docker-compose.yml

services:
  postgres:
    # TimescaleDB is a PostgreSQL extension and a drop-in replacement; it powers
    # the analytics continuous aggregates (docs/adr/0001-analytics-store.md).
    image: timescale/timescaledb:2.16.1-pg16
    container_name: vortex-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: vortex
      POSTGRES_PASSWORD: vortex
      POSTGRES_DB: vortex
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U vortex -d vortex"]
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      - postgres-data:/var/lib/postgresql/data

  # ── Read replica (issue #411) ─────────────────────────────────────────────
  # Brought up with:  docker compose --profile replica up -d
  #
  # A streaming Postgres replica that mirrors the primary via WAL shipping.
  # The `primary_conninfo` env var uses the Docker network hostname "postgres"
  # to reach the primary.  DATABASE_REPLICA_URLS should be set to:
  #   postgresql://vortex:vortex@postgres-replica:5433/vortex?schema=public
  #
  # NOTE: TimescaleDB images do not ship with `pg_basebackup` or the streaming
  # replication config in the default image. This service uses stock Postgres
  # 16 for simplicity. Use the timescaledb image in production.
  postgres-replica:
    image: postgres:16-alpine
    container_name: vortex-postgres-replica
    restart: unless-stopped
    profiles: ["replica"]
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      POSTGRES_USER: vortex
      POSTGRES_PASSWORD: vortex
      POSTGRES_DB: vortex
      # Streaming replication target
      PGUSER: vortex
    ports:
      - "5433:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U vortex -d vortex"]
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      - postgres-replica-data:/var/lib/postgresql/data
    command: >
      bash -c "
        if [ ! -f /var/lib/postgresql/data/PG_VERSION ]; then
          pg_basebackup -h postgres -U vortex -D /var/lib/postgresql/data -P -R --wal-method=stream;
        fi;
        postgres
      "

  # ── MinIO (object storage for archival, issue #413) ───────────────────────
  # Brought up with:  docker compose --profile archival up -d
  # Console: http://localhost:9001  (minioadmin / minioadmin)
  # API:     http://localhost:9000
  minio:
    image: minio/minio:RELEASE.2024-09-22T00-33-43Z
    container_name: vortex-minio
    restart: unless-stopped
    profiles: ["archival"]
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    ports:
      - "9000:9000"   # S3-compatible API
      - "9001:9001"   # web console
    volumes:
      - minio-data:/data
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    container_name: vortex-redis
    restart: unless-stopped
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  app:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: vortex-backend
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment: &app-env
      NODE_ENV: development
      PORT: 4000
      DATABASE_URL: postgresql://vortex:vortex@postgres:5432/vortex?schema=public
      CORS_ORIGIN: "*"
      WS_MAX_CONNECTIONS: 1000
      # Issue #454 — `WS_BACKPLANE=redis docker compose up` fans WS events out
      # through the redis service.
      WS_BACKPLANE: ${WS_BACKPLANE:-memory}
      REDIS_URL: redis://redis:6379
      # Issue #494 — single-process default: this service serves the API and
      # runs queue workers. With the in-memory intents store the store-size
      # job must run here, next to the data it evicts.
      PROCESS_ROLE: all
      JOBS_DRIVER: bullmq
      FLAGS_PUBSUB: redis
      # Issue #414 — hot read paths (tokens, leaderboard, /stats) are cached in
      # the redis service; invalidations fan out over its pub/sub.
      CACHE_DRIVER: ${CACHE_DRIVER:-redis}
      ADMIN_API_KEYS: ${ADMIN_API_KEYS:-}
      CANARY_ADDRESSES: ${CANARY_ADDRESSES:-}
      # Issue #488 — JSON lines so the observability profile's collector can
      # parse them; set LOG_FORMAT=pretty for human-readable local output.
      LOG_FORMAT: ${LOG_FORMAT:-json}
    ports:
      - "4000:4000"
    volumes:
      - .:/app
    command: sh -c "npx prisma migrate deploy && npm run dev -- --host 0.0.0.0"

  # ── Observability profile (issue #481) ─────────────────────────────────────
  # Brought up with:  docker compose --profile observability up -d
  #
  # Grafana <http://localhost:3001> (anonymous viewing, admin/admin) serves the
  # five committed dashboards in ops/grafana/dashboards. They are provisioned
  # from disk with allowUiUpdates: false, so a panel edited in the UI is
  # reverted on the next provisioning pass - edit ops/grafana/build.mjs instead.
  prometheus:
    image: prom/prometheus:v2.54.1
    container_name: vortex-prometheus
    restart: unless-stopped
    profiles: ["observability"]
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=15d
      - --web.enable-lifecycle
    ports:
      - "9090:9090"
    volumes:
      - ./ops/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./ops/prometheus/rules:/etc/prometheus/rules:ro
      - prometheus-data:/prometheus

  grafana:
    image: grafana/grafana:11.2.0
    container_name: vortex-grafana
    restart: unless-stopped
    profiles: ["observability"]
    depends_on:
      - prometheus
      - loki
    environment:
      # Local viewing is intentionally unauthenticated. Do not copy this into a
      # shared or public deployment - see ops/grafana/README.md.
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Viewer
      GF_AUTH_DISABLE_LOGIN_FORM: "true"
      GF_AUTH_BASIC_ENABLED: "false"
      GF_USERS_DEFAULT_THEME: dark
    ports:
      - "3001:3000"
    volumes:
      - ./ops/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./ops/grafana/dashboards:/etc/grafana/provisioning/dashboards/json:ro
      - grafana-data:/var/lib/grafana

  # Log aggregation. Nothing in the service emits spans yet, so Tempo is wired
  # up but idle; the datasource is provisioned so turning tracing on later is a
  # config change rather than a dashboard rebuild.
  loki:
    image: grafana/loki:3.1.1
    container_name: vortex-loki
    restart: unless-stopped
    profiles: ["observability"]
    # -config.expand-env lets the ruler read ALERTMANAGER_URL (issue #488).
    command: -config.file=/etc/loki/loki.yml -config.expand-env=true
    volumes:
      - ./ops/observability/loki.yml:/etc/loki/loki.yml:ro
      - ./ops/observability/loki-rules:/etc/loki/rules:ro
      - loki-data:/loki

  # Issue #488 — log shipping. Tails the app's JSON stdout (LOG_FORMAT=json)
  # from the Docker log files, and accepts the winston HTTP transport on :8088.
  # Forwards logs to Loki (OTLP) and traces to Tempo. See
  # ops/otel-collector/config.yaml and docs/observability/logging.md.
  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.110.0
    container_name: vortex-otel-collector
    restart: unless-stopped
    profiles: ["observability"]
    command: ["--config=/etc/otelcol/config.yaml"]
    # Root is needed to read other containers' log files.
    user: "0:0"
    depends_on:
      - loki
      - tempo
    ports:
      - "4317:4317"   # OTLP gRPC (traces)
      - "4318:4318"   # OTLP HTTP (traces)
      - "8088:8088"   # winston HTTP transport (LOG_SHIPPING_*)
    volumes:
      - ./ops/otel-collector/config.yaml:/etc/otelcol/config.yaml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro

  tempo:
    image: grafana/tempo:2.5.0
    container_name: vortex-tempo
    restart: unless-stopped
    profiles: ["observability"]
    command: -config.file=/etc/tempo/tempo.yml
    volumes:
      - ./ops/observability/tempo.yml:/etc/tempo/tempo.yml:ro
      - tempo-data:/var/tempo

  # ── Chaos test profile ────────────────────────────────────────────────────
  # Brought up with:  docker compose --profile chaos up -d
  #
  # Toxiproxy fronts every external dependency so individual chaos scenarios
  # can inject latency, packet loss, bandwidth throttling, and TCP resets
  # without modifying the application or its configuration.
  #
  # The app-chaos service overrides dependency URLs to point at Toxiproxy
  # endpoints instead of the real services.
  #
  # Admin API:  http://localhost:8474   (add/remove toxics)
  # TCP proxies (see test/chaos/toxiproxy.json for full list):
  #   postgres   → localhost:25432
  #   redis      → localhost:26379
  #   soroban    → localhost:28080
  #   horizon    → localhost:28001
  toxiproxy:
    image: ghcr.io/shopify/toxiproxy:2.9.0
    container_name: vortex-toxiproxy
    restart: unless-stopped
    profiles: ["chaos"]
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    ports:
      - "8474:8474"   # Toxiproxy HTTP API
      - "25432:25432" # postgres proxy
      - "26379:26379" # redis proxy
      - "28080:28080" # soroban-rpc proxy
      - "28001:28001" # horizon proxy
    volumes:
      - ./test/chaos/toxiproxy.json:/etc/toxiproxy/config.json:ro
    command: ["-host=0.0.0.0", "-config=/etc/toxiproxy/config.json"]

  app-chaos:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: vortex-backend-chaos
    profiles: ["chaos"]
    depends_on:
      toxiproxy:
        condition: service_started
    environment:
      <<: *app-env
      # Override connection URLs to route through Toxiproxy
      DATABASE_URL: postgresql://vortex:vortex@toxiproxy:25432/vortex?schema=public
      REDIS_URL: redis://toxiproxy:26379
      SOROBAN_RPC_URL: http://toxiproxy:28080
      HORIZON_URL: http://toxiproxy:28001
      PORT: 4002
      # Chaos tests are allowlisted to bypass abuse detection
      ABUSE_ALLOWLIST: "GCHAOSTEST000000000000000000000000000000000000000000000000"
    ports:
      - "4002:4002"
    volumes:
      - .:/app
    command: sh -c "npx prisma migrate deploy && npm run dev -- --host 0.0.0.0"

  # Extra horizontally-scaled job worker: `docker compose --profile worker up`.
  worker:
    profiles: ["worker"]
    build:
      context: .
      dockerfile: Dockerfile
    container_name: vortex-worker
    depends_on:
      app:
        condition: service_started
      redis:
        condition: service_healthy
    environment:
      <<: *app-env
      PROCESS_ROLE: worker
      PORT: 4001
    volumes:
      - .:/app
    # Migrations are run by the app service.
    command: npm run dev

volumes:
  postgres-data:
  postgres-replica-data:
  prometheus-data:
  grafana-data:
  loki-data:
  tempo-data:
  minio-data: