIZE: 50
    depends_on:
      postgres-primary:
        condition: service_healthy
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Redis Master - Cache & Session Store
  # Optimized for high-throughput leaderboard operations
  # =====================================
  redis-master:
    image: redis:7-alpine
    container_name: nimaora-redis-master
    command: >
      redis-server 
      --appendonly yes 
      --maxmemory 4gb 
      --maxmemory-policy allkeys-lru
      --tcp-backlog 511
      --timeout 0
      --tcp-keepalive 300
      --maxclients 10000
      --save ""
      --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_master_data:/data
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 4G
        reservations:
          cpus: '0.5'
          memory: 1G
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Redis Replica - Read Scaling
  # =====================================
  redis-replica:
    image: redis:7-alpine
    container_name: nimaora-redis-replica
    command: >
      redis-server 
      --appendonly yes 
      --maxmemory 2gb 
      --maxmemory-policy allkeys-lru
      --replicaof redis-master 6379
      --masterauth ${REDIS_PASSWORD}
      --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_replica_data:/data
    deploy:
      mode: replicated
      replicas: ${REDIS_REPLICA_COUNT:-2}
      resources:
        limits:
          cpus: '1'
          memory: 2G
    depends_on:
      - redis-master
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # RabbitMQ Message Broker (High Throughput)
  # Critical for attack processing and real-time events
  # =====================================
  rabbitmq:
    image: rabbitmq:3.13-management-alpine
    container_name: nimaora-rabbitmq
    hostname: nimaora-rabbitmq
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_USER:-nimaora}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD}
      RABBITMQ_DEFAULT_VHOST: /nimaora
      RABBITMQ_VM_MEMORY_HIGH_WATERMARK: 0.6
      RABBITMQ_DISK_FREE_LIMIT: 2GB
      RABBITMQ_NODENAME: rabbit@nimaora-rabbitmq
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq
      - ./nimaora-infrastructure/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
      - ./nimaora-infrastructure/rabbitmq/definitions.json:/etc/rabbitmq/definitions.json:ro
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 4G
        reservations:
          cpus: '0.5'
          memory: 1G
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
      interval: 10s
      timeout: 10s
      retries: 5
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rabbitmq.rule=Host(`rabbitmq.nimaora.dwin.codes`)"
      - "traefik.http.routers.rabbitmq.entrypoints=websecure"
      - "traefik.http.routers.rabbitmq.tls=true"
      - "traefik.http.routers.rabbitmq.tls.certresolver=letsencrypt"
      - "traefik.http.services.rabbitmq.loadbalancer.server.port=15672"
      - "traefik.http.routers.rabbitmq.middlewares=traefik-auth"
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # MinIO S3 Compatible Storage
  # =====================================
  minio:
    image: minio/minio:RELEASE.2024-11-07T00-52-20Z
    container_name: nimaora-minio
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:-nimaora}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY}
      MINIO_BROWSER_REDIRECT_URL: https://minio.nimaora.dwin.codes
      MINIO_PROMETHEUS_AUTH_TYPE: public
    volumes:
      - minio_data:/data
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 2G
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 5
    labels:
      - "traefik.enable=true"
      # API endpoint
      - "traefik.http.routers.minio-api.rule=Host(`s3.nimaora.dwin.codes`)"
      - "traefik.http.routers.minio-api.entrypoints=websecure"
      - "traefik.http.routers.minio-api.tls=true"
      - "traefik.http.routers.minio-api.tls.certresolver=letsencrypt"
      - "traefik.http.routers.minio-api.service=minio-api"
      - "traefik.http.services.minio-api.loadbalancer.server.port=9000"
      # Console
      - "traefik.http.routers.minio-console.rule=Host(`minio.nimaora.dwin.codes`)"
      - "traefik.http.routers.minio-console.entrypoints=websecure"
      - "traefik.http.routers.minio-console.tls=true"
      - "traefik.http.routers.minio-console.tls.certresolver=letsencrypt"
      - "traefik.http.routers.minio-console.service=minio-console"
      - "traefik.http.services.minio-console.loadbalancer.server.port=9001"
      - "traefik.http.routers.minio-console.middlewares=traefik-auth"
    networks:
      - nimaora
    restart: unless-stopped

  # MinIO Client - Initialize buckets
  minio-init:
    image: minio/mc:latest
    container_name: nimaora-minio-init
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set nimaora http://minio:9000 ${MINIO_ACCESS_KEY:-nimaora} ${MINIO_SECRET_KEY};
      mc mb nimaora/nimaora --ignore-existing;
      mc anonymous set download nimaora/nimaora/public;
      echo 'MinIO initialized successfully';
      exit 0;
      "
    networks:
      - nimaora

  # =====================================
  # Loki - Log Aggregation
  # =====================================
  loki:
    image: grafana/loki:3.2.0
    container_name: nimaora-loki
    command: -config.file=/etc/loki/local-config.yaml
    volumes:
      - loki_data:/loki
      - ./nimaora-infrastructure/loki/loki-config.yaml:/etc/loki/local-config.yaml:ro
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3100/ready || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Promtail - Log Collector
  # =====================================
  promtail:
    image: grafana/promtail:3.2.0
    container_name: nimaora-promtail
    command: -config.file=/etc/promtail/config.yaml
    volumes:
      - ./nimaora-infrastructure/promtail/promtail-config.yaml:/etc/promtail/config.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
    depends_on:
      loki:
        condition: service_healthy
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Prometheus - Metrics Collection
  # =====================================
  prometheus:
    image: prom/prometheus:v2.54.1
    container_name: nimaora-prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=30d'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
      - '--web.enable-lifecycle'
    volumes:
      - prometheus_data:/prometheus
      - ./nimaora-infrastructure/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./nimaora-infrastructure/prometheus/alerts.yml:/etc/prometheus/alerts.yml:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.prometheus.rule=Host(`prometheus.nimaora.dwin.codes`)"
      - "traefik.http.routers.prometheus.entrypoints=websecure"
      - "traefik.http.routers.prometheus.tls=true"
      - "traefik.http.routers.prometheus.tls.certresolver=letsencrypt"
      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
      - "traefik.http.routers.prometheus.middlewares=traefik-auth"
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Grafana - Visualization & Dashboards
  # =====================================
  grafana:
    image: grafana/grafana:11.3.0
    container_name: nimaora-grafana
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_SERVER_ROOT_URL: https://grafana.nimaora.dwin.codes
      GF_INSTALL_PLUGINS: grafana-clock-panel,grafana-piechart-panel
      GF_AUTH_ANONYMOUS_ENABLED: "false"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./nimaora-infrastructure/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./nimaora-infrastructure/grafana/dashboards:/var/lib/grafana/dashboards:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.grafana.rule=Host(`grafana.nimaora.dwin.codes`)"
      - "traefik.http.routers.grafana.entrypoints=websecure"
      - "traefik.http.routers.grafana.tls=true"
      - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
    depends_on:
      - prometheus
      - loki
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Portainer - Container Management
  # =====================================
  portainer:
    image: portainer/portainer-ce:2.21.3-alpine
    container_name: nimaora-portainer
    command: -H unix:///var/run/docker.sock
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=Host(`portainer.nimaora.dwin.codes`)"
      - "traefik.http.routers.portainer.entrypoints=websecure"
      - "traefik.http.routers.portainer.tls=true"
      - "traefik.http.routers.portainer.tls.certresolver=letsencrypt"
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # pgAdmin 4 - PostgreSQL Administration
  # =====================================
  pgadmin:
    image: dpage/pgadmin4:8.13
    container_name: nimaora-pgadmin
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL:-admin@nimaora.dwin.codes}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD}
      PGADMIN_CONFIG_SERVER_MODE: "False"
      PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: "False"
    volumes:
      - pgadmin_data:/var/lib/pgadmin
      - ./nimaora-infrastructure/pgadmin/servers.json:/pgadmin4/servers.json:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pgadmin.rule=Host(`pgadmin.nimaora.dwin.codes`)"
      - "traefik.http.routers.pgadmin.entrypoints=websecure"
      - "traefik.http.routers.pgadmin.tls=true"
      - "traefik.http.routers.pgadmin.tls.certresolver=letsencrypt"
      - "traefik.http.services.pgadmin.loadbalancer.server.port=80"
      - "traefik.http.routers.pgadmin.middlewares=traefik-auth"
    depends_on:
      - postgres-primary
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Redis Commander - Redis UI
  # =====================================
  redis-commander:
    image: rediscommander/redis-commander:latest
    container_name: nimaora-redis-commander
    environment:
      REDIS_HOSTS: master:redis-master:6379:0:${REDIS_PASSWORD}
      HTTP_USER: ${REDIS_COMMANDER_USER:-admin}
      HTTP_PASSWORD: ${REDIS_COMMANDER_PASSWORD}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.redis-commander.rule=Host(`redis-ui.nimaora.dwin.codes`)"
      - "traefik.http.routers.redis-commander.entrypoints=websecure"
      - "traefik.http.routers.redis-commander.tls=true"
      - "traefik.http.routers.redis-commander.tls.certresolver=letsencrypt"
      - "traefik.http.services.redis-commander.loadbalancer.server.port=8081"
    depends_on:
      - redis-master
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # Node Exporter - Host Metrics
  # =====================================
  node-exporter:
    image: prom/node-exporter:v1.8.2
    container_name: nimaora-node-exporter
    command:
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    networks:
      - nimaora
    restart: unless-stopped

  # =====================================
  # cAdvisor - Container Metrics
  # =====================================
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.49.1
    container_name: nimaora-cadvisor
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    networks:
      - nimaora
    restart: unless-stopped

# =============================================================================
# Networks
# =============================================================================
networks:
  nimaora:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.28.0.0/16

# =============================================================================
# Volumes - Persistent Storage
# =============================================================================
volumes:
  postgres_primary_data:
    driver: local
  redis_master_data:
    driver: local
  redis_replica_data:
    driver: local
  rabbitmq_data:
    driver: local
  minio_data:
    driver: local
  loki_data:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  portainer_data:
    driver: local
  pgadmin_data:
    driver: local
  traefik_certs:
    driver: local