docker-compose.yml

services:
  postgres:
    image: postgres:16-alpine
    env_file: .env
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s

  migrate:
    build:
      context: .
      dockerfile: migrate/Dockerfile
    env_file: .env
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable
      TEST_DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${TEST_POSTGRES_DB}?sslmode=disable
      MIGRATION_VERSION: ${MIGRATION_VERSION:-}
      POSTGRES_EXPORTER_USER: ${POSTGRES_EXPORTER_USER:-exporter}
      POSTGRES_EXPORTER_PASSWORD: ${POSTGRES_EXPORTER_PASSWORD:-exporter_secret}
    depends_on:
      postgres:
        condition: service_healthy
    restart: on-failure

  seeder:
    build:
      context: .
      dockerfile: seeder/Dockerfile
    env_file: .env
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable
    depends_on:
      migrate:
        condition: service_completed_successfully
    profiles:
      - seed

  postgres_exporter:
    image: prometheuscommunity/postgres-exporter:v0.15.0
    environment:
      DATA_SOURCE_NAME: "postgresql://${POSTGRES_EXPORTER_USER:-exporter}:${POSTGRES_EXPORTER_PASSWORD:-exporter_secret}@postgres:5432/${POSTGRES_DB}?sslmode=disable"
    depends_on:
      migrate:
        condition: service_completed_successfully
    profiles:
      - monitoring

  prometheus:
    image: prom/prometheus:v2.51.2
    volumes:
      - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    depends_on:
      - postgres_exporter
    profiles:
      - monitoring

  grafana:
    image: grafana/grafana:10.4.2
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
    ports:
      - "${GRAFANA_PORT:-3000}:3000"
    volumes:
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
    depends_on:
      - prometheus
    profiles:
      - monitoring

  minio:
    image: minio/minio:latest
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
      MINIO_PROMETHEUS_AUTH_TYPE: public
    ports:
      - "${MINIO_PORT:-9000}:9000"
      - "${MINIO_CONSOLE_PORT:-9001}:9001"
    volumes:
      - ./data/minio:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s
    profiles:
      - backup

  backup:
    build:
      context: .
      dockerfile: backup/Dockerfile
    env_file: .env
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable
      MINIO_ENDPOINT: http://minio:9000
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
      BUCKET_BACKUP_NAME: ${BUCKET_BACKUP_NAME:-pg-backups}
      BACKUP_INTERVAL: ${BACKUP_INTERVAL:-0 2 * * *}
      BACKUP_RETENTION_COUNT: ${BACKUP_RETENTION_COUNT:-7}
    depends_on:
      minio:
        condition: service_healthy
      postgres:
        condition: service_healthy
    profiles:
      - backup

  etcd:
    image: gcr.io/etcd-development/etcd:v3.5.17
    command:
      - etcd
      - --name=etcd
      - --advertise-client-urls=http://etcd:2379
      - --listen-client-urls=http://0.0.0.0:2379
      - --listen-peer-urls=http://0.0.0.0:2380
      - --initial-advertise-peer-urls=http://etcd:2380
      - --initial-cluster=etcd=http://etcd:2380
      - --initial-cluster-state=new
      - --initial-cluster-token=sessionproxy-etcd
    healthcheck:
      test: ["CMD", "etcdctl", "--endpoints=http://localhost:2379", "endpoint", "health"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 15s
    profiles:
      - ha

  patroni1:
    build:
      context: .
      dockerfile: ha/Dockerfile
    env_file: .env
    environment:
      PATRONI_NAME: patroni1
      REPLICATION_PASSWORD: ${REPLICATION_PASSWORD}
      PATRONI_SUPERUSER_PASSWORD: ${PATRONI_SUPERUSER_PASSWORD}
    volumes:
      - ./data/patroni1:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8008/health"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 30s
    depends_on:
      etcd:
        condition: service_healthy
    profiles:
      - ha

  patroni2:
    build:
      context: .
      dockerfile: ha/Dockerfile
    env_file: .env
    environment:
      PATRONI_NAME: patroni2
      REPLICATION_PASSWORD: ${REPLICATION_PASSWORD}
      PATRONI_SUPERUSER_PASSWORD: ${PATRONI_SUPERUSER_PASSWORD}
    volumes:
      - ./data/patroni2:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8008/health"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 30s
    depends_on:
      etcd:
        condition: service_healthy
      patroni1:
        condition: service_healthy
    profiles:
      - ha

  haproxy:
    image: haproxy:2.8-alpine
    volumes:
      - ./ha/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
    ports:
      - "${HA_PORT:-5433}:5432"
      - "${HA_STATS_PORT:-7000}:7000"
    depends_on:
      patroni1:
        condition: service_healthy
      patroni2:
        condition: service_healthy
    profiles:
      - ha

  migrate-ha:
    build:
      context: .
      dockerfile: migrate/Dockerfile
    env_file: .env
    environment:
      DATABASE_URL: postgres://postgres:${PATRONI_SUPERUSER_PASSWORD}@haproxy:5432/${POSTGRES_DB}?sslmode=disable
      TEST_DATABASE_URL: postgres://postgres:${PATRONI_SUPERUSER_PASSWORD}@haproxy:5432/${TEST_POSTGRES_DB}?sslmode=disable
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${PATRONI_SUPERUSER_PASSWORD}
      MIGRATION_VERSION: ${MIGRATION_VERSION:-}
      POSTGRES_EXPORTER_USER: ${POSTGRES_EXPORTER_USER:-exporter}
      POSTGRES_EXPORTER_PASSWORD: ${POSTGRES_EXPORTER_PASSWORD:-exporter_secret}
      PG_HOST: haproxy
    depends_on:
      haproxy:
        condition: service_started
    restart: on-failure
    profiles:
      - ha

