docker-compose.yml

services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: appdb
      POSTGRES_USER: app
      POSTGRES_PASSWORD: app
    volumes:
      - dbdata:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app -d appdb"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks:
      - devnet
    restart: unless-stopped

  api:
    build:
      context: ./backend
      target: runtime
    environment:
      - DATABASE_URL=postgresql+asyncpg://app:app@db:5432/appdb
      - ALEMBIC_DATABASE_URL=postgresql+psycopg://app:app@db:5432/appdb
      - ENVIRONMENT=${ENVIRONMENT:-development}
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "8000:8000"
    labels:
      - "environment=${ENVIRONMENT:-development}"
    networks:
      - devnet
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    # Development command (default)
    command: >
      sh -c "python -m alembic -c /app/alembic.ini upgrade head &&
             uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload"
    deploy:
      resources:
        limits: {}
        #  cpus: 1
        #  memory: 1G
        reservations: {}
        #  cpus: 2
        #  memory: 2G

  prometheus:
    image: prom/prometheus:v3.11.2
    volumes:
      - ./observability/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./observability/prometheus_slo_rules.yml:/etc/prometheus/prometheus_slo_rules.yml:ro
    ports:
      - "9090:9090"
    networks:
      - devnet
    restart: unless-stopped

  postgres_exporter:
    image: prometheuscommunity/postgres-exporter:v0.19.1
    environment:
      DATA_SOURCE_NAME: postgresql://app:app@db:5432/appdb?sslmode=disable
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "9187:9187"
    networks:
      - devnet
    restart: unless-stopped

  grafana:
    image: grafana/grafana:13.0.1
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: admin
      GF_SECURITY_DISABLE_INITIAL_ADMIN_PASSWORD_CHANGE: "true"
      GF_SECURITY_DISABLE_GRAVATAR: "true"
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_INSTALL_PLUGINS: ""
    volumes:
      - ./observability/grafana/provisioning:/etc/grafana/provisioning
      - ./observability/grafana/dashboards:/etc/grafana/dashboards
      - ./observability/grafana/grafana.ini:/etc/grafana/grafana.ini:ro
      - grafana-data:/var/lib/grafana
    ports:
      - "3000:3000"
    depends_on:
      prometheus:
        condition: service_started
    networks:
      - devnet
    restart: unless-stopped

  loki:
    image: grafana/loki:3.7.1
    command: -config.file=/etc/loki/config.yml -target=all
    volumes:
      - ./observability/loki/config.yml:/etc/loki/config.yml:ro
      - loki-data:/loki
    ports:
      - "3100:3100"
    networks:
      - devnet
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3100/ready || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  # Promtail is deprecated (EOL March 2026), migrated to Grafana Alloy
  # See: https://grafana.com/docs/alloy/latest/set-up/migrate/from-promtail/
  alloy:
    image: grafana/alloy:v1.15.1
    command: run --server.http.listen-addr=0.0.0.0:9080 --storage.path=/var/lib/alloy/data /etc/alloy/config.alloy
    volumes:
      - ./observability/alloy/config.alloy:/etc/alloy/config.alloy:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - alloy-data:/var/lib/alloy/data
    depends_on:
      loki:
        condition: service_healthy
    networks:
      - devnet
    restart: unless-stopped
    healthcheck:
      # Check both readiness and metrics for write errors
      # This ensures Alloy fails fast if it cannot write to Loki
      # The healthcheck monitors Alloy metrics and marks the container as unhealthy
      # if there are write errors, making failures visible
      # With restart: no, the container will remain stopped/unhealthy, making the failure visible
      test: >
        wget --no-verbose --tries=1 --spider http://localhost:9080/-/ready > /dev/null 2>&1 &&
        (wget --no-verbose --tries=1 -O- http://localhost:9080/metrics 2>/dev/null | grep -q 'loki_write_dropped_lines_total 0' || exit 1) ||
        exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.55.1
    privileged: true
    devices:
      - /dev/kmsg:/dev/kmsg
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    ports:
      - "8081:8080"
    networks:
      - devnet
    restart: unless-stopped

  web:
    build:
      context: ./frontend
      target: runtime
    ports:
      - "8080:80"
    depends_on:
      api:
        condition: service_started
    networks:
      - devnet
    restart: unless-stopped

volumes:
  dbdata: {}
  loki-data: {}
  alloy-data: {}
  grafana-data: {}

networks:
  devnet: {}