docker-compose.yml

services:
  traefik:
    image: traefik:v3.3
    restart: unless-stopped
    command:
      - --configfile=/etc/traefik/traefik.yml
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - ./api-gateway/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./api-gateway/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro

  rabbitmq:
    image: rabbitmq:3-management
    restart: unless-stopped
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-guest}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-guest}
    ports:
      - "5672:5672"
      - "15672:15672"
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq

  # ── Auth DB — dedicated, isolated ────────────────────────────────────────────
  # auth-service is the only consumer of this database.
  postgres-auth:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_DB: auth_db
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
    volumes:
      - ./data/pg-auth:/var/lib/postgresql/data
    ports:
      - "5433:5432"

  # ── Shared DB — one Postgres, multiple databases ──────────────────────────────
  # Used by all non-auth services (orders, inventory, reporting, sensor).
  # Each service connects to its own database within this instance.
  postgres:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      # POSTGRES_DB is not set — each service creates its own DB on first connect.
      # See: services/<name>/app/database.py → CREATE DATABASE IF NOT EXISTS
      POSTGRES_MULTIPLE_DATABASES: "orders_db,inventory_db,reporting_db,events_db"
    volumes:
      - ./data/pg-shared:/var/lib/postgresql/data
      - ./infrastructure/postgres/init-multiple-dbs.sh:/docker-entrypoint-initdb.d/init-multiple-dbs.sh:ro
    ports:
      - "5434:5432"

  # ── Services ──────────────────────────────────────────────────────────────────

  auth-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/auth-service/Dockerfile
    environment:
      APP_NAME: auth-service
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres-auth:5432/auth_db
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-at-least-256-bits-long}
      JWT_EXPIRE_HOURS: ${JWT_EXPIRE_HOURS:-8}
      BOOTSTRAP_ADMIN_USERNAME: ${BOOTSTRAP_ADMIN_USERNAME:-admin}
      BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD:-}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - postgres-auth

  orders-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/orders-service/Dockerfile
    environment:
      APP_NAME: orders-service
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/orders_db
    depends_on:
      - postgres

  inventory-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/inventory-service/Dockerfile
    environment:
      APP_NAME: inventory-service
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/inventory_db
    depends_on:
      - postgres

  reporting-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/reporting-service/Dockerfile
    environment:
      APP_NAME: reporting-service
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/reporting_db
    depends_on:
      - postgres
      - rabbitmq

  sensor-ingest-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/sensor-ingest-service/Dockerfile
    environment:
      APP_NAME: sensor-ingest-service
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/events_db
      RABBITMQ_URL: amqp://${RABBITMQ_DEFAULT_USER:-guest}:${RABBITMQ_DEFAULT_PASS:-guest}@rabbitmq:5672/
    depends_on:
      - rabbitmq
      - postgres

  sap-b1-adapter-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/sap-b1-adapter-service/Dockerfile
    environment:
      APP_NAME: sap-b1-adapter-service
      B1_BASE_URL: ${SAP_B1_SERVICE_LAYER_URL:-https://172.22.248.4:50000/b1s}
      B1_COMPANY_DB: ${SAP_B1_COMPANY_DB:-BRD_PS_20250407}
      B1_USER: ${SAP_B1_USERNAME:-termelesig}
      B1_PASSWORD: ${SAP_B1_PASSWORD:-}
      VPN_BYPASS: ${VPN_BYPASS:-false}
      VPN_CONFIG: /etc/vpn/brd.conf
      VPN_TARGET_HOST: 172.22.248.4
      VPN_TARGET_PORT: "50000"
      VPN_CONNECT_TIMEOUT: "30"
      VPN_IDLE_TTL: "300"
      DST_SERVER: ${DST_SQL_SERVER:-mssql_server,1433}
      DST_DB: ${DST_SQL_DB:-ReportingDB}
      DST_USER: ${DST_SQL_USER:-sa}
      DST_PASSWORD: ${DST_SQL_PASSWORD:-}
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-at-least-256-bits-long}
      API_KEYS_JSON: ${SAP_API_KEYS_JSON:-{}}
    cap_add:
      - NET_ADMIN
    # devices:
    #   - /dev/net/tun      # uncomment after PVE tun=1 is enabled (see OVPN_Guide.md §12 note)
    volumes:
      - ./vpn:/etc/vpn:ro
    networks:
      - default
      - db_net

  # ── Files DB — metadata for file-service; accessible to any service via postgres-files:5432 ──
  postgres-files:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_DB: files_db
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
    volumes:
      - ./data/pg-files:/var/lib/postgresql/data
    ports:
      - "5436:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d files_db"]
      interval: 5s
      timeout: 5s
      retries: 10

  file-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/file-service/Dockerfile
    environment:
      APP_NAME: file-service
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres-files:5432/files_db
      STORAGE_DIR: /app/storage
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-at-least-256-bits-long}
    volumes:
      - ./files:/app/storage
    depends_on:
      postgres-files:
        condition: service_healthy

  postgres-maps:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_DB: maps_db
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
    volumes:
      - ./data/pg-maps:/var/lib/postgresql/data
    ports:
      - "5435:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d maps_db"]
      interval: 5s
      timeout: 5s
      retries: 10

  maps-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/maps-service/Dockerfile
    environment:
      APP_NAME: maps-service
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres-maps:5432/maps_db
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-at-least-256-bits-long}
    depends_on:
      postgres-maps:
        condition: service_healthy

  # ── InfluxDB — timeseries storage for OPC-UA data ────────────────────────────
  influxdb:
    image: influxdb:2.7
    restart: unless-stopped
    ports:
      - "8086:8086"
    environment:
      DOCKER_INFLUXDB_INIT_MODE: setup
      DOCKER_INFLUXDB_INIT_USERNAME: ${INFLUXDB_USER:-admin}
      DOCKER_INFLUXDB_INIT_PASSWORD: ${INFLUXDB_PASSWORD:-adminpassword}
      DOCKER_INFLUXDB_INIT_ORG: ${INFLUXDB_ORG:-compani}
      DOCKER_INFLUXDB_INIT_BUCKET: ${INFLUXDB_BUCKET:-opcua}
      DOCKER_INFLUXDB_INIT_ADMIN_TOKEN: ${INFLUXDB_TOKEN:-my-super-secret-token}
      # Store CLI config inside the data volume so it's wiped together with the db
      INFLUX_CONFIGS_PATH: /var/lib/influxdb2/influx.configs
    volumes:
      - ./data/influxdb:/var/lib/influxdb2

  # ── OPC-UA Simulator — dev/test stand-in for a real S7-1500 PLC ──────────────
  # Start with: docker compose --profile sim up -d opcua-simulator
  # Set OPCUA_ENDPOINT=opc.tcp://opcua-simulator:4840 in .env to use it.
  opcua-simulator:
    build:
      context: services/opcua-simulator
      dockerfile: Dockerfile
    environment:
      SIM_ENDPOINT: opc.tcp://0.0.0.0:4840
      SIM_INTERVAL_MS: ${SIM_INTERVAL_MS:-500}
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres-opcua:5432/opcua_db
    depends_on:
      - postgres-opcua
    profiles: ["sim"]

  postgres-opcua:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_DB: opcua_db
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
    volumes:
      - postgres_opcua_data:/var/lib/postgresql/data
    ports:
      - "5438:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5

  opcua-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/opcua-service/Dockerfile
    environment:
      APP_NAME: opcua-service
      OPCUA_ENDPOINT: ${OPCUA_ENDPOINT:-opc.tcp://192.168.0.1:4840}
      OPCUA_USERNAME: ${OPCUA_USERNAME:-}
      OPCUA_PASSWORD: ${OPCUA_PASSWORD:-}
      OPCUA_SECURITY_MODE: ${OPCUA_SECURITY_MODE:-None}
      POLL_INTERVAL_MS: ${OPCUA_POLL_INTERVAL_MS:-500}
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-at-least-256-bits-long}
      INFLUXDB_URL: ${INFLUXDB_URL:-http://influxdb:8086}
      INFLUXDB_TOKEN: ${INFLUXDB_TOKEN:-my-super-secret-token}
      INFLUXDB_ORG: ${INFLUXDB_ORG:-compani}
      INFLUXDB_BUCKET: ${INFLUXDB_BUCKET:-opcua}
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres-opcua:5432/opcua_db
    depends_on:
      - influxdb
      - postgres-opcua

  binpack-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/binpack-service/Dockerfile
    environment:
      APP_NAME: binpack-service

  postgres-labeling:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_DB: labeling_db
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
    volumes:
      - ./data/pg-labeling:/var/lib/postgresql/data
    ports:
      - "5437:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d labeling_db"]
      interval: 5s
      timeout: 5s
      retries: 10

  labeling-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/labeling-service/Dockerfile
    environment:
      APP_NAME: labeling-service
      PRINTER_IP: ${PRINTER_IP:-192.168.1.100}
      PRINTER_PORT: ${PRINTER_PORT:-9100}
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres-labeling:5432/labeling_db
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-at-least-256-bits-long}
    depends_on:
      postgres-labeling:
        condition: service_healthy

  # ── Portainer — Docker GUI ────────────────────────────────────────────────

  portainer:
    image: portainer/portainer-ce:latest
    ports:
      - "9000:9000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    restart: unless-stopped

  # ── Monitoring ────────────────────────────────────────────────────────────────

  prometheus:
    image: prom/prometheus:latest
    restart: unless-stopped
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./data/prometheus:/prometheus

  loki:
    image: grafana/loki:3.0.0
    restart: unless-stopped
    ports:
      - "3100:3100"
    command: -config.file=/etc/loki/local-config.yaml
    volumes:
      - ./data/loki:/loki

  promtail:
    image: grafana/promtail:3.0.0
    restart: unless-stopped
    volumes:
      - ./monitoring/promtail/promtail-config.yml:/etc/promtail/config.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
    command: -config.file=/etc/promtail/config.yml
    depends_on:
      - loki

  grafana:
    image: grafana/grafana:latest
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
    volumes:
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./data/grafana:/var/lib/grafana
    depends_on:
      - prometheus
      - loki
      - influxdb

  # ── Frontend SPAs ─────────────────────────────────────────────────────────────

  admin-ui:
    build:
      context: frontend/admin-ui
      dockerfile: Dockerfile
    ports:
      - "5176:80"
    restart: unless-stopped

  sap-sync-ui:
    build:
      context: frontend/sap-sync-ui
      dockerfile: Dockerfile
    ports:
      - "5173:80"
    restart: unless-stopped

  sap-map-ui:
    build:
      context: frontend/sap-map-ui
      dockerfile: Dockerfile
    ports:
      - "5174:80"
    restart: unless-stopped

  binpack-ui:
    build:
      context: frontend/binpack-ui
      dockerfile: Dockerfile
    ports:
      - "5175:80"
    restart: unless-stopped

  live-labeling-ui:
    build:
      context: frontend/live-labeling-ui
      dockerfile: Dockerfile
    ports:
      - "5178:80"
    restart: unless-stopped

  s7-status-ui:
    build:
      context: frontend/s7-status-ui
      dockerfile: Dockerfile
    ports:
      - "5179:80"
    restart: unless-stopped

  # ── LOTGEN — Sarzs / LOT generáló és nyomtató ────────────────────────────────

  postgres-lot:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_DB: lot_db
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
    volumes:
      - ./data/pg-lot:/var/lib/postgresql/data
    ports:
      - "5440:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d lot_db"]
      interval: 5s
      timeout: 5s
      retries: 10

  lotgen-service:
    restart: unless-stopped
    build:
      context: .
      dockerfile: services/lotgen-service/Dockerfile
    environment:
      APP_NAME: lotgen-service
      POSTGRES_URL: postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres-lot:5432/lot_db
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-at-least-256-bits-long}
      LABELING_URL: http://labeling-service:8000
    depends_on:
      postgres-lot:
        condition: service_healthy

  lotgen-ui:
    build:
      context: frontend/lotgen-ui
      dockerfile: Dockerfile
    ports:
      - "5177:80"
    restart: unless-stopped

volumes:
  postgres_opcua_data:
  rabbitmq_data:
  portainer_data:

networks:
  # db_net is owned by the infrastructure stack (infrastructure/mssql/docker-compose.yml).
  # Start that stack first: make infra-up
  db_net:
    external: true
    name: db_net