docker-compose.yml

services:
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  postgres:
    image: postgres:16-alpine
    ports:
      - "5432:5432"
    environment:
      POSTGRES_DB: nester_dev
      POSTGRES_USER: nester
      POSTGRES_PASSWORD: nester_dev_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U nester"]
      interval: 5s
      timeout: 5s
      retries: 10

  api:
    build:
      context: ./apps/api
      dockerfile: Dockerfile.dev
    ports:
      - "8080:8080"
    environment:
      APP_ENV: development
      DATABASE_DSN: postgres://nester:nester_dev_password@postgres:5432/nester_dev?sslmode=disable
      REDIS_ADDR: redis:6379
      STELLAR_NETWORK_PASSPHRASE: "Test SDF Network ; September 2015"
      STELLAR_RPC_URL: https://soroban-testnet.stellar.org
      STELLAR_HORIZON_URL: https://horizon-testnet.stellar.org
      # DO NOT use in production — this is a development-only placeholder
      AUTH_JWT_SECRET: dev-nester-jwt-secret-change-in-production
      LOG_LEVEL: info
      LOG_FORMAT: text
      RUN_MIGRATIONS: "true"
      ALLOWED_ORIGINS: http://localhost:3001
      # Tracing (nester#1054). Off unless TRACING_ENABLED is exported, so the
      # default compose workflow is unchanged. The endpoint targets the
      # collector over the compose network — localhost:4317 would resolve to
      # this container, not the collector.
      TRACING_ENABLED: ${TRACING_ENABLED:-false}
      OTEL_EXPORTER_OTLP_ENDPOINT: otel-collector:4317
      OTEL_EXPORTER_OTLP_INSECURE: "true"
      # 1.0 because the collector applies tail sampling: a trace the head
      # drops never reaches it. See deploy/observability/otel-collector.yaml.
      TRACING_SAMPLE_RATIO: ${TRACING_SAMPLE_RATIO:-1.0}
      # Bound to all interfaces inside the container so Prometheus can reach
      # it over the compose network. Deliberately NOT published under `ports`
      # below: the metrics endpoint stays reachable only from inside the
      # compose network, never from the host's public interface.
      METRICS_ADDR: 0.0.0.0:9090
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - ./apps/api:/app
      - go_mod_cache:/go/pkg/mod
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  seed:
    image: postgres:16-alpine
    depends_on:
      api:
        condition: service_healthy
    environment:
      PGPASSWORD: nester_dev_password
    volumes:
      - ./scripts/seed.sql:/seed.sql:ro
    command: ["psql", "-h", "postgres", "-U", "nester", "-d", "nester_dev", "-v", "ON_ERROR_STOP=1", "-f", "/seed.sql"]

  frontend:
    build:
      context: ./apps/dapp/frontend
      dockerfile: Dockerfile.dev
    ports:
      - "3001:3001"
    environment:
      NEXT_PUBLIC_API_URL: http://localhost:8080/api/v1
      NEXT_PUBLIC_WS_URL: ws://localhost:8080/ws
      NEXT_PUBLIC_NETWORK: testnet
      INTELLIGENCE_SERVICE_URL: http://intelligence:8000
    volumes:
      - ./apps/dapp/frontend:/app
      - /app/node_modules
      - /app/.next

  intelligence:
    build:
      context: ./apps/intelligence
    ports:
      - "8000:8000"
    env_file:
      # Optional: a fresh clone has no .env yet, and a hard requirement here
      # makes every `docker compose` command fail to parse — even ones that
      # never start this service.
      - path: ./apps/intelligence/.env
        required: false
    environment:
      INTELLIGENCE_REDIS_URL: redis://redis:6379/0
      # See the api service above for why the endpoint is not localhost and
      # why the sample ratio is 1.0 under the collector.
      INTELLIGENCE_TRACING_ENABLED: ${INTELLIGENCE_TRACING_ENABLED:-false}
      INTELLIGENCE_OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4317
      INTELLIGENCE_OTEL_EXPORTER_OTLP_INSECURE: "true"
      INTELLIGENCE_TRACING_SAMPLE_RATIO: ${INTELLIGENCE_TRACING_SAMPLE_RATIO:-1.0}
      # SLI exposition (nester#1056). Enabled by default because these are the
      # unsampled counters an error budget is computed from; a service whose
      # SLI stops being recorded reports a perfect success rate rather than an
      # outage. The token is empty locally, which disables the scrape auth
      # check — set it in any environment where the port is reachable.
      INTELLIGENCE_METRICS_ENABLED: ${INTELLIGENCE_METRICS_ENABLED:-true}
      INTELLIGENCE_METRICS_TOKEN: ${INTELLIGENCE_METRICS_TOKEN:-}
    depends_on:
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  # --- Local observability: tracing (nester#1054) -----------------------
  #
  # Note for whoever merges second: PR #1065 (#1043, metrics) adds
  # `prometheus` and `grafana` under this same profile. The two stacks are
  # complementary and share no ports or volume names, so a conflict here is
  # textual only — keep both blocks and both sets of volumes.
  #
  # Started only with an explicit profile:
  #     docker compose --profile observability up
  #
  # Both services are profile-gated, so a normal `docker compose up` is
  # unchanged and tracing infrastructure is never a startup dependency for
  # ordinary development.
  #
  # To send traces, run the app services with tracing switched on:
  #     TRACING_ENABLED=true INTELLIGENCE_TRACING_ENABLED=true   #       docker compose --profile observability up
  #
  # Then open the Jaeger UI at http://localhost:16686 and pick the
  # "nester-api" or "nester-intelligence" service.
  jaeger:
    image: jaegertracing/all-in-one:1.62.0
    profiles: ["observability"]
    ports:
      # Jaeger UI.
      - "16686:16686"
    environment:
      # Jaeger accepts OTLP directly; the collector forwards to it here.
      COLLECTOR_OTLP_ENABLED: "true"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:16686/"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.115.1
    profiles: ["observability"]
    command: ["--config=/etc/otel/config.yaml"]
    volumes:
      - ./deploy/observability/otel-collector.yaml:/etc/otel/config.yaml:ro
    ports:
      # OTLP gRPC — what both services export to by default.
      - "4317:4317"
      # OTLP HTTP, for tools that cannot speak gRPC.
      - "4318:4318"
    depends_on:
      # Restored in nester#1056: the #1065/#1067 merge left this key with an
      # empty body, which makes the whole compose file fail to parse — every
      # `docker compose` command, not only the observability profile.
      jaeger:
        condition: service_healthy

  # Local observability stack. Started only with:
  #   docker compose --profile observability up
  # Services without a profile keep starting as before, so the default
  # developer workflow is unchanged.
  prometheus:
    image: prom/prometheus:v3.1.0
    profiles: ["observability"]
    ports:
      - "9091:9090"
    volumes:
      - ./docker/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      # SLO recording and alerting rules (nester#1056). Mounted read-only from
      # the repo so the rules Prometheus loads locally are byte-identical to
      # the ones CI validates with promtool.
      - ./docker/prometheus/rules:/etc/prometheus/rules:ro
      - prometheus_data:/prometheus
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=24h
      # The local stack is for looking at graphs, not for storing history;
      # 24h keeps the volume small.
    depends_on:
      api:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:9090/-/healthy"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Alertmanager (nester#1056). Receives the burn-rate alerts and applies the
  # routing and inhibition policy in docker/alertmanager/alertmanager.yml.
  #
  # Its receivers are deliberately empty: a local stack must not be able to
  # page anyone. Alerts are still inspectable in the UI at
  # http://localhost:9093, which is what makes the routing testable.
  alertmanager:
    image: prom/alertmanager:v0.28.0
    profiles: ["observability"]
    ports:
      - "9093:9093"
    volumes:
      - ./docker/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - alertmanager_data:/alertmanager
    command:
      - --config.file=/etc/alertmanager/alertmanager.yml
      - --storage.path=/alertmanager
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:9093/-/healthy"]
      interval: 10s
      timeout: 5s
      retries: 5

  grafana:
    image: grafana/grafana:11.4.0
    profiles: ["observability"]
    ports:
      - "3002:3000"
    environment:
      # Local-only convenience: anonymous viewer access so a developer does
      # not have to log in to look at a graph. Never mirror this in a
      # deployed environment.
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Admin
      GF_SECURITY_ALLOW_EMBEDDING: "true"
    volumes:
      - ./docker/grafana/provisioning:/etc/grafana/provisioning:ro
      # SLO dashboards (nester#1056), generated by
      # scripts/build_slo_dashboards.py and committed. Every panel reads the
      # recorded series the alerts fire on, so a dashboard cannot disagree
      # with the pager during an incident.
      - ./docker/grafana/dashboards:/etc/grafana/dashboards:ro
      - grafana_data:/var/lib/grafana
    depends_on:
      prometheus:
        condition: service_healthy

volumes:
  postgres_data:
  go_mod_cache:
  prometheus_data:
  alertmanager_data:
  grafana_data: