services:
  postgres:
    image: postgres:16
    environment:
      POSTGRES_DB: vigilcare
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: password
    ports:
      - "5436:5432"
    volumes:
      - pg_data:/var/lib/postgresql/data
    networks:
      - vigilcare_net

  redis:
    image: redis:7-alpine
    ports:
      - "6382:6379"
    networks:
      - vigilcare_net

  seq:
    image: datalust/seq:latest
    environment:
      ACCEPT_EULA: "Y"
      SEQ_FIRSTRUN_ADMINPASSWORD: "admin"
    ports:
      - "5345:80"
    volumes:
      - seq_data:/data
    networks:
      - vigilcare_net

  kafka:
    image: apache/kafka:3.7.0
    ports:
      - "9092:9092"
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_LISTENERS: INTERNAL://0.0.0.0:29092,EXTERNAL://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
      # A client bootstraps, then reconnects to whatever the broker advertises — so the
      # advertised address must be resolvable from the client, not from the broker.
      # Compose services use INTERNAL; anything outside vigilcare_net reaches the
      # published port via EXTERNAL. KAFKA_EXTERNAL_HOST overrides "localhost" for CI,
      # where dotnet test runs inside a container and must use host.docker.internal.
      KAFKA_ADVERTISED_LISTENERS: INTERNAL://kafka:29092,EXTERNAL://${KAFKA_EXTERNAL_HOST:-localhost}:9092
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: INTERNAL:PLAINTEXT,EXTERNAL:PLAINTEXT,CONTROLLER:PLAINTEXT
      KAFKA_INTER_BROKER_LISTENER_NAME: INTERNAL
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      # Disable auto-creation — topics are provisioned explicitly with the correct
      # partition count. Auto-creation would silently create a topic with 1 partition
      # if the relay publishes before the provisioner runs.
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "false"
      # Fixed ID prevents the broker from reinitializing storage on restart.
      # Generate once with: kafka-storage.sh random-uuid | base64
      CLUSTER_ID: "MkU3OEVBNTcwNTJENDM2Qk"
    volumes:
      - kafka_data:/var/lib/kafka/data
    networks:
      - vigilcare_net

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.0
    environment:
      - discovery.type=single-node
      # Security disabled for development — no TLS negotiation overhead, no keystore setup.
      # A production deployment would enable xpack.security and use HTTPS.
      - xpack.security.enabled=false
      - ES_JAVA_OPTS=-Xms512m -Xmx512m
      - cluster.name=vigilcare-dev
    ports:
      - "9200:9200"
    volumes:
      - es_data:/usr/share/elasticsearch/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9200/_cluster/health"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - vigilcare_net

  rabbitmq:
    image: rabbitmq:3.13-management-alpine
    container_name: vigilcare_rabbitmq
    ports:
      - "5674:5672"    # AMQP
      - "15674:15672"  # management UI
    environment:
      RABBITMQ_DEFAULT_USER: guest
      RABBITMQ_DEFAULT_PASS: guest
    volumes:
      # Allow guest from host.docker.internal / CI runner (dev only).
      - ./infra/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - vigilcare_net

  minio:
    image: minio/minio:RELEASE.2024-07-04T14-25-45Z
    container_name: vigilcare_minio
    command: server /data --console-address ":9001"
    ports:
      - "9005:9000"    # S3 API
      - "9006:9001"    # console
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    volumes:
      - minio_data:/data
    networks:
      - vigilcare_net

  prometheus:
    image: prom/prometheus:v2.52.0
    container_name: vigilcare_prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.retention.time=7d"
    ports:
      - "9101:9090"
    volumes:
      - ./infra/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - vigilcare_net

  grafana:
    image: grafana/grafana:10.4.3
    container_name: vigilcare_grafana
    ports:
      - "3101:3000"
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: admin
      GF_USERS_ALLOW_SIGN_UP: "false"
    volumes:
      - ./infra/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./infra/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - grafana_data:/var/lib/grafana
    depends_on:
      - prometheus
    networks:
      - vigilcare_net

  ward-gateway-db:
    image: postgres:16
    profiles: ["ward-gateway", "full"]
    environment:
      POSTGRES_DB: vigilcare_ward
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: password
    ports:
      - "5437:5432"
    volumes:
      - ward_pg_data:/var/lib/postgresql/data
    networks:
      - vigilcare_net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  ward-gateway-redis:
    image: redis:7-alpine
    profiles: ["ward-gateway", "full"]
    ports:
      - "6383:6379"
    networks:
      - vigilcare_net

  ward-gateway-rabbitmq:
    image: rabbitmq:3.13-management-alpine
    profiles: ["ward-gateway", "full"]
    ports:
      - "5675:5672"
      - "15675:15672"
    environment:
      RABBITMQ_DEFAULT_USER: guest
      RABBITMQ_DEFAULT_PASS: guest
    volumes:
      - ./infra/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - vigilcare_net

  ward-gateway-api:
    profiles: ["ward-gateway", "full"]
    build:
      context: .
      dockerfile: VigilCare.WardGateway/Dockerfile
    ports:
      - "5081:8080"
    environment:
      ASPNETCORE_ENVIRONMENT: Development
      ConnectionStrings__GatewayDb: "Host=ward-gateway-db;Port=5432;Database=vigilcare_ward;Username=postgres;Password=password"
      Redis__ConnectionString: "ward-gateway-redis:6379"
      RabbitMq__Host: ward-gateway-rabbitmq
      RabbitMq__Port: 5672
      RabbitMq__PagingAckTimeoutMs: 300000
      CentralApi__BaseUrl: "http://host.docker.internal:5270"
      Gateway__GatewayId: "22222222-2222-2222-2222-222222222222"
      Gateway__SiteId: "11111111-1111-1111-1111-111111111111"
      Gateway__Department: "ICU"
      ApiKey__Gateway: "dev-gateway-key-change-in-production"
      Jwt__SigningKey: "dev-signing-key-minimum-32-bytes-long!!"
      Jwt__Issuer: "vigilcare-gateway"
      Jwt__Audience: "vigilcare-dashboard"
      GATEWAY_SYNC_JWT: "${GATEWAY_SYNC_JWT:-}"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      ward-gateway-db:
        condition: service_healthy
      ward-gateway-redis:
        condition: service_started
      ward-gateway-rabbitmq:
        condition: service_healthy
    networks:
      - vigilcare_net

volumes:
  pg_data:
  seq_data:
  kafka_data:
  es_data:
  minio_data:
  prometheus_data:
  grafana_data:
  ward_pg_data:

networks:
  vigilcare_net:
    driver: bridge