docker-compose.yml

services:
  bioetl:
    build:
      context: .
      dockerfile: Dockerfile.bioetl
    container_name: bioetl-app
    restart: unless-stopped
    depends_on:
      neo4j:
        condition: service_healthy
    volumes:
      - ./src:/app/src
      - ./configs:/app/configs
      - ./data:/app/data
      - ./logs:/app/logs
    ports:
      - "8000:8000"
      - "8081:8081"
    environment:
      NEO4J_URI: bolt://neo4j:7687
      NEO4J_USERNAME: ${NEO4J_AUTH_USERNAME:-neo4j}
      NEO4J_PASSWORD: ${NEO4J_AUTH_PASSWORD:-bioetl_secure_password}
      PYTHONUNBUFFERED: "1"
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      BIOETL_LOG_FILE: /app/logs/bioetl.log
      BIOETL_METRICS_PORT: "8000"
      BIOETL_METRICS_ADDR: 0.0.0.0
      BIOETL_OBSERVABILITY__METRICS_ENABLED: "true"
      BIOETL_OBSERVABILITY__METRICS_SERVER_ENABLED: "true"
    command: ["health", "server", "--host", "0.0.0.0", "--port", "8081"]
    networks:
      - warp-network
    healthcheck:
      test: ["CMD", "python", "-c", "import sys; sys.exit(0)"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  warp:
    build:
      context: .
      dockerfile: Dockerfile.warp
    container_name: cloudflare-warp
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    volumes:
      - warp-data:/var/lib/cloudflare-warp
      - /dev/net/tun:/dev/net/tun
    devices:
      - /dev/net/tun
    networks:
      - warp-network
    environment:
      RUST_LOG: warn

  neo4j:
    image: neo4j:${NEO4J_VERSION:-5.15-community}
    container_name: bioetl-neo4j
    command: ["neo4j", "console"]
    restart: unless-stopped
    ports:
      - "${NEO4J_HTTP_PORT:-7474}:7474"
      - "${NEO4J_BOLT_PORT:-7687}:7687"
    volumes:
      - neo4j-data:/var/lib/neo4j/data
      - neo4j-logs:/var/lib/neo4j/logs
      - neo4j-import:/var/lib/neo4j/import
    environment:
      # Memory Configuration
      # Defaults are sized for deterministic repo graph sync and live audit work.
      NEO4J_server_memory_heap_initial__size: ${NEO4J_HEAP_INITIAL:-512m}
      NEO4J_server_memory_heap_max__size: ${NEO4J_HEAP_MAX:-2g}
      NEO4J_server_memory_pagecache_size: ${NEO4J_PAGECACHE_SIZE:-1g}

      # Authentication
      NEO4J_AUTH: neo4j/bioetl_secure_password

      # Server Configuration
      NEO4J_initial_dbms_default__database: neo4j
      NEO4J_server_bolt_listen__address: 0.0.0.0:7687
      NEO4J_server_http_listen__address: 0.0.0.0:7474

      # Performance Tuning
      NEO4J_db_memory_transaction_max: ${NEO4J_TX_MAX_SIZE:-2g}
      NEO4J_dbms_memory_transaction_total_max: ${NEO4J_GLOBAL_TX_MAX:-4g}
      NEO4J_server_jvm_additional: -XX:+UseG1GC -XX:G1HeapRegionSize=16m

      # Additional Settings
      NEO4J_ACCEPT_LICENSE_AGREEMENT: "yes"
    networks:
      - warp-network
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:7474/browser/"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 40s

  pushgateway:
    image: prom/pushgateway:${PUSHGATEWAY_VERSION:-latest}
    container_name: bioetl-pushgateway
    # Use docker-compose.monitoring.yml for the supported monitoring stack.
    # This legacy profile keeps the service available for explicit opt-in only.
    profiles:
      - legacy-observability
    restart: unless-stopped
    ports:
      - "${PUSHGATEWAY_PORT:-9091}:9091"
    volumes:
      - pushgateway-data:/var/lib/pushgateway
    command:
      - "--persistence.file=/var/lib/pushgateway/metrics"
      - "--persistence.interval=15m"
    networks:
      - warp-network
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:9091/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  grafana:
    image: grafana/grafana:${GRAFANA_VERSION:-latest}
    container_name: bioetl-grafana
    # Use docker-compose.monitoring.yml for the supported monitoring stack.
    # This legacy profile keeps the service available for explicit opt-in only.
    profiles:
      - legacy-observability
    restart: unless-stopped
    ports:
      - "${GRAFANA_PORT:-3000}:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - grafana-provisioning:/etc/grafana/provisioning
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-changeme}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:-http://localhost:3000}
      GF_SESSION_COOKIE_SECURE: ${GRAFANA_COOKIE_SECURE:-false}
      GF_SESSION_COOKIE_HTTPONLY: "true"
      GF_SECURITY_COOKIE_SAMESITE: "Lax"
    networks:
      - warp-network
    depends_on:
      pushgateway:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

networks:
  warp-network:
    driver: bridge

volumes:
  warp-data:
  neo4j-data:
  neo4j-logs:
  neo4j-import:
  pushgateway-data:
  grafana-data:
  grafana-provisioning: