docker-compose.swarm.dev.yml

# Obiente Cloud - Development Docker Swarm Configuration
# This setup uses Swarm mode for development and delegates DNS to the main deployment



# This file requires docker-compose.base.yml to be merged before use
# Usage: cat docker-compose.base.yml docker-compose.swarm.dev.yml | docker stack deploy -c - obiente

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-obiente_postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-obiente_postgres}
      POSTGRES_DB: ${POSTGRES_DB:-obiente}
      # Configure PostgreSQL to listen on all interfaces (required for Docker Swarm overlay network)
      POSTGRES_HOST_AUTH_METHOD: md5
      # Overlay network subnet for pg_hba.conf configuration
      OVERLAY_SUBNET: ${OVERLAY_SUBNET:-10.15.3.0/24}
      # Allowed hosts for pg_hba.conf (comma-separated IPs or subnets, e.g., "10.10.10.1,10.0.0.0/8")
      POSTGRES_ALLOWED_HOSTS: ${POSTGRES_ALLOWED_HOSTS:-}
    command:
      - postgres
      - -c
      - listen_addresses=*
      - -c
      - max_connections=200
    # Port exposure configuration for Netbird VPN access
    # Default: Use ingress mode for Swarm compatibility (host mode conflicts with overlay networks)
    # To change binding, set POSTGRES_EXPOSE_PORT and POSTGRES_PORT_MODE environment variables
    # Note: In Docker Swarm, services on overlay networks must use ingress mode for ports
    # Examples:
    #   - POSTGRES_EXPOSE_PORT=5433  # Default port
    #   - POSTGRES_PORT_MODE=ingress  # Use ingress mode (required for overlay networks)
    # Note: Port 5432 is reserved for databases-service proxy ingress.
    # Note: If you need host mode, the service must use network_mode: host (not compatible with overlay networks)
    ports:
      - target: 5432
        published: ${POSTGRES_EXPOSE_PORT:-5433}
        protocol: tcp
        mode: ${POSTGRES_PORT_MODE:-ingress}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    configs:
      # Mount custom pg_hba.conf file and init script
      - source: postgres_hba_conf
        target: /docker-entrypoint-initdb.d/pg_hba.conf
        mode: 0644
      - source: postgres_hba_init
        target: /docker-entrypoint-initdb.d/01-init-pg-hba.sh
        mode: 0755
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-obiente_postgres} -d ${POSTGRES_DB:-obiente}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.postgres.enabled == true
      resources:
        limits:
          cpus: "2"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 128M
    dns_search: []
    networks:
      - obiente-network

  timescaledb:
    image: timescale/timescaledb:latest-pg16
    environment:
      POSTGRES_USER: ${METRICS_DB_USER:-obiente_postgres}
      POSTGRES_PASSWORD: ${METRICS_DB_PASSWORD:-obiente_postgres}
      POSTGRES_DB: ${METRICS_DB_NAME:-obiente_metrics}
      # Configure PostgreSQL to listen on all interfaces (required for Docker Swarm overlay network)
      POSTGRES_HOST_AUTH_METHOD: md5
      # Overlay network subnet for pg_hba.conf configuration
      OVERLAY_SUBNET: ${OVERLAY_SUBNET:-10.15.3.0/24}
      # Allowed hosts for pg_hba.conf (comma-separated IPs or subnets, e.g., "10.10.10.1,10.0.0.0/8")
      # Falls back to POSTGRES_ALLOWED_HOSTS if not set
      POSTGRES_ALLOWED_HOSTS: ${METRICS_DB_ALLOWED_HOSTS:-${POSTGRES_ALLOWED_HOSTS:-}}
    command:
      - postgres
      - -c
      - listen_addresses=*
      - -c
      - max_connections=200
    # Port exposure configuration for Netbird VPN access
    # Default: Use ingress mode for Swarm compatibility (host mode conflicts with overlay networks)
    # To change binding, set METRICS_DB_EXPOSE_PORT and METRICS_DB_PORT_MODE environment variables
    # Note: In Docker Swarm, services on overlay networks must use ingress mode for ports
    # Examples:
    #   - METRICS_DB_EXPOSE_PORT=5434  # Default port
    #   - METRICS_DB_PORT_MODE=ingress  # Use ingress mode (required for overlay networks)
    # Note: Keep distinct from POSTGRES_EXPOSE_PORT and databases-service proxy ports.
    # Note: If you need host mode, the service must use network_mode: host (not compatible with overlay networks)
    ports:
      - target: 5432
        published: ${METRICS_DB_EXPOSE_PORT:-5434}
        protocol: tcp
        mode: ${METRICS_DB_PORT_MODE:-ingress}
    volumes:
      - timescaledb_data:/var/lib/postgresql/data
    configs:
      # Mount custom pg_hba.conf file and init script
      - source: postgres_hba_conf
        target: /docker-entrypoint-initdb.d/pg_hba.conf
        mode: 0644
      - source: postgres_hba_init
        target: /docker-entrypoint-initdb.d/01-init-pg-hba.sh
        mode: 0755
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${METRICS_DB_USER:-obiente_postgres} -d ${METRICS_DB_NAME:-obiente_metrics}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.metrics.enabled == true
      resources:
        limits:
          cpus: "2"
          memory: 2G
        reservations:
          cpus: "0.25"
          memory: 128M
    dns_search: []
    networks:
      - obiente-network

  redis:
    image: redis:8-alpine
    environment:
      # Redis password authentication (required if port is exposed)
      # If REDIS_PASSWORD is set, Redis will require authentication
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
    command:
      - sh
      - -c
      - |
        if [ -n "$$REDIS_PASSWORD" ]; then
          exec redis-server --appendonly yes --requirepass "$$REDIS_PASSWORD"
        else
          exec redis-server --appendonly yes
        fi
    # Port exposure configuration for Netbird VPN access
    # Default: Use ingress mode for Swarm compatibility (host mode conflicts with overlay networks)
    # To change binding, set REDIS_EXPOSE_PORT and REDIS_PORT_MODE environment variables
    # Note: In Docker Swarm, services on overlay networks must use ingress mode for ports
    # Examples:
    #   - REDIS_EXPOSE_PORT=6379  # Default port
    #   - REDIS_PORT_MODE=ingress  # Use ingress mode (required for overlay networks)
    # Note: If you need host mode, the service must use network_mode: host (not compatible with overlay networks)
    ports:
      - target: 6379
        published: ${REDIS_EXPOSE_PORT:-6379}
        protocol: tcp
        mode: ${REDIS_PORT_MODE:-ingress}
    volumes:
      - redis_data:/data
    healthcheck:
      # Health check with password support
      # If REDIS_PASSWORD is set, use AUTH command
      test: ["CMD-SHELL", "if [ -n \"$$REDIS_PASSWORD\" ]; then redis-cli -a \"$$REDIS_PASSWORD\" ping; else redis-cli ping; fi || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.redis.enabled == true
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
    dns_search: []
    networks:
      - obiente-network

  # ============================================================================
  # MICROSERVICES
  # ============================================================================
  # All functionality has been moved from the monolithic API to microservices
  # API Gateway (port 3001) is the primary entry point and routes to microservices