  seeder-ha:
    build:
      context: .
      dockerfile: seeder/Dockerfile
    env_file: .env
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@haproxy:5432/${POSTGRES_DB}?sslmode=disable
    depends_on:
      migrate-ha:
        condition: service_completed_successfully
    profiles:
      - bi

  kafka:
    image: apache/kafka:3.7.0
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_LISTENERS: PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
      KAFKA_LOG_DIRS: /var/lib/kafka/data
    healthcheck:
      test: ["CMD-SHELL", "/opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:9092 --list > /dev/null 2>&1"]
      interval: 10s
      timeout: 10s
      retries: 15
      start_period: 30s
    profiles:
      - bi

  kafka-connect:
    image: debezium/connect:2.7.3.Final
    environment:
      BOOTSTRAP_SERVERS: kafka:9092
      GROUP_ID: "1"
      CONFIG_STORAGE_TOPIC: connect_configs
      OFFSET_STORAGE_TOPIC: connect_offsets
      STATUS_STORAGE_TOPIC: connect_statuses
      CONNECT_CONFIG_STORAGE_REPLICATION_FACTOR: "1"
      CONNECT_OFFSET_STORAGE_REPLICATION_FACTOR: "1"
      CONNECT_STATUS_STORAGE_REPLICATION_FACTOR: "1"
      CONNECT_KEY_CONVERTER: org.apache.kafka.connect.json.JsonConverter
      CONNECT_VALUE_CONVERTER: org.apache.kafka.connect.json.JsonConverter
      CONNECT_KEY_CONVERTER_SCHEMAS_ENABLE: "false"
      CONNECT_VALUE_CONVERTER_SCHEMAS_ENABLE: "false"
    ports:
      - "8083:8083"
    depends_on:
      kafka:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8083/connectors > /dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 60s
    profiles:
      - bi

  clickhouse:
    image: clickhouse/clickhouse-server:24.3-alpine
    volumes:
      - ./clickhouse/config.xml:/etc/clickhouse-server/config.d/custom.xml:ro
      - ./clickhouse/users.xml:/etc/clickhouse-server/users.d/allow-remote.xml:ro
      - ./clickhouse/init:/docker-entrypoint-initdb.d:ro
    ports:
      - "8123:8123"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8123/ping | grep -q Ok"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 15s
    profiles:
      - bi

  metabase-db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: metabase
      POSTGRES_USER: metabase
      POSTGRES_PASSWORD: ${METABASE_DB_PASSWORD:-metabase_db_secret}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U metabase -d metabase"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s
    profiles:
      - bi

  metabase-plugin-init:
    image: curlimages/curl:8.7.1
    entrypoint:
      - /bin/sh
      - -c
      - "curl -fsSL --retry 3 -o /plugins/clickhouse.metabase-driver.jar https://github.com/ClickHouse/metabase-clickhouse-driver/releases/download/1.50.7/clickhouse.metabase-driver.jar && echo 'ClickHouse driver downloaded'"
    volumes:
      - metabase-plugins:/plugins
    profiles:
      - bi

  metabase:
    image: metabase/metabase:v0.50.14
    environment:
      MB_DB_TYPE: postgres
      MB_DB_HOST: metabase-db
      MB_DB_PORT: 5432
      MB_DB_DBNAME: metabase
      MB_DB_USER: metabase
      MB_DB_PASS: ${METABASE_DB_PASSWORD:-metabase_db_secret}
      MB_PLUGINS_DIR: /plugins
    volumes:
      - metabase-plugins:/plugins
    ports:
      - "${METABASE_PORT:-3030}:3000"
    depends_on:
      metabase-db:
        condition: service_healthy
      metabase-plugin-init:
        condition: service_completed_successfully
      clickhouse:
        condition: service_healthy
    profiles:
      - bi

  redis:
    image: redis:7-alpine
    command: ["redis-server", "--save", "", "--appendonly", "no"]
    ports:
      - "${REDIS_PORT:-6379}:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 5s
    profiles:
      - app

  # Stub target site used to prove the proxy actually injects the owner's
  # credentials and strips them from the response - see app/test and the
  # manual curl walkthrough in README.md section 7.
  echo-target:
    image: mendhak/http-https-echo:31
    environment:
      HTTP_PORT: 8080
    ports:
      - "${ECHO_TARGET_PORT:-8888}:8080"
    profiles:
      - app

  app:
    build:
      context: ./app
      dockerfile: Dockerfile
    env_file: .env
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@haproxy:5432/${POSTGRES_DB}?sslmode=disable
      REDIS_URL: redis://redis:6379/0
      HTTP_PORT: ${HTTP_PORT:-8080}
      GRPC_PORT: ${GRPC_PORT:-9090}
      DEBUG_PORT: ${DEBUG_PORT:-6060}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
      JWT_SECRET: ${JWT_SECRET}
    ports:
      - "${HTTP_PORT:-8080}:8080"
      - "${GRPC_PORT:-9090}:9090"
      - "${DEBUG_PORT:-6060}:6060"
    depends_on:
      haproxy:
        condition: service_started
      redis:
        condition: service_healthy
    profiles:
      - app

volumes:
  metabase-plugins: