compose.yaml

services:
  ns-gateway:
    build:
      context: .
      target: ns-gateway
    image: ghcr.io/traptitech/ns-gateway:main
    command: --debug --loglevel=trace --config=/config.yaml
    restart: always
    volumes:
      - ./.local-dev/config/ns.yaml:/config.yaml
      - ./.local-dev/local-storage:/data
      - ./.local-dev/keys:/keys
      - ~/.ssh/known_hosts:/root/.ssh/known_hosts
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ns-gateway.rule=Host(`ns.local.trapti.tech`) && PathPrefix(`/neoshowcase.protobuf.APIService`)"
      # - "traefik.http.routers.ns-gateway.middlewares=ns_auth@file"
      - "traefik.http.routers.ns-gateway.middlewares=ns_auth_dev@file"
      - "traefik.http.routers.ns-gateway.service=ns-gateway"
      - "traefik.http.services.ns-gateway.loadbalancer.server.port=8080"
    depends_on:
      mysql:
        condition: service_healthy
      ns-migrate:
        condition: service_completed_successfully
    networks:
      - default

  dashboard:
    build:
      context: ./dashboard
      target: dev
    image: ghcr.io/traptitech/ns-dashboard:main-dev
    restart: always
    volumes:
      - ./dashboard:/work
      - /work/node_modules
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ns_dashboard.rule=Host(`ns.local.trapti.tech`)"
      # - "traefik.http.routers.ns_dashboard.middlewares=ns_auth@file"
      - "traefik.http.routers.ns_dashboard.middlewares=ns_auth_dev@file"
      - "traefik.http.routers.ns_dashboard.service=ns_dashboard"
      - "traefik.http.services.ns_dashboard.loadbalancer.server.port=80"
    networks:
      - default

  ns-controller:
    build:
      context: .
      target: ns-controller
    image: ghcr.io/traptitech/ns-controller:main
    command: --debug --loglevel=trace --config=/config.yaml
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./.local-dev/config/ns.yaml:/config.yaml
      - ./.local-dev/local-storage:/data
      - ./.local-dev/keys:/keys
      - ./.local-dev/traefik:/opt/traefik/conf
      - ~/.ssh/known_hosts:/root/.ssh/known_hosts
    ports:
      # for debug
      - 10000:10000
    depends_on:
      mysql:
        condition: service_healthy
      ns-migrate:
        condition: service_completed_successfully
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ns_controller_webhook.rule=Host(`ns.local.trapti.tech`) && PathPrefix(`/api/webhook`)"
      - "traefik.http.routers.ns_controller_webhook.service=ns_controller_webhook"
      - "traefik.http.services.ns_controller_webhook.loadbalancer.server.port=8080"
      - "traefik.tcp.routers.ns_controller.entrypoints=ns-ssh"
      - "traefik.tcp.routers.ns_controller.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.ns_controller.service=ns_controller"
      - "traefik.tcp.services.ns_controller.loadbalancer.server.port=2201"
    networks:
      - default

# Uncomment if testing gitea integration
#  ns-gitea-integration:
#    build:
#      context: .
#      target: ns-gitea-integration
#    image: ghcr.io/traptitech/ns-gitea-integration:main
#    command: --config=/config.yaml
#    restart: always
#    volumes:
#      - ./.local-dev/config/ns.yaml:/config.yaml
#    depends_on:
#      mysql:
#        condition: service_healthy
#      ns-migrate:
#        condition: service_completed_successfully
#    networks:
#      - default

  ns-auth:
    image: ghcr.io/traptitech/traefik-forward-auth:3.0.0
    restart: always
    command:
      - --config=/config.ini
    volumes:
      - ./.local-dev/config/ns-auth.ini:/config.ini
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ns_auth.rule=Host(`auth.local.trapti.tech`)"
      - "traefik.http.routers.ns_auth.service=ns_auth"
      - "traefik.http.services.ns_auth.loadbalancer.server.port=4181"
    networks:
      - default

  ns-auth-dev:
    build:
      context: .
      target: ns-auth-dev
    image: ghcr.io/traptitech/ns-auth-dev:main
    restart: always
    environment:
      HEADER: X-Showcase-User
      USER: "toki"
    networks:
      - default

  ns-builder:
    build:
      context: .
      target: ns-builder
    image: ghcr.io/traptitech/ns-builder:main
    command: --debug --loglevel=trace --config=/config.yaml
    restart: always
    volumes:
      - ./.local-dev/config/ns.yaml:/config.yaml
      - ./.local-dev/keys:/keys
      - ./.local-dev/local-storage:/data
      - ./.local-dev/buildkitd-sock:/run/buildkit
      - ~/.ssh/known_hosts:/root/.ssh/known_hosts
    depends_on:
      mysql:
        condition: service_healthy
      ns-migrate:
        condition: service_completed_successfully
      buildkitd:
        condition: service_started
    networks:
      - default

  buildpack-install:
    build:
      context: .
      target: ns
    image: ghcr.io/traptitech/ns:main
    restart: "no"
    entrypoint: cp /app/ns /ns-bin
    volumes:
      - binary:/ns-bin

  buildpack:
    image: paketobuildpacks/builder-jammy-full:latest
    restart: always
    entrypoint:
      - /ns-bin/ns
      - buildpack-helper
    command: --debug --loglevel=trace --config=/config.yaml
    expose:
      - 1235
    volumes:
      - binary:/ns-bin
      - ./.local-dev/config/ns.yaml:/config.yaml
    depends_on:
      buildpack-install:
        condition: service_completed_successfully
    networks:
      - default

  buildkitd:
    image: moby/buildkit:latest
    restart: always
    privileged: true
    command: --addr unix:///run/buildkit/buildkitd.sock
    volumes:
      - ./.local-dev/buildkitd-sock:/run/buildkit
      - ./.local-dev/buildkitd/buildkitd.toml:/etc/buildkit/buildkitd.toml
    networks:
      - default
    deploy:
      resources:
        limits:
          cpus: "1"

  static-server:
    image: caddy:2-alpine
    restart: always
    environment:
      # Do not bind to all addresses in production!
      CADDY_ADMIN: ":2019"
    volumes:
      - ./.local-dev/staticsite/artifacts:/artifacts
    networks:
      - default

  ns-ssgen:
    build:
      context: .
      target: ns-ssgen
    image: ghcr.io/traptitech/ns-ssgen:main
    command: --debug --loglevel=trace --config=/config.yaml
    restart: always
    volumes:
      - ./.local-dev/config/ns.yaml:/config.yaml
      - ./.local-dev/staticsite/artifacts:/artifacts
      - ./.local-dev/local-storage:/data
    depends_on:
      mysql:
        condition: service_healthy
      ns-migrate:
        condition: service_completed_successfully
    networks:
      - default

  ns-migrate:
    build:
      context: .
      target: ns-migrate
    image: ghcr.io/traptitech/ns-migrate:main
    restart: "no"
    environment:
      DB_HOST: "mysql"
      DB_PORT: "3306"
      DB_USER: "root"
      DB_PASS: "password"
      DB_NAME: "neoshowcase"
    depends_on:
      mysql:
        condition: service_healthy
    networks:
      - default

  registry:
    image: registry:2
    restart: always
    environment:
      REGISTRY_STORAGE_DELETE_ENABLED: "true"
      REGISTRY_HTTP_ADDR: :80
      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /var/lib/registry
      GC_SCRIPT: /gc.sh
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.registry.rule=Host(`registry.local`)"
      - "traefik.http.services.registry.loadbalancer.server.port=80"
    volumes:
      - ./.local-dev/registry/entrypoint.sh:/entrypoint.sh
      - ./.local-dev/registry/gc.sh:/gc.sh
      - ./.local-dev/registry-data:/var/lib/registry
    networks:
      default:
        aliases:
          - "registry.local"

  registry-frontend:
    image: joxit/docker-registry-ui:2
    restart: always
    environment:
      SINGLE_REGISTRY: "true"
      REGISTRY_TITLE: registry.local
      NGINX_PROXY_PASS_URL: http://registry.local
      SHOW_CONTENT_DIGEST: "true"
      DELETE_IMAGES: "true"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.registry_frontend.rule=Host(`registry-frontend.local.trapti.tech`)"
      - "traefik.http.services.registry_frontend.loadbalancer.server.port=80"
    networks:
      - default

  mysql:
    image: mariadb:10
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: password
      MYSQL_DATABASE: neoshowcase
    command: mysqld --character-set-server=utf8 --collation-server=utf8_general_ci
    healthcheck:
      test: mysql --user=root --password=password --execute "SHOW DATABASES;"
      interval: 1s
      timeout: 10s
      retries: 60
    volumes:
      - ./.local-dev/mysql:/var/lib/mysql
    ports:
      - "5004:3306"
    networks:
      - default
      - apps

  mongo:
    image: mongo:6
    restart: always
    environment:
      MONGO_INITDB_ROOT_USERNAME: root
      MONGO_INITDB_ROOT_PASSWORD: password
    volumes:
      - ./.local-dev/mongo:/data/db
    ports:
      - "5010:27017"
    networks:
      - default
      - apps

  adminer:
    image: adminer:4.8.1
    restart: always
    environment:
      ADMINER_DEFAULT_SERVER: mysql
      ADMINER_DESIGN: nette
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.adminer.rule=Host(`adminer.local.trapti.tech`)"
      - "traefik.http.services.adminer.loadbalancer.server.port=80"
    networks:
      - default

  grafana:
    image: grafana/grafana:10.0.1
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.grafana.rule=Host(`grafana.local.trapti.tech`)"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
    volumes:
      - ./.local-dev/grafana:/var/lib/grafana
      - ./.local-dev/config/grafana.ini:/etc/grafana/grafana.ini:ro
    networks:
      - default

  loki:
    image: grafana/loki:2.8.0
    command: "-config.file /etc/loki/loki.yaml"
    restart: always
    labels:
      # for debug
      - "traefik.enable=true"
      - "traefik.http.routers.loki.rule=Host(`loki.local.trapti.tech`)"
      - "traefik.http.services.loki.loadbalancer.server.port=3100"
    volumes:
      - ./.local-dev/loki:/var/lib/loki
      - ./.local-dev/config/loki.yaml:/etc/loki/loki.yaml:ro
    networks:
      - default

  promtail:
    image: grafana/promtail:2.8.0
    command: "-config.file /etc/promtail/promtail.yaml"
    restart: always
    volumes:
      - ./.local-dev/config/promtail.yaml:/etc/promtail/promtail.yaml
      - ./.local-dev/promtail:/var/run/promtail
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - default

  victoria-metrics:
    image: victoriametrics/victoria-metrics:v1.91.3
    command:
      - --promscrape.config=/etc/config/prometheus.yml
      - --promscrape.maxScrapeSize=256MB
      - --maxLabelsPerTimeseries=128
      - --storageDataPath=/data
      - --retentionPeriod=7d
    expose:
      - 8428
    volumes:
      - ./.local-dev/config/prometheus.yml:/etc/config/prometheus.yml:ro
      - ./.local-dev/victoria-metrics:/data

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.47.2
    privileged: true
    devices:
      - /dev/kmsg
    expose:
      - 8080
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro

  traefik:
    image: traefik:3.0.0
    restart: always
    command:
      - --api.insecure=true
      - --providers.docker
      - --providers.docker.exposedByDefault=false
      - --providers.file
      - --providers.file.directory=/opt/neoshowcase/conf
      - --providers.file.watch=true
      - --entrypoints.web.address=:80/tcp
      - --entrypoints.websecure.address=:443/tcp
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.ns-ssh.address=:2201/tcp
      - --entrypoints.traefik.address=:8080/tcp
      - --entrypoints.metrics.address=:9100/tcp
      - --api.dashboard=true
      - --ping=true
      - --metrics.prometheus=true
      - --metrics.prometheus.entrypoint=metrics
    ports:
      - "80:80"
      - "443:443"
      - "2201:2201"
      - "8080:8080"
      - "9100:9100"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./.local-dev/traefik:/opt/neoshowcase/conf
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik_dashboard.rule=Host(`traefik.local.trapti.tech`)"
      - "traefik.http.routers.traefik_dashboard.service=traefik_dashboard"
      - "traefik.http.services.traefik_dashboard.loadbalancer.server.port=8080"
      - "traefik.http.routers.traefik_metrics.rule=Host(`traefik.local.trapti.tech`) && PathPrefix(`/metrics`)"
      - "traefik.http.routers.traefik_metrics.service=traefik_metrics"
      - "traefik.http.services.traefik_metrics.loadbalancer.server.port=9100"
    networks:
      - default
      - apps

networks:
  default: { }
  apps:
    name: neoshowcase_apps
    external: true

volumes:
  binary: