docker-compose.yml

version: '3.8'

services:
  # PostgreSQL Database (bundled by default)
  postgres:
    image: postgres:16-alpine
    container_name: gough-postgres
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-gough}
      POSTGRES_USER: ${POSTGRES_USER:-gough}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-gough}
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
    expose:
      - "5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-gough} -d ${POSTGRES_DB:-gough}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - app-network

  # MinIO S3 Storage (optional - profile: local-storage)
  # For production, configure external storage via API/WebUI
  # Start with: docker compose --profile local-storage up
  minio:
    image: minio/minio:latest
    container_name: gough-minio
    profiles: ["local-storage"]
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
    command: server /data --console-address ":9001"
    volumes:
      - minio_data:/data
    expose:
      - "9000"
      - "9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - app-network

  # API Manager (Quart backend - renamed from flask-backend)
  api-manager:
    build:
      context: ./services/api-manager
      dockerfile: Dockerfile
      additional_contexts:
        penguin-libs: ../penguin-libs
    container_name: gough-api-manager
    environment:
      # Database configuration
      - DB_TYPE=${DB_TYPE:-postgres}
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_NAME=${POSTGRES_DB:-gough}
      - DB_USER=${POSTGRES_USER:-gough}
      - DB_PASS=${POSTGRES_PASSWORD:-gough}
      # Storage configuration (optional - can be configured via API/WebUI)
      - STORAGE_ENDPOINT=${STORAGE_ENDPOINT:-}
      - STORAGE_ACCESS_KEY=${STORAGE_ACCESS_KEY:-}
      - STORAGE_SECRET_KEY=${STORAGE_SECRET_KEY:-}
      - STORAGE_BUCKET_BOOT_IMAGES=${STORAGE_BUCKET_BOOT_IMAGES:-gough-boot-images}
      - STORAGE_BUCKET_EGGS=${STORAGE_BUCKET_EGGS:-gough-eggs}
      - STORAGE_BUCKET_LXD=${STORAGE_BUCKET_LXD:-gough-lxd-images}
      # Security
      - SECRET_KEY=${SECRET_KEY:-change-me-in-production}
      - SECURITY_PASSWORD_SALT=${SECURITY_PASSWORD_SALT:-change-me-salt}
      - JWT_SECRET_KEY=${JWT_SECRET_KEY:-change-me-jwt-secret}
      - WORKER_API_KEY=${WORKER_API_KEY:-worker-secret}
      # Admin user
      - ADMIN_EMAIL=${ADMIN_EMAIL:-admin@gough.local}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-changeme123}
      # Elder integration
      - ELDER_URL=${ELDER_URL:-}
      - ELDER_API_KEY=${ELDER_API_KEY:-}
      - ELDER_SYNC_ENABLED=${ELDER_SYNC_ENABLED:-false}
      # Secrets management
      - SECRETS_BACKEND=${SECRETS_BACKEND:-encrypted_db}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}
      - VAULT_ADDR=${VAULT_ADDR:-http://vault:8200}
      - VAULT_TOKEN=${VAULT_TOKEN:-}
      # Audit and rate limiting
      - AUDIT_ENABLED=${AUDIT_ENABLED:-true}
      - AUDIT_RECORDING_ENABLED=${AUDIT_RECORDING_ENABLED:-true}
      - AUDIT_RECORDING_PATH=/var/gough/recordings
      - RATE_LIMIT_ENABLED=${RATE_LIMIT_ENABLED:-true}
      # MariaDB Galera (optional)
      - DB_GALERA_ENABLED=${DB_GALERA_ENABLED:-false}
      - DB_GALERA_WSREP_SYNC_WAIT=${DB_GALERA_WSREP_SYNC_WAIT:-1}
    ports:
      - "${API_PORT:-5001}:5000"
    volumes:
      - audit_recordings:/var/gough/recordings
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/api/v1/status"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - app-network

  # iPXE Worker (DHCP/TFTP/HTTP boot services)
  worker-ipxe:
    build:
      context: ./services/worker-ipxe
      dockerfile: Dockerfile
      additional_contexts:
        penguin-libs: ../penguin-libs
    container_name: gough-worker-ipxe
    environment:
      # API Manager connection
      - API_MANAGER_URL=http://api-manager:5000
      - WORKER_API_KEY=${WORKER_API_KEY:-worker-secret}
      # DHCP configuration
      - DHCP_MODE=${DHCP_MODE:-proxy}
      - DHCP_INTERFACE=${DHCP_INTERFACE:-eth0}
      - DHCP_SUBNET=${DHCP_SUBNET:-192.168.1.0/24}
      - DHCP_RANGE_START=${DHCP_RANGE_START:-192.168.1.100}
      - DHCP_RANGE_END=${DHCP_RANGE_END:-192.168.1.200}
      - DHCP_GATEWAY=${DHCP_GATEWAY:-192.168.1.1}
      - DNS_SERVERS=${DNS_SERVERS:-8.8.8.8,8.8.4.4}
      # Boot services
      - TFTP_ENABLED=${TFTP_ENABLED:-true}
      - HTTP_BOOT_URL=${HTTP_BOOT_URL:-http://192.168.1.10:8080}
      - HTTP_PORT=${HTTP_PORT:-8080}
      - TFTP_PORT=${TFTP_PORT:-69}
      # Storage (for fetching boot images)
      - STORAGE_ENDPOINT=${STORAGE_ENDPOINT:-minio:9000}
      - STORAGE_ACCESS_KEY=${STORAGE_ACCESS_KEY:-${MINIO_ROOT_USER:-minioadmin}}
      - STORAGE_SECRET_KEY=${STORAGE_SECRET_KEY:-${MINIO_ROOT_PASSWORD:-minioadmin}}
      # Logging
      - LOG_LEVEL=${WORKER_LOG_LEVEL:-info}
    depends_on:
      api-manager:
        condition: service_healthy
    cap_add:
      - NET_ADMIN
      - NET_RAW
    network_mode: host
    volumes:
      - ipxe_tftp:/var/lib/ipxe/tftp
    restart: unless-stopped

  # WebUI (React frontend)
  webui:
    build:
      context: ./services/webui
      dockerfile: Dockerfile
      additional_contexts:
        penguin-libs: ../penguin-libs
    container_name: gough-webui
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - PORT=3000
      - API_URL=http://api-manager:5000
      - VITE_API_URL=${VITE_API_URL:-http://localhost:5000}
    ports:
      - "${WEBUI_PORT:-3000}:3000"
    depends_on:
      api-manager:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped
    networks:
      - app-network

  # Prometheus Monitoring
  prometheus:
    image: prom/prometheus:latest
    container_name: gough-prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=200h'
      - '--web.enable-lifecycle'
    expose:
      - "9090"
    volumes:
      - ./infrastructure/monitoring/prometheus:/etc/prometheus
      - prometheus_data:/prometheus
    networks:
      - app-network
    restart: unless-stopped
    profiles:
      - monitoring

  # Grafana Dashboard
  grafana:
    image: grafana/grafana:latest
    container_name: gough-grafana
    environment:
      - GF_SECURITY_ADMIN_USER=${GRAFANA_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}
      - GF_USERS_ALLOW_SIGN_UP=false
    expose:
      - "3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./infrastructure/monitoring/grafana/provisioning:/etc/grafana/provisioning
      - ./infrastructure/monitoring/grafana/dashboards:/var/lib/grafana/dashboards
    depends_on:
      - prometheus
    networks:
      - app-network
    restart: unless-stopped
    profiles:
      - monitoring

  # Nginx Reverse Proxy (optional - for production)
  nginx:
    image: nginx:alpine
    container_name: gough-nginx
    ports:
      - "${NGINX_HTTP_PORT:-80}:80"
      - "${NGINX_HTTPS_PORT:-443}:443"
    volumes:
      - ./infrastructure/docker/nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./infrastructure/docker/nginx/conf.d:/etc/nginx/conf.d
      - ./infrastructure/docker/nginx/ssl:/etc/nginx/ssl
      - nginx_logs:/var/log/nginx
    depends_on:
      - api-manager
      - webui
    networks:
      - app-network
    restart: unless-stopped
    profiles:
      - production

volumes:
  postgres_data:
    driver: local
  minio_data:
    driver: local
  ipxe_tftp:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  nginx_logs:
    driver: local
  audit_recordings:
    driver: local

networks:
  app-network:
    driver: bridge