name: clarity-platform

# ─────────────────────────────────────────────────────────────────────────────
# Platform Infrastructure — run once, always on.
# This is NOT part of Aspire orchestration.
#
# Usage:
#   docker compose up -d
#   docker compose down        (keeps volumes)
#   docker compose down -v     (destroys all data — careful!)
#
# Hardcoded dev credentials — do not use in production.
# ─────────────────────────────────────────────────────────────────────────────

networks:
  clarity-net:
    name: clarity-net
    external: true

volumes:
  postgres-data:
  minio-data:

services:

  # ── Postgres ──────────────────────────────────────────────────────────────
  # Single server for all platform databases.
  # Databases: keycloakdb, giteadb, controlplanedb
  # Tenant databases (clarity_{subdomain}) are created at provisioning time by ControlPlane.Worker.
  postgres:
    image: postgres:17.6
    container_name: clarity-postgres
    restart: unless-stopped
    ports:
      - "5432:5432"
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      clarity-net:
        aliases:
          - postgres
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 10

  # ── Keycloak ──────────────────────────────────────────────────────────────
  keycloak:
    image: quay.io/keycloak/keycloak:26.2
    container_name: clarity-keycloak
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloakdb
      KC_DB_USERNAME: postgres
      KC_DB_PASSWORD: postgres
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: Admin1234!
      KC_HOSTNAME: keycloak.clarity.test
      KC_HOSTNAME_URL: https://keycloak.clarity.test
      KC_HOSTNAME_PORT: "443"
      KC_HOSTNAME_STRICT: "false"
      KC_PROXY_HEADERS: xforwarded
    volumes:
      - ./keycloak:/opt/keycloak/data/import:ro
    command: start-dev --import-realm
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      clarity-net:
        aliases:
          - keycloak
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8080/health/ready || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 15

  # ── Vault ─────────────────────────────────────────────────────────────────
  vault:
    image: hashicorp/vault:latest
    container_name: clarity-vault
    restart: unless-stopped
    ports:
      - "8200:8200"
    cap_add:
      - IPC_LOCK
    user: root
    entrypoint: ["sh", "/vault/entrypoint.sh"]
    volumes:
      - ./vault/config/vault.hcl:/vault/config/vault.hcl:ro
      - ./vault/entrypoint.sh:/vault/entrypoint.sh:ro
      - ./vault/data:/vault/file
    networks:
      clarity-net:
        aliases:
          - vault
    healthcheck:
      test: ["CMD-SHELL", "vault status -address=http://127.0.0.1:8200 | grep -q 'Sealed' || vault status -address=http://127.0.0.1:8200 | grep -q 'false'"]
      interval: 10s
      timeout: 5s
      retries: 10

  # ── MinIO ─────────────────────────────────────────────────────────────────
  minio:
    image: minio/minio:latest
    container_name: clarity-minio
    restart: unless-stopped
    ports:
      - "9000:9000"
      - "9001:9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    command: server /data --console-address ":9001"
    volumes:
      - minio-data:/data
    networks:
      clarity-net:
        aliases:
          - minio
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10

  # ── Nginx (wildcard reverse proxy) ────────────────────────────────────────
  # Routes {subdomain}.clarity.test → correct tenant container via Docker DNS.
  # ControlPlane.Worker writes per-tenant configs into conf.d/ at provisioning time.
  nginx:
    image: nginx:alpine
    container_name: clarity-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./nginx/clarity.test.crt:/etc/nginx/certs/clarity.test.crt:ro
      - ./nginx/clarity.test.key:/etc/nginx/certs/clarity.test.key:ro
    networks:
      clarity-net:
        aliases:
          - nginx

  # ── Dnsmasq ───────────────────────────────────────────────────────────────
  # Resolves *.clarity.test → 127.0.0.1 so browser requests hit nginx on the host.
  dnsmasq:
    image: andyshinn/dnsmasq
    container_name: clarity-dnsmasq
    restart: unless-stopped
    ports:
      - "53:53/udp"
    cap_add:
      - NET_ADMIN
    volumes:
      - ./dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf:ro
    networks:
      clarity-net:
        aliases:
          - dnsmasq