docker-compose.yml

# ============================================================
# ArxMint — Full Stack Docker Compose
# Fedimint Federation v0.10.0 + Cashu Mint + LND + Aperture L402
# Network: testnet (change to mainnet for production)
# ============================================================
# Usage:
#   docker compose up -d
#   docker compose logs -f
#   docker compose down
# ============================================================

services:

  # === Bitcoin + Lightning Node ===
  lnd:
    image: lightninglabs/lnd:v0.18.0-beta
    container_name: sf-lnd
    restart: unless-stopped
    command: >
      lnd
      --bitcoin.active
      --bitcoin.testnet
      --bitcoin.node=neutrino
      --neutrino.addpeer=faucet.lightning.community
      --neutrino.addpeer=lnd.bitrefill.com
      --rpclisten=0.0.0.0:10009
      --restlisten=0.0.0.0:8080
      --tlsextradomain=lnd
      --accept-keysend
      --protocol.wumbo-channels
      --db.backend=sqlite
      # NOTE: Run 'docker exec sf-lnd lncli create' after first start to create wallet + save seed phrase
    ports:
      - "9735:9735"     # P2P — must be public for Lightning routing
      # gRPC (10009) and REST (8080) are internal only — access via docker exec or SSH tunnel
      # Caddy handles HTTPS termination; LND internal APIs stay on the sovereign network
    volumes:
      - lnd-data:/root/.lnd
    networks:
      - sovereign
    healthcheck:
      test: ["CMD", "lncli", "--network=testnet", "getinfo"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  # === Cashu Mint (Lightweight ecash) ===
  cashu-mint:
    image: cashubtc/nutshell:latest
    container_name: sf-cashu
    restart: unless-stopped
    environment:
      - MINT_BACKEND_BOLT11_SAT=LndRestWallet
      - MINT_LND_REST_ENDPOINT=https://lnd:8080
      - MINT_LND_REST_CERT=/root/.lnd/tls.cert
      - MINT_LND_REST_MACAROON=/root/.lnd/data/chain/bitcoin/testnet/admin.macaroon
      - MINT_LISTEN_HOST=0.0.0.0
      - MINT_LISTEN_PORT=3338
      - "MINT_PRIVATE_KEY=${CASHU_PRIVATE_KEY:?CASHU_PRIVATE_KEY is required — generate with: openssl rand -hex 32}"
    ports:
      - "3338:3338"
    volumes:
      - lnd-data:/root/.lnd:ro
      - cashu-data:/app/data
    depends_on:
      lnd:
        condition: service_healthy
    networks:
      - sovereign

  # === Fedimint Guardian 1 (Primary) — v0.10.0 Lighthouse ===
  fedimintd-0:
    image: fedimint/fedimintd:v0.10.0
    container_name: sf-guardian-0
    restart: unless-stopped
    environment:
      - FM_BIND_P2P=0.0.0.0:18173
      - FM_BIND_API=0.0.0.0:18174
      - FM_P2P_URL=fedimintd-0:18173
      - FM_API_URL=ws://fedimintd-0:18174
      - FM_BITCOIN_RPC_KIND=none
      # v0.10.0 ConnectorRegistry — Iroh networking
      - FM_TRANSPORT=iroh
      - FM_IROH_DISCOVERY=dns
    ports:
      - "18173:18173"
      - "18174:18174"
    volumes:
      - guardian-0-data:/data
    networks:
      - sovereign

  # === Fedimint Guardian 2 — v0.10.0 Lighthouse ===
  fedimintd-1:
    image: fedimint/fedimintd:v0.10.0
    container_name: sf-guardian-1
    restart: unless-stopped
    environment:
      - FM_BIND_P2P=0.0.0.0:18175
      - FM_BIND_API=0.0.0.0:18176
      - FM_P2P_URL=fedimintd-1:18175
      - FM_API_URL=ws://fedimintd-1:18176
      - FM_BITCOIN_RPC_KIND=none
      # v0.10.0 ConnectorRegistry — Iroh networking
      - FM_TRANSPORT=iroh
      - FM_IROH_DISCOVERY=dns
    ports:
      - "18175:18175"
      - "18176:18176"
    volumes:
      - guardian-1-data:/data
    networks:
      - sovereign

  # === Fedimint Guardian 3 — v0.10.0 Lighthouse ===
  fedimintd-2:
    image: fedimint/fedimintd:v0.10.0
    container_name: sf-guardian-2
    restart: unless-stopped
    environment:
      - FM_BIND_P2P=0.0.0.0:18177
      - FM_BIND_API=0.0.0.0:18178
      - FM_P2P_URL=fedimintd-2:18177
      - FM_API_URL=ws://fedimintd-2:18178
      - FM_BITCOIN_RPC_KIND=none
      # v0.10.0 ConnectorRegistry — Iroh networking
      - FM_TRANSPORT=iroh
      - FM_IROH_DISCOVERY=dns
    ports:
      - "18177:18177"
      - "18178:18178"
    volumes:
      - guardian-2-data:/data
    networks:
      - sovereign

  # === Monitoring: Prometheus ===
  prometheus:
    image: prom/prometheus:v2.51.0
    container_name: sf-prometheus
    restart: unless-stopped
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.retention.time=30d"
    ports:
      - "9090:9090"
    volumes:
      - prometheus-data:/prometheus
      - ./docker/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./docker/prometheus-alerts.yml:/etc/prometheus/prometheus-alerts.yml:ro
    networks:
      - sovereign

  # === Monitoring: Grafana ===
  grafana:
    image: grafana/grafana:11.0.0
    container_name: sf-grafana
    restart: unless-stopped
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:?GRAFANA_PASSWORD is required — set a strong password}
      - GF_USERS_ALLOW_SIGN_UP=false
    ports:
      - "3001:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./docker/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./docker/grafana/datasources:/etc/grafana/provisioning/datasources:ro
      - ./docker/grafana/provisioning/alerting:/etc/grafana/provisioning/alerting:ro
    depends_on:
      - prometheus
    networks:
      - sovereign

  # === PostgreSQL Database ===
  postgres:
    image: postgres:15-alpine
    container_name: sf-postgres
    restart: unless-stopped
    command:
      - postgres
      - -c
      - wal_level=replica
      - -c
      - archive_mode=on
      - -c
      - archive_timeout=60s
      - -c
      - archive_command=test ! -f /var/lib/postgresql/wal-archive/%f && cp %p /var/lib/postgresql/wal-archive/%f
      - -c
      - max_wal_senders=5
      - -c
      - wal_keep_size=512MB
    environment:
      POSTGRES_DB: arxmint
      POSTGRES_USER: arxmint
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required — set a strong password}
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - postgres-wal-archive:/var/lib/postgresql/wal-archive
    networks:
      - sovereign  # internal only — no ports exposed to host
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U arxmint"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  # === Aperture L402 Reverse Proxy ===
  aperture:
    image: lightninglabs/aperture:v0.4.2
    container_name: sf-aperture
    restart: unless-stopped
    ports:
      - "8081:8081"
    volumes:
      - ./docker/aperture.yml:/config/aperture.yml:ro
      - lnd-data:/root/.lnd:ro
    command: ["--configfile=/config/aperture.yml"]
    depends_on:
      lnd:
        condition: service_healthy
    networks:
      - sovereign

  # === ArxMint Web App ===
  web:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: sf-web
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - CASHU_MINT_URL=http://cashu-mint:3338
      - APERTURE_URL=http://aperture:8081
      - BITCOIN_NETWORK=testnet
      - DATABASE_URL=postgresql://arxmint:${POSTGRES_PASSWORD}@postgres:5432/arxmint
      - NODE_ENV=production
    depends_on:
      cashu-mint:
        condition: service_started
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:3000/api/health | grep -q '\"status\"' || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    networks:
      - sovereign

  # === Caddy Reverse Proxy (HTTPS termination) ===
  caddy:
    image: caddy:2-alpine
    container_name: sf-caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"  # HTTP/3 (QUIC)
    volumes:
      - ./docker/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    networks:
      - sovereign
    depends_on:
      - web

volumes:
  lnd-data:
  cashu-data:
  guardian-0-data:
  guardian-1-data:
  guardian-2-data:
  prometheus-data:
  grafana-data:
  postgres-data:
  postgres-wal-archive:
  caddy-data:
  caddy-config:

networks:
  sovereign:
    driver: bridge