docker-compose.yml

# This file requires docker-compose.base.yml to be merged before use
# Usage: ./scripts/docker-compose-wrapper.sh docker-compose.yml [command]
# Or manually: cat docker-compose.base.yml docker-compose.yml | docker compose -f - [command]

services:
  # Main API service removed - all functionality has been moved to microservices
  # API Gateway (port 3001) is the primary entry point and routes to microservices
  
  # Audit Service - Microservice for audit log management
  audit-service:
    image: ghcr.io/obiente/cloud-audit-service:latest
    build:
      context: .
      dockerfile: apps/audit-service/Dockerfile
    environment:
      PORT: 3010
      <<: [*common-database, *common-metrics-db, *common-auth]
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    labels:
      - "cloud.obiente.service=audit-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.audit-service.rule=Host(`audit-service.${DOMAIN:-localhost}`) || Host(`audit-service.localhost`)"
      - "traefik.http.routers.audit-service.entrypoints=web"
      - "traefik.http.services.audit-service.loadbalancer.server.port=3010"
      - "traefik.http.routers.audit-service-secure.rule=Host(`audit-service.${DOMAIN:-localhost}`) || Host(`audit-service.localhost`)"
      - "traefik.http.routers.audit-service-secure.entrypoints=websecure"
      - "traefik.http.routers.audit-service-secure.service=audit-service"
      - "traefik.http.routers.audit-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3010/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Notifications Service - Microservice for user notifications
  notifications-service:
    image: ghcr.io/obiente/cloud-notifications-service:latest
    build:
      context: .
      dockerfile: apps/notifications-service/Dockerfile
    environment:
      PORT: 3012
      <<: [*common-database, *common-metrics-db, *common-auth, *common-smtp, *common-dashboard, *common-notifications]
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    labels:
      - "cloud.obiente.service=notifications-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.notifications-service.rule=Host(`notifications-service.${DOMAIN:-localhost}`) || Host(`notifications-service.localhost`)"
      - "traefik.http.routers.notifications-service.entrypoints=web"
      - "traefik.http.services.notifications-service.loadbalancer.server.port=3012"
      - "traefik.http.routers.notifications-service-secure.rule=Host(`notifications-service.${DOMAIN:-localhost}`) || Host(`notifications-service.localhost`)"
      - "traefik.http.routers.notifications-service-secure.entrypoints=websecure"
      - "traefik.http.routers.notifications-service-secure.service=notifications-service"
      - "traefik.http.routers.notifications-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3012/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Support Service - Microservice for support ticket management
  support-service:
    image: ghcr.io/obiente/cloud-support-service:latest
    build:
      context: .
      dockerfile: apps/support-service/Dockerfile
    environment:
      PORT: 3009
      <<: [*common-database, *common-metrics-db, *common-auth]
    depends_on:
      postgres:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    labels:
      - "cloud.obiente.service=support-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.support-service.rule=Host(`support-service.${DOMAIN:-localhost}`) || Host(`support-service.localhost`)"
      - "traefik.http.routers.support-service.entrypoints=web"
      - "traefik.http.services.support-service.loadbalancer.server.port=3009"
      - "traefik.http.routers.support-service-secure.rule=Host(`support-service.${DOMAIN:-localhost}`) || Host(`support-service.localhost`)"
      - "traefik.http.routers.support-service-secure.entrypoints=websecure"
      - "traefik.http.routers.support-service-secure.service=support-service"
      - "traefik.http.routers.support-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3009/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Auth Service - Microservice for authentication
  auth-service:
    image: ghcr.io/obiente/cloud-auth-service:latest
    build:
      context: .
      dockerfile: apps/auth-service/Dockerfile
    environment:
      PORT: 3002
      <<: [*common-database, *common-metrics-db, *common-auth, *common-dashboard, *common-github]
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    labels:
      - "cloud.obiente.service=auth-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.auth-service.rule=Host(`auth-service.${DOMAIN:-localhost}`) || Host(`auth-service.localhost`)"
      - "traefik.http.routers.auth-service.entrypoints=web"
      - "traefik.http.services.auth-service.loadbalancer.server.port=3002"
      - "traefik.http.routers.auth-service-secure.rule=Host(`auth-service.${DOMAIN:-localhost}`) || Host(`auth-service.localhost`)"
      - "traefik.http.routers.auth-service-secure.entrypoints=websecure"
      - "traefik.http.routers.auth-service-secure.service=auth-service"
      - "traefik.http.routers.auth-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3002/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Organizations Service - Microservice for organization management
  organizations-service:
    image: ghcr.io/obiente/cloud-organizations-service:latest
    build:
      context: .
      dockerfile: apps/organizations-service/Dockerfile
    environment:
      PORT: 3003
      <<: [*common-database, *common-metrics-db, *common-auth, *common-smtp, *common-dashboard, *common-notifications]
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    labels:
      - "cloud.obiente.service=organizations-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.organizations-service.rule=Host(`organizations-service.${DOMAIN:-localhost}`) || Host(`organizations-service.localhost`)"
      - "traefik.http.routers.organizations-service.entrypoints=web"
      - "traefik.http.services.organizations-service.loadbalancer.server.port=3003"
      - "traefik.http.routers.organizations-service-secure.rule=Host(`organizations-service.${DOMAIN:-localhost}`) || Host(`organizations-service.localhost`)"
      - "traefik.http.routers.organizations-service-secure.entrypoints=websecure"
      - "traefik.http.routers.organizations-service-secure.service=organizations-service"
      - "traefik.http.routers.organizations-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3003/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Billing Service - Microservice for billing and Stripe integration
  billing-service:
    image: ghcr.io/obiente/cloud-billing-service:latest
    build:
      context: .
      dockerfile: apps/billing-service/Dockerfile
    environment:
      PORT: 3004
      <<: [*common-database, *common-metrics-db, *common-auth, *common-stripe, *common-dashboard, *common-notifications]
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    labels:
      - "cloud.obiente.service=billing-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.billing-service.rule=Host(`billing-service.${DOMAIN:-localhost}`) || Host(`billing-service.localhost`)"
      - "traefik.http.routers.billing-service.entrypoints=web"
      - "traefik.http.services.billing-service.loadbalancer.server.port=3004"
      - "traefik.http.routers.billing-service-secure.rule=Host(`billing-service.${DOMAIN:-localhost}`) || Host(`billing-service.localhost`)"
      - "traefik.http.routers.billing-service-secure.entrypoints=websecure"
      - "traefik.http.routers.billing-service-secure.service=billing-service"
      - "traefik.http.routers.billing-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3004/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Deployments Service - Microservice for deployment management
  deployments-service:
    image: ghcr.io/obiente/cloud-deployments-service:latest
    build:
      context: .
      dockerfile: apps/deployments-service/Dockerfile
    environment:
      PORT: 3005
      <<: [*common-database, *common-metrics-db, *common-auth, *common-redis, *common-github, *common-orchestrator, *common-dns-delegation, *common-notifications]
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "cloud.obiente.service=deployments-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.deployments-service.rule=Host(`deployments-service.${DOMAIN:-localhost}`) || Host(`deployments-service.localhost`)"
      - "traefik.http.routers.deployments-service.entrypoints=web"
      - "traefik.http.services.deployments-service.loadbalancer.server.port=3005"
      - "traefik.http.routers.deployments-service-secure.rule=Host(`deployments-service.${DOMAIN:-localhost}`) || Host(`deployments-service.localhost`)"
      - "traefik.http.routers.deployments-service-secure.entrypoints=websecure"
      - "traefik.http.routers.deployments-service-secure.service=deployments-service"
      - "traefik.http.routers.deployments-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3005/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Databases Service - Microservice for managed database management
  databases-service:
    image: ghcr.io/obiente/cloud-databases-service:latest
    build:
      context: .
      dockerfile: apps/databases-service/Dockerfile
    environment:
      PORT: 3014
      <<: [*common-database, *common-metrics-db, *common-auth, *common-redis]
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
      - obiente-databases
    ports:
      - "5432:5432"     # PostgreSQL proxy
      - "3306:3306"     # MySQL/MariaDB proxy
      - "27017:27017"   # MongoDB proxy
      - "16379-16478:16379-16478"  # Redis port-per-instance
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "cloud.obiente.service=databases-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.databases-service.rule=Host(`databases-service.${DOMAIN:-localhost}`) || Host(`databases-service.localhost`)"
      - "traefik.http.routers.databases-service.entrypoints=web"
      - "traefik.http.services.databases-service.loadbalancer.server.port=3014"
      - "traefik.http.routers.databases-service-secure.rule=Host(`databases-service.${DOMAIN:-localhost}`) || Host(`databases-service.localhost`)"
      - "traefik.http.routers.databases-service-secure.entrypoints=websecure"
      - "traefik.http.routers.databases-service-secure.service=databases-service"
      - "traefik.http.routers.databases-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3014/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Game Servers Service - Microservice for game server management
  gameservers-service:
    image: ghcr.io/obiente/cloud-gameservers-service:latest
    build:
      context: .
      dockerfile: apps/gameservers-service/Dockerfile
    environment:
      PORT: 3006
      <<: [*common-database, *common-metrics-db, *common-auth, *common-notifications, *common-redis]
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/obiente/volumes:/var/lib/obiente/volumes
    labels:
      - "cloud.obiente.service=gameservers-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.gameservers-service.rule=Host(`gameservers-service.${DOMAIN:-localhost}`) || Host(`gameservers-service.localhost`)"
      - "traefik.http.routers.gameservers-service.entrypoints=web"
      - "traefik.http.services.gameservers-service.loadbalancer.server.port=3006"
      - "traefik.http.routers.gameservers-service-secure.rule=Host(`gameservers-service.${DOMAIN:-localhost}`) || Host(`gameservers-service.localhost`)"
      - "traefik.http.routers.gameservers-service-secure.entrypoints=websecure"
      - "traefik.http.routers.gameservers-service-secure.service=gameservers-service"
      - "traefik.http.routers.gameservers-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3006/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Orchestrator Service - Microservice for container orchestration and metrics
  orchestrator-service:
    image: ghcr.io/obiente/cloud-orchestrator-service:latest
    build:
      context: .
      dockerfile: apps/orchestrator-service/Dockerfile
    environment:
      PORT: 3007
      <<: [*common-database, *common-metrics-db, *common-redis, *common-orchestrator, *common-vps, *common-dns-delegation, *common-notifications]
      ORCHESTRATOR_SYNC_INTERVAL: ${ORCHESTRATOR_SYNC_INTERVAL:-30s}
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "cloud.obiente.service=orchestrator-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.orchestrator-service.rule=Host(`orchestrator-service.${DOMAIN:-localhost}`) || Host(`orchestrator-service.localhost`)"
      - "traefik.http.routers.orchestrator-service.entrypoints=web"
      - "traefik.http.services.orchestrator-service.loadbalancer.server.port=3007"
      - "traefik.http.routers.orchestrator-service-secure.rule=Host(`orchestrator-service.${DOMAIN:-localhost}`) || Host(`orchestrator-service.localhost`)"
      - "traefik.http.routers.orchestrator-service-secure.entrypoints=websecure"
      - "traefik.http.routers.orchestrator-service-secure.service=orchestrator-service"
      - "traefik.http.routers.orchestrator-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3007/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # VPS Service - Microservice for VPS management
  vps-service:
    image: ghcr.io/obiente/cloud-vps-service:latest
    build:
      context: .
      dockerfile: apps/vps-service/Dockerfile
    environment:
      PORT: 3008
      <<: [*common-database, *common-metrics-db, *common-auth, *common-orchestrator, *common-vps, *common-notifications, *common-redis]
    volumes:
      # Persist SSH host key to prevent fingerprint changes on restart
      - vps_ssh_host_key:/var/lib/obiente
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    labels:
      - "cloud.obiente.service=vps-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.vps-service.rule=Host(`vps-service.${DOMAIN:-localhost}`) || Host(`vps-service.localhost`)"
      - "traefik.http.routers.vps-service.entrypoints=web"
      - "traefik.http.services.vps-service.loadbalancer.server.port=3008"
      - "traefik.http.routers.vps-service-secure.rule=Host(`vps-service.${DOMAIN:-localhost}`) || Host(`vps-service.localhost`)"
      - "traefik.http.routers.vps-service-secure.entrypoints=websecure"
      - "traefik.http.routers.vps-service-secure.service=vps-service"
      - "traefik.http.routers.vps-service-secure.tls=true"
      # SSH TCP routing through Traefik (SSH proxy runs in vps-service)
      - "traefik.tcp.routers.ssh.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.ssh.entrypoints=ssh"
      - "traefik.tcp.routers.ssh.service=ssh"
      - "traefik.tcp.services.ssh.loadbalancer.server.port=${SSH_PROXY_PORT:-2222}"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3008/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Superadmin Service - Microservice for superadmin operations
  superadmin-service:
    image: ghcr.io/obiente/cloud-superadmin-service:latest
    build:
      context: .
      dockerfile: apps/superadmin-service/Dockerfile
    environment:
      PORT: 3011
      <<: [*common-database, *common-metrics-db, *common-auth, *common-stripe, *common-orchestrator, *common-vps, *common-notifications]
    depends_on:
      postgres:
        condition: service_healthy
      timescaledb:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    labels:
      - "cloud.obiente.service=superadmin-service"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.superadmin-service.rule=Host(`superadmin-service.${DOMAIN:-localhost}`) || Host(`superadmin-service.localhost`)"
      - "traefik.http.routers.superadmin-service.entrypoints=web"
      - "traefik.http.services.superadmin-service.loadbalancer.server.port=3011"
      - "traefik.http.routers.superadmin-service-secure.rule=Host(`superadmin-service.${DOMAIN:-localhost}`) || Host(`superadmin-service.localhost`)"
      - "traefik.http.routers.superadmin-service-secure.entrypoints=websecure"
      - "traefik.http.routers.superadmin-service-secure.service=superadmin-service"
      - "traefik.http.routers.superadmin-service-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3011/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # DNS Service - Microservice for DNS resolution
  # Set ENABLE_DNS=false to disable this service when using DNS delegation
  # When disabled, the service will exit gracefully (container will stop)
  dns-service:
    image: ghcr.io/obiente/cloud-dns-service:latest
    build:
      context: .
      dockerfile: apps/dns-service/Dockerfile
    environment:
      <<: [*common-database, *common-redis, *common-orchestrator, *common-dns, *common-dns-delegation]
      HTTP_PORT: ${DNS_HTTP_PORT:-8053}  # HTTP port for DNS delegation push endpoints
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns_search: []
    networks:
      - obiente-network
    # Ports mapping - automatically handled based on ENABLE_DNS
    # When ENABLE_DNS=false, the service exits immediately before binding ports
    # Docker will still try to map ports, but since the container exits, no conflict occurs
    # If you still get port conflicts, the external service is likely already using port 53
    ports:
      - "${DNS_PORT:-53}:${DNS_PORT:-53}/udp"
      - "${DNS_PORT:-53}:${DNS_PORT:-53}/tcp"
    cap_add:
      - NET_BIND_SERVICE
    labels:
      - "cloud.obiente.service=dns-service"
    # Health check - Check HTTP port (8053) instead of DNS port (53) since HTTP server always runs
    # even when ENABLE_DNS=false, and this is what Traefik routes to
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:${HTTP_PORT:-8053}/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # API Gateway - Routes requests to all microservices
  api-gateway:
    image: ghcr.io/obiente/cloud-api-gateway:latest
    build:
      context: .
      dockerfile: apps/api-gateway/Dockerfile
    environment:
      PORT: 3001
      <<: [*common-auth]
    dns_search: []
    networks:
      - obiente-network
    labels:
      - "cloud.obiente.service=api-gateway"
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.api-gateway.rule=Host(`api.${DOMAIN:-localhost}`) || Host(`api.localhost`)"
      - "traefik.http.routers.api-gateway.entrypoints=web"
      - "traefik.http.routers.api-gateway.service=api-gateway"
      - "traefik.http.services.api-gateway.loadbalancer.server.port=3001"
      - "traefik.http.services.api-gateway.loadbalancer.passHostHeader=true"
      - "traefik.http.routers.api-gateway-secure.rule=Host(`api.${DOMAIN:-localhost}`) || Host(`api.localhost`)"
      - "traefik.http.routers.api-gateway-secure.entrypoints=websecure"
      - "traefik.http.routers.api-gateway-secure.service=api-gateway"
      - "traefik.http.routers.api-gateway-secure.tls=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3001/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  postgres:
    image: postgres:16-alpine
    ports:
      - "127.0.0.1:5433:5432"
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-obiente}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - obiente-network

  timescaledb:
    image: timescale/timescaledb:latest-pg16
    ports:
      - "127.0.0.1:5434:5432"
    environment:
      POSTGRES_USER: ${METRICS_DB_USER:-postgres}
      POSTGRES_PASSWORD: ${METRICS_DB_PASSWORD:-postgres}
      POSTGRES_DB: ${METRICS_DB_NAME:-obiente_metrics}
    volumes:
      - timescaledb_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${METRICS_DB_USER:-postgres} -d ${METRICS_DB_NAME:-obiente_metrics}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - obiente-network

  redis:
    image: redis:8-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - obiente-network

  traefik:
    image: traefik:v3.6.1
    command:
      - --api.dashboard=true
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.constraints=Label(`cloud.obiente.traefik`,`true`)
      - --entryPoints.web.address=:80
      - --entryPoints.web.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      - --entryPoints.websecure.address=:443
      - --entryPoints.websecure.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      - --entryPoints.ssh.address=:${SSH_PROXY_PORT:-2222}
      - --entryPoints.ssh.proxyProtocol.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      # Database TCP ports are handled by databases-service proxy (not Traefik)
    labels:
      - "cloud.obiente.traefik=true"
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN:-localhost}`)"
      - "traefik.http.routers.traefik.entrypoints=web,websecure"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls=true"
    ports:
      - "${PUBLIC_HTTP_PORT:-80}:80"
      - "${PUBLIC_HTTPS_PORT:-443}:443"
      - "${PUBLIC_TRAEFIK_DASHBOARD_PORT:-8080}:8080"
      - "${SSH_PROXY_PORT:-2222}:${SSH_PROXY_PORT:-2222}"  # SSH proxy port (routed through Traefik)
      # Database ports are handled by databases-service proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - obiente-network

  # DNS Server - Runs on port 53 inside Docker network only (not exposed to host)
  # This allows dev deployments to resolve without binding port 53 on host
  # The DNS server queries the dev database, so dev deployments resolve correctly
  # Containers can resolve domains via this DNS server (no nameserver config needed)
  # To use production DNS instead, set MAIN_DNS_IP and comment out this service
  # Note: DNS service is now a microservice (dns-service above)
  # This old service definition is kept for reference but dns-service should be used instead

volumes:
  postgres_data:
  redis_data:
  timescaledb_data:
  vps_ssh_host_key:
    # Persists the SSH proxy host key to prevent fingerprint changes

networks:
  obiente-network:
    driver: bridge
    # Configure network to prevent DNS search domain issues
    # This ensures service names like "postgres" resolve correctly without appending .my.obiente.cloud
    driver_opts:
      com.docker.network.bridge.enable_icc: "true"
      com.docker.network.driver.mtu: "1500"
  obiente-databases:
    # Fixed name so API-created database containers can join this network
    name: obiente-databases
    driver: bridge
    driver_opts:
      com.docker.network.bridge.enable_icc: "true"
      com.docker.network.driver.mtu: "1500"
  # Option: Connect to production Swarm network (uncomment if both dev and prod are on same host)
  # This allows direct access to production DNS server by service name
  # production-network:
  #   external: true
  #   name: obiente_obiente-network  # Replace with your production network name