  # API Gateway - Routes requests to all microservices
  api-gateway:
    image: ghcr.io/obiente/cloud-api-gateway:latest
    build:
      context: .
      dockerfile: apps/api-gateway/Dockerfile
    environment:
      PORT: 3001
      <<: [*common-auth, *common-api-gateway]
    ports:
      - target: 3001
        published: ${API_GATEWAY_PORT:-3001}
        protocol: tcp
        mode: ingress  # Use ingress mode for Swarm compatibility (host mode conflicts with overlay networks)
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
        failure_action: rollback
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.api-gateway.rule=Host(`api.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.api-gateway.entrypoints=web"
        - "traefik.http.routers.api-gateway.service=api-gateway"
        # Retry middleware for transient failures
        - "traefik.http.middlewares.api-gateway-retry.retry.attempts=3"
        - "traefik.http.middlewares.api-gateway-retry.retry.initialInterval=100ms"
        - "traefik.http.routers.api-gateway.middlewares=api-gateway-retry"
        - "traefik.http.services.api-gateway.loadbalancer.server.port=3001"
        - "traefik.http.services.api-gateway.loadbalancer.passHostHeader=true"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.path=/health"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.interval=10s"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.timeout=3s"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.scheme=http"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.followRedirects=true"
        - "traefik.http.routers.api-gateway-secure.rule=Host(`api.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.api-gateway-secure.entrypoints=websecure"
        - "traefik.http.routers.api-gateway-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.api-gateway-secure.service=api-gateway"
        # Circuit breaker removed from API gateway - gateway should always be accessible
        - "traefik.http.routers.api-gateway-secure.middlewares=api-gateway-retry"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3001/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Auth Service - Microservice for authentication
  auth-service:
    image: ghcr.io/obiente/cloud-auth-service:latest
    build:
      context: .
      dockerfile: apps/auth-service/Dockerfile
    environment:
      PORT: 3002
      <<: [*common-database, *common-metrics-db, *common-auth, *common-dashboard, *common-github]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.auth-service.rule=Host(`auth-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.auth-service.entrypoints=web"
        - "traefik.http.services.auth-service.loadbalancer.server.port=3002"
        - "traefik.http.routers.auth-service-secure.rule=Host(`auth-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.auth-service-secure.entrypoints=websecure"
        - "traefik.http.routers.auth-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.auth-service-secure.service=auth-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3002/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Organizations Service - Microservice for organization management
  organizations-service:
    image: ghcr.io/obiente/cloud-organizations-service:latest
    build:
      context: .
      dockerfile: apps/organizations-service/Dockerfile
    environment:
      PORT: 3003
      <<: [*common-database, *common-metrics-db, *common-auth, *common-smtp, *common-dashboard, *common-notifications]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.organizations-service.rule=Host(`organizations-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.organizations-service.entrypoints=web"
        - "traefik.http.services.organizations-service.loadbalancer.server.port=3003"
        - "traefik.http.routers.organizations-service-secure.rule=Host(`organizations-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.organizations-service-secure.entrypoints=websecure"
        - "traefik.http.routers.organizations-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.organizations-service-secure.service=organizations-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3003/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Billing Service - Microservice for billing and Stripe integration
  billing-service:
    image: ghcr.io/obiente/cloud-billing-service:latest
    build:
      context: .
      dockerfile: apps/billing-service/Dockerfile
    environment:
      PORT: 3004
      <<: [*common-database, *common-metrics-db, *common-auth, *common-stripe, *common-dashboard, *common-notifications]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.billing-service.rule=Host(`billing-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.billing-service.entrypoints=web"
        - "traefik.http.services.billing-service.loadbalancer.server.port=3004"
        - "traefik.http.routers.billing-service-secure.rule=Host(`billing-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.billing-service-secure.entrypoints=websecure"
        - "traefik.http.routers.billing-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.billing-service-secure.service=billing-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3004/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Deployments Service - Microservice for deployment management
  deployments-service:
    image: ghcr.io/obiente/cloud-deployments-service:latest
    build:
      context: .
      dockerfile: apps/deployments-service/Dockerfile
    environment:
      PORT: 3005
      <<: [*common-database, *common-metrics-db, *common-auth, *common-redis, *common-github, *common-orchestrator, *common-dns-delegation, *common-notifications]
      ENABLE_SWARM: ${ENABLE_SWARM:-true}  # Override to enable Swarm mode (default: true for Swarm deployment)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/obiente:/var/lib/obiente
      - /var/obiente/tmp/obiente-volumes:/tmp/obiente-volumes
      - /var/obiente/tmp/obiente-deployments:/tmp/obiente-deployments
    deploy:
      mode: global  # One instance per node for local Docker access
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
        failure_action: rollback
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "2"
          memory: 2G
        reservations:
          cpus: "0.25"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.deployments-service.rule=Host(`deployments-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.deployments-service.entrypoints=web"
        - "traefik.http.services.deployments-service.loadbalancer.server.port=3005"
        - "traefik.http.routers.deployments-service-secure.rule=Host(`deployments-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.deployments-service-secure.entrypoints=websecure"
        - "traefik.http.routers.deployments-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.deployments-service-secure.service=deployments-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3005/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Game Servers Service - Microservice for game server management
  gameservers-service:
    image: ghcr.io/obiente/cloud-gameservers-service:latest
    build:
      context: .
      dockerfile: apps/gameservers-service/Dockerfile
    environment:
      PORT: 3006
      <<: [*common-database, *common-metrics-db, *common-auth, *common-notifications]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/obiente/volumes:/var/lib/obiente/volumes
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.gameservers-service.rule=Host(`gameservers-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.gameservers-service.entrypoints=web"
        - "traefik.http.services.gameservers-service.loadbalancer.server.port=3006"
        - "traefik.http.routers.gameservers-service-secure.rule=Host(`gameservers-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.gameservers-service-secure.entrypoints=websecure"
        - "traefik.http.routers.gameservers-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.gameservers-service-secure.service=gameservers-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3006/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Orchestrator Service - Microservice for container orchestration and metrics
  orchestrator-service:
    image: ghcr.io/obiente/cloud-orchestrator-service:latest
    build:
      context: .
      dockerfile: apps/orchestrator-service/Dockerfile
    environment:
      PORT: 3007
      <<: [*common-database, *common-metrics-db, *common-redis, *common-orchestrator, *common-vps, *common-dns-delegation, *common-notifications]
      ORCHESTRATOR_SYNC_INTERVAL: ${ORCHESTRATOR_SYNC_INTERVAL:-30s}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "2"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.orchestrator-service.rule=Host(`orchestrator-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.orchestrator-service.entrypoints=web"
        - "traefik.http.services.orchestrator-service.loadbalancer.server.port=3007"
        - "traefik.http.routers.orchestrator-service-secure.rule=Host(`orchestrator-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.orchestrator-service-secure.entrypoints=websecure"
        - "traefik.http.routers.orchestrator-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.orchestrator-service-secure.service=orchestrator-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3007/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # VPS Service - Microservice for VPS management
  vps-service:
    image: ghcr.io/obiente/cloud-vps-service:latest
    build:
      context: .
      dockerfile: apps/vps-service/Dockerfile
    environment:
      PORT: 3008
      <<: [*common-database, *common-metrics-db, *common-auth, *common-orchestrator, *common-vps, *common-notifications, *common-redis]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.vps-service.rule=Host(`vps-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.vps-service.entrypoints=web"
        - "traefik.http.services.vps-service.loadbalancer.server.port=3008"
        - "traefik.http.routers.vps-service-secure.rule=Host(`vps-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.vps-service-secure.entrypoints=websecure"
        - "traefik.http.routers.vps-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.vps-service-secure.service=vps-service"
        # SSH TCP routing through Traefik (SSH proxy runs in vps-service)
        - "traefik.tcp.routers.ssh.rule=HostSNI(`*`)"
        - "traefik.tcp.routers.ssh.entrypoints=ssh"
        - "traefik.tcp.routers.ssh.service=ssh"
        - "traefik.tcp.services.ssh.loadbalancer.server.port=${SSH_PROXY_PORT:-2222}"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3008/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Support Service - Microservice for support ticket management
  support-service:
    image: ghcr.io/obiente/cloud-support-service:latest
    build:
      context: .
      dockerfile: apps/support-service/Dockerfile
    environment:
      PORT: 3009
      <<: [*common-database, *common-metrics-db, *common-auth]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.support-service.rule=Host(`support-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.support-service.entrypoints=web"
        - "traefik.http.services.support-service.loadbalancer.server.port=3009"
        - "traefik.http.routers.support-service-secure.rule=Host(`support-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.support-service-secure.entrypoints=websecure"
        - "traefik.http.routers.support-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.support-service-secure.service=support-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3009/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Audit Service - Microservice for audit log management
  audit-service:
    image: ghcr.io/obiente/cloud-audit-service:latest
    build:
      context: .
      dockerfile: apps/audit-service/Dockerfile
    environment:
      PORT: 3010
      <<: [*common-database, *common-metrics-db, *common-auth]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.audit-service.rule=Host(`audit-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.audit-service.entrypoints=web"
        - "traefik.http.services.audit-service.loadbalancer.server.port=3010"
        - "traefik.http.routers.audit-service-secure.rule=Host(`audit-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.audit-service-secure.entrypoints=websecure"
        - "traefik.http.routers.audit-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.audit-service-secure.service=audit-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3010/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  notifications-service:
    image: ghcr.io/obiente/cloud-notifications-service:latest
    build:
      context: .
      dockerfile: apps/notifications-service/Dockerfile
    environment:
      PORT: 3012
      <<: [*common-database, *common-metrics-db, *common-auth, *common-smtp, *common-dashboard, *common-notifications]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.notifications-service.rule=Host(`notifications-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.notifications-service.entrypoints=web"
        - "traefik.http.services.notifications-service.loadbalancer.server.port=3012"
        - "traefik.http.routers.notifications-service-secure.rule=Host(`notifications-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.notifications-service-secure.entrypoints=websecure"
        - "traefik.http.routers.notifications-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.notifications-service-secure.service=notifications-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3012/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Superadmin Service - Microservice for superadmin operations
  superadmin-service:
    image: ghcr.io/obiente/cloud-superadmin-service:latest
    build:
      context: .
      dockerfile: apps/superadmin-service/Dockerfile
    environment:
      PORT: 3011
      <<: [*common-database, *common-metrics-db, *common-auth, *common-stripe, *common-orchestrator, *common-vps, *common-notifications]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.superadmin-service.rule=Host(`superadmin-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.superadmin-service.entrypoints=web"
        - "traefik.http.services.superadmin-service.loadbalancer.server.port=3011"
        - "traefik.http.routers.superadmin-service-secure.rule=Host(`superadmin-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.superadmin-service-secure.entrypoints=websecure"
        - "traefik.http.routers.superadmin-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.superadmin-service-secure.service=superadmin-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3011/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # DNS Service - Microservice for DNS resolution
  # Set ENABLE_DNS=false to disable this service when using DNS delegation
  dns-service:
    image: ghcr.io/obiente/cloud-dns-service:latest
    build:
      context: .
      dockerfile: apps/dns-service/Dockerfile
    environment:
      <<: [*common-database, *common-redis, *common-orchestrator, *common-dns]
      HTTP_PORT: ${DNS_HTTP_PORT:-8053}
    ports:
      # Use host mode publishing to expose DNS port directly on the host
      # DNS only runs on nodes labeled with dns.enabled=true
      # Published port uses DNS_PORT environment variable (default: 53)
      - target: 53
        published: ${DNS_PORT:-53}
        protocol: udp
        mode: host
      - target: 53
        published: ${DNS_PORT:-53}
        protocol: tcp
        mode: host
    cap_add:
      - NET_BIND_SERVICE
    deploy:
      mode: replicated
      replicas: ${DNS_REPLICAS:-1}
      placement:
        constraints:
          - node.labels.dns.enabled == true
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=dns-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.dns-service.rule=Host(`dns-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.dns-service.entrypoints=web"
        - "traefik.http.services.dns-service.loadbalancer.server.port=8053"
        - "traefik.http.routers.dns-service-secure.rule=Host(`dns-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.dns-service-secure.entrypoints=websecure"
        - "traefik.http.routers.dns-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.dns-service-secure.service=dns-service"
        - "traefik.docker.network=obiente_obiente-network"  # Use overlay network IP, not ingress network
    healthcheck:
      test: ["CMD-SHELL", "if command -v nc >/dev/null 2>&1; then nc -z localhost ${DNS_PORT:-53} || exit 1; else (apk add --no-cache netcat-openbsd >/dev/null 2>&1 || apt-get update -qq && apt-get install -y -qq netcat-openbsd >/dev/null 2>&1 || yum install -y -q nc >/dev/null 2>&1) && nc -z localhost ${DNS_PORT:-53} || exit 1; fi"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # VPS Gateway - gRPC gateway for VPS operations (optional)
  vps-gateway:
    image: ghcr.io/obiente/cloud-vps-gateway:latest
    build:
      context: .
      dockerfile: apps/vps-gateway/Dockerfile
    ports:
      - target: 1537
        published: 1537
        protocol: tcp
        mode: ingress  # Use ingress mode for Swarm compatibility (host mode conflicts with overlay networks)
      - target: 9091
        published: 9091
        protocol: tcp
        mode: ingress  # Use ingress mode for Swarm compatibility (host mode conflicts with overlay networks)
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.labels.vps-gateway.enabled == true
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
    dns_search: []
    networks:
      - obiente-network

  traefik:
    image: traefik:v3.6.1
    command:
      - --api.dashboard=true
      - --api.insecure=true  # Enable API on port 8080 directly
      - --providers.swarm=true  # Use Swarm provider for Docker Swarm mode (v3.0)
      - --providers.swarm.exposedbydefault=false
      - --providers.swarm.watch=true  # Watch for service changes
      - --providers.swarm.refreshSeconds=5  # Poll Docker Swarm every 5 seconds for faster service discovery
      - --providers.swarm.constraints=Label(`cloud.obiente.traefik`,`true`)  # Only discover services with this label
      # Timeout configuration to fail faster on unreachable backends
      # dialTimeout: time to establish connection (increased to 10s to handle network delays)
      - --serversTransport.forwardingTimeouts.dialTimeout=10s
      # responseHeaderTimeout: time to wait for response headers
      - --serversTransport.forwardingTimeouts.responseHeaderTimeout=15s
      # idleConnTimeout: time to keep idle connections open
      - --serversTransport.forwardingTimeouts.idleConnTimeout=90s
      - --entryPoints.web.address=:80
      - --entryPoints.web.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      - --entryPoints.websecure.address=:443
      - --entryPoints.websecure.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      - --entryPoints.deployments.address=:8000
      - --entryPoints.deployments.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      - --entryPoints.ssh.address=:${SSH_PROXY_PORT:-2222}
      - --entryPoints.ssh.proxyProtocol.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      # Database TCP ports are handled by databases-service proxy (not Traefik)
      # Port 8080 is used by Traefik API (--api.insecure=true)
      # Grafana is accessible via port 80/443 at /grafana
      # Let's Encrypt
      - --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:-admin@example.com}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      # Use Let's Encrypt staging environment if ACME_CA_SERVER is set to staging URL
      # Set ACME_CA_SERVER=https://acme-staging-v02.api.letsencrypt.org/directory to avoid rate limits during testing
      # Default: production (https://acme-v02.api.letsencrypt.org/directory)
      - --certificatesresolvers.letsencrypt.acme.caserver=${ACME_CA_SERVER:-https://acme-v02.api.letsencrypt.org/directory}
      # Metrics
      - --metrics.prometheus=true
      # Logging
      - --accesslog=true
      - --log.level=DEBUG  # Enable debug logging to see service discovery
    ports:
      - target: 80
        published: ${TRAEFIK_HTTP_PORT:-80}
        protocol: tcp
        mode: host  # host mode preserves real client IPs (ingress mode causes SNAT)
      - target: 443
        published: ${TRAEFIK_HTTPS_PORT:-443}
        protocol: tcp
        mode: host  # host mode preserves real client IPs (ingress mode causes SNAT)
      - target: 8000
        published: ${TRAEFIK_DEPLOYMENTS_PORT:-8000}
        protocol: tcp
        mode: host  # host mode preserves real client IPs (ingress mode causes SNAT)
      - target: 8080
        published: ${TRAEFIK_DASHBOARD_PORT:-8080}
        protocol: tcp
        mode: host  # Traefik dashboard accessible on port 8080
      - target: ${SSH_PROXY_PORT:-2222}
        published: ${TRAEFIK_SSH_PORT:-2222}
        protocol: tcp
        mode: host  # host mode preserves real client IPs for SSH connections
      # Database ports are handled by databases-service proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_letsencrypt:/letsencrypt
    deploy:
      mode: global  # Run one instance on each manager node
      update_config:
        parallelism: 1
        order: start-first
      placement:
        constraints:
          - node.role == manager  # Only run on manager nodes
          - node.labels.traefik.exclude != true  # Exclude nodes labeled with traefik.exclude=true
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        # Traefik dashboard accessible directly on port 8080 via --api.insecure=true
        # Also route Traefik dashboard via HTTPS
        - "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.traefik.entrypoints=websecure"
        - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
        - "traefik.http.routers.traefik.service=api@internal"
        - "traefik.http.services.traefik.loadbalancer.server.port=8080"
    dns_search: []
    networks:
      - obiente-network

  # ============================================================================
  # MONITORING & OBSERVABILITY
  # ============================================================================

  # Prometheus - Metrics collection
  prometheus:
    image: prom/prometheus:latest
    user: "0:0"  # Run as root to access Docker socket for Swarm service discovery
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=15d"
    volumes:
      - prometheus_data:/prometheus
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro  # Required for Docker Swarm service discovery
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          cpus: "2"
          memory: 2G
        reservations:
          cpus: "0.25"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.prometheus.rule=Host(`prometheus.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.prometheus.entrypoints=websecure"
        - "traefik.http.routers.prometheus.tls.certresolver=letsencrypt"
        - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
    dns_search: []
    networks:
      - obiente-network

  # Grafana - Metrics visualization dashboard accessible at /grafana via Traefik
  grafana:
    image: grafana/grafana:latest
    user: "0:0"  # Run as root for entrypoint script to write provisioning files
    entrypoint: ["/bin/sh", "/etc/grafana/entrypoint.sh"]
    command: ["/run.sh"]
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-admin}
      GF_SERVER_ROOT_URL: https://grafana.${DOMAIN:-localhost}
      # Disable strict provisioning validation to avoid conflicts
      GF_PROVISIONING_DATASOURCES_ALLOW_DELETION: "true"
      # Allow unsigned plugins (for lokiexplore-app and other community plugins)
      GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS: "grafana-lokiexplore-app"
      # Pass database credentials as environment variables for datasource provisioning
      POSTGRES_USER: ${POSTGRES_USER:-obiente_postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-obiente_postgres}
      METRICS_DB_USER: ${METRICS_DB_USER:-obiente_postgres}
      METRICS_DB_PASSWORD: ${METRICS_DB_PASSWORD:-obiente_postgres}
      # Datasource host configuration (for regular swarm, use direct service names)
      GRAFANA_POSTGRES_HOST: ${GRAFANA_POSTGRES_HOST:-postgres}
      GRAFANA_METRICS_DB_HOST: ${GRAFANA_METRICS_DB_HOST:-timescaledb}
      # Alerting configuration
      ALERT_EMAIL: ${ALERT_EMAIL:-admin@example.com}
      # SMTP configuration for Grafana email notifications (only set if SMTP_HOST is configured)
      # These will be conditionally set by the entrypoint script
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM_ADDRESS: ${SMTP_FROM_ADDRESS:-}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-Grafana}
      SMTP_SKIP_TLS_VERIFY: ${SMTP_SKIP_TLS_VERIFY:-false}
      SMTP_USE_STARTTLS: ${SMTP_USE_STARTTLS:-true}
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:rw
      - ./monitoring/grafana/dashboards:/etc/grafana/dashboards:ro
      - ./monitoring/grafana/entrypoint.sh:/etc/grafana/entrypoint.sh:ro
    depends_on:
      - prometheus
      - postgres
      - timescaledb
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        # Route Grafana at grafana.domain (Host-based routing)
        - "traefik.http.routers.grafana.rule=Host(`grafana.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.grafana.entrypoints=web"
        - "traefik.http.routers.grafana.service=grafana"
        - "traefik.http.services.grafana.loadbalancer.server.port=3000"
        # Route Grafana on HTTPS for production access
        - "traefik.http.routers.grafana-secure.rule=Host(`grafana.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.grafana-secure.entrypoints=websecure"
        - "traefik.http.routers.grafana-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.grafana-secure.service=grafana"
    dns_search: []
    networks:
      - obiente-network

  # Docker Registry - Host images for Swarm deployments
  registry:
    image: registry:2
    environment:
      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /var/lib/registry
      REGISTRY_HTTP_ADDR: 0.0.0.0:5000
      # Allow deletion of images (useful for cleanup)
      REGISTRY_STORAGE_DELETE_ENABLED: "true"
      # Enable basic auth for private repositories
      REGISTRY_AUTH: htpasswd
      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
      REGISTRY_AUTH_HTPASSWD_REALM: "Obiente Cloud Registry"
    volumes:
      - registry_data:/var/lib/registry
      # Use bind mount for auth directory to allow easy setup from host
      - /var/lib/obiente/registry-auth:/auth:ro
    healthcheck:
      test: ["CMD-SHELL", "sh -c 'if command -v nc >/dev/null 2>&1; then nc -z localhost 5000 || exit 1; else (apk add --no-cache netcat-openbsd >/dev/null 2>&1 || apt-get update -qq && apt-get install -y -qq netcat-openbsd >/dev/null 2>&1 || yum install -y -q nc >/dev/null 2>&1) && nc -z localhost 5000 || exit 1; fi'"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          cpus: "2"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.registry.rule=Host(`registry.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.registry.entrypoints=websecure"
        - "traefik.http.routers.registry.tls.certresolver=letsencrypt"
        - "traefik.http.routers.registry.service=registry"
        - "traefik.http.services.registry.loadbalancer.server.port=5000"
    dns_search: []
    networks:
      - obiente-network

  # Note: Dashboard is deployed separately using docker-compose.dashboard.yml
  # Run: ./scripts/deploy-swarm.sh to deploy both main stack and dashboard
  # Note: vps-gateway service is deployed separately using docker-compose.vps-gateway.yml
  # It should be deployed on the gateway VM/container with network_mode: host

volumes:
  postgres_data:
    driver: local
  timescaledb_data:
    driver: local
  redis_data:
    driver: local
  traefik_letsencrypt:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  registry_data:
    driver: local

networks:
  obiente-network:
    driver: overlay
    attachable: true
    driver_opts:
      encrypted: "true"
    ipam:
      config:
        - subnet: 10.15.3.0/24
    # Docker Swarm will automatically create this network when the stack is deployed
    # Network name will be: {stack-name}_obiente-network (e.g., obiente_obiente-network)
  obiente-databases:
    # Fixed name so API-created database containers can join this network
    name: obiente-databases
    driver: overlay
    attachable: true
    driver_opts:
      encrypted: "true"
    # Services on this network can resolve each other by service name (e.g., "postgres")
    # IMPORTANT: Do NOT use external: true - it breaks DNS resolution in Swarm
    # The embedded DNS server (127.0.0.11) only works properly when the network is created BY THE STACK
    # Option: Connect to main deployment's network (recommended approach for dev)
    # Uncomment and configure to share the network with main deployment
    # This allows direct access to the main deployment's DNS server by service name
    # main-deployment-network:
    #   external: true
    #   name: ${MAIN_DEPLOYMENT_NETWORK:-obiente_obiente-network}

configs:
  # Custom pg_hba.conf file
  postgres_hba_conf:
    file: ./scripts/internal/pg_hba.conf
  # Init script to copy pg_hba.conf to PGDATA
  postgres_hba_init:
    file: ./scripts/internal/init-pg-hba.sh