docker-compose.yml

# docker-compose.yml
#
# Local container environment for sublime247/mobile-money.
# Builds the optimized production image alongside Postgres, Redis, and local mock services.
#
# Usage:
#   docker compose up --build  # build and start everything
#   docker compose up -d       # start in background
#   docker compose down        # stop and remove containers
#   docker compose down -v     # stop and wipe volumes (fresh DB)

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: mobilemoney_app
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    env_file:
      - path: .env
        required: false
    environment:
      NODE_ENV: production
      LOG_LEVEL: ${LOG_LEVEL:-info}
      DATABASE_URL: postgresql://user:password@postgres:5432/mobilemoney_stellar
      REDIS_URL: redis://redis:6379
      # Loki transport — optional, falls back to stdout when unset
      LOKI_HOST: ${LOKI_HOST:-http://loki:3100}
      SERVICE_NAME: ${SERVICE_NAME:-mobile-money-api}
    ports:
      - "3000:3000"
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://localhost:3000/health').then(response => { if (!response.ok) process.exit(1); }).catch(() => process.exit(1))",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - mobilemoney_net
    logging:
      driver: "json-file"
      options:
        tag: "{{.Name}}"

  postgres:
    image: postgres:16-alpine
    container_name: mobilemoney_postgres
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
      POSTGRES_DB: mobilemoney_stellar
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d mobilemoney_stellar"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - mobilemoney_net

  redis:
    image: redis:7-alpine
    container_name: mobilemoney_redis
    command: redis-server /usr/local/etc/redis/redis.conf
    volumes:
      - ./redis.conf:/usr/local/etc/redis/redis.conf:ro
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - mobilemoney_net

  # ---------------------------------------------------------------------------
  # Mock SMTP Server (Maildev)
  # ---------------------------------------------------------------------------
  maildev:
    image: maildev/maildev:2.1.0
    container_name: mobilemoney_maildev
    restart: unless-stopped
    ports:
      - "1080:1080" # Web UI
      - "1025:1025" # SMTP Port
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 1025 || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5

  # ---------------------------------------------------------------------------
  # Local Stellar Quickstart Node
  # ---------------------------------------------------------------------------
  stellar:
    image: stellar/quickstart:latest
    container_name: mobilemoney_stellar_quickstart
    restart: unless-stopped
    ports:
      - "8000:8000" # Horizon API / Faucet (Friendbot)
      - "8001:8001" # Soroban RPC (contract deployment)
    command: ["--standalone", "--enable-horizon", "--enable-soroban-rpc"]
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8000 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  # ---------------------------------------------------------------------------
  # Loki (log aggregation)
  # ---------------------------------------------------------------------------
  loki:
    image: grafana/loki:latest
    container_name: mobilemoney_loki
    restart: unless-stopped
    ports:
      - "3100:3100"
    volumes:
      - ./logging/loki-config.yaml:/etc/loki/local-config.yaml
    command: -config.file=/etc/loki/local-config.yaml
    networks:
      - mobilemoney_net

  promtail:
    image: grafana/promtail:latest
    container_name: mobilemoney_promtail
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./logging/promtail-config.yaml:/etc/promtail/config.yml
    command: -config.file=/etc/promtail/config.yml
    networks:
      - mobilemoney_net

  resource-profiler:
    image: alpine:latest
    container_name: mobilemoney_resource_profiler
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./scripts:/scripts:ro
    command:
      [
        "/bin/sh",
        "-c",
        "apk add --no-cache bash docker-cli curl && bash /scripts/checkResources.sh",
      ]
    networks:
      - mobilemoney_net

  load-balancer:
    image: nginx:alpine
    container_name: mobilemoney_load_balancer
    restart: unless-stopped
    ports:
      - "80:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - app
    networks:
      - mobilemoney_net

  grafana:
    image: grafana/grafana:latest
    container_name: mobilemoney_grafana
    ports:
      - "3001:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GF_SECURITY_ADMIN_PASSWORD:-admin}
      - GF_PATHS_PROVISIONING=/etc/grafana/provisioning
      # ── Azure AD / Entra OAuth SSO ────────────────────────────────────
      - GF_AUTH_AZUREAD_ENABLED=${GF_AUTH_AZUREAD_ENABLED:-false}
      - GF_AUTH_AZUREAD_CLIENT_ID=${GF_AUTH_AZUREAD_CLIENT_ID:-}
      - GF_AUTH_AZUREAD_CLIENT_SECRET=${GF_AUTH_AZUREAD_CLIENT_SECRET:-}
      - GF_AUTH_AZUREAD_AUTH_URL=${GF_AUTH_AZUREAD_AUTH_URL:-}
      - GF_AUTH_AZUREAD_TOKEN_URL=${GF_AUTH_AZUREAD_TOKEN_URL:-}
      - GF_AUTH_AZUREAD_ALLOW_SIGN_UP=${GF_AUTH_AZUREAD_ALLOW_SIGN_UP:-true}
      - GF_AUTH_AZUREAD_AUTO_LOGIN=${GF_AUTH_AZUREAD_AUTO_LOGIN:-false}
      - GF_AUTH_AZUREAD_ROLE_ATTRIBUTE_STRICT=${GF_AUTH_AZUREAD_ROLE_ATTRIBUTE_STRICT:-false}
      - GF_AUTH_AZUREAD_SCOPES=${GF_AUTH_AZUREAD_SCOPES:-openid email profile}
      # ── Role mapping via Azure AD group claims ────────────────────────
      - GF_AUTH_AZUREAD_ROLE_ATTRIBUTE_PATH=${GF_AUTH_AZUREAD_ROLE_ATTRIBUTE_PATH:-}
      - GF_AUTH_AZUREAD_ALLOW_ASSIGN_GRAFANA_ADMIN=${GF_AUTH_AZUREAD_ALLOW_ASSIGN_GRAFANA_ADMIN:-false}
      - GF_AUTH_AZUREAD_SKIP_ORG_ROLE_SYNC=${GF_AUTH_AZUREAD_SKIP_ORG_ROLE_SYNC:-false}
      - GF_AUTH_AZUREAD_NAME=${GF_AUTH_AZUREAD_NAME:-Azure AD}
      # ── Access control ───────────────────────────────────────────────
      - GF_AUTH_AZUREAD_ALLOWED_DOMAINS=${GF_AUTH_AZUREAD_ALLOWED_DOMAINS:-}
      - GF_AUTH_AZUREAD_ALLOWED_GROUPS=${GF_AUTH_AZUREAD_ALLOWED_GROUPS:-}
      - GF_SERVER_ROOT_URL=${GF_SERVER_ROOT_URL:-http://localhost:3001}
      # ── Global auth hardening ─────────────────────────────────────────
      - GF_AUTH_ANONYMOUS_ENABLED=false
      - GF_AUTH_BASIC_ENABLED=true
      - GF_AUTH_DISABLE_LOGIN_FORM=${GF_AUTH_DISABLE_LOGIN_FORM:-false}
      - GF_AUTH_OAUTH_AUTO_LOGIN=${GF_AUTH_OAUTH_AUTO_LOGIN:-false}
      - GF_AUTH_SIGNOUT_REDIRECT_URL=${GF_AUTH_SIGNOUT_REDIRECT_URL:-}
    volumes:
      - grafana_data:/var/lib/grafana
      - ./logging/grafana/provisioning:/etc/grafana/provisioning
    networks:
      - mobilemoney_net

networks:
  mobilemoney_net:
    driver: bridge

volumes:
  grafana_data:
  redis_data: