docker-compose.yml

# /\_/\
# ( o.o )  paws control plane
#  > ^ <
#
# Architecture:
#   Caddy (:80/:443) → Gateway (:4000) — dashboard + API
#
# Workers connect via K8s Services (in-cluster) or WebSocket call-home (remote).
# No tunneling dependencies required.

services:
  # ── Caddy (Reverse Proxy + Auto-HTTPS — enabled when domain is set) ──────
  caddy:
    image: caddy:2-alpine
    container_name: paws-caddy
    restart: unless-stopped
    profiles:
      - domain
    networks:
      - paws
    ports:
      - '80:80'
      - '443:443'
    environment:
      DOMAIN: '${DOMAIN:-localhost}'
    volumes:
      - ./config/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    depends_on:
      gateway:
        condition: service_healthy

  # ── Gateway (Paws API + Dashboard) ───────────────────────────────────────
  # Directly accessible on port 3000 (HTTP). When a domain is configured,
  # Caddy sits in front on 80/443 and proxies to the gateway.
  gateway:
    image: ghcr.io/arek-e/paws-control-plane:${PAWS_VERSION:-latest}
    container_name: paws-control-plane
    restart: unless-stopped
    networks:
      - paws
    ports:
      - '3000:3000'
    volumes:
      - gateway-data:/var/lib/paws/data
    environment:
      PORT: '3000'
      API_KEY: '${API_KEY:-paws-dev-key}'
      WORKER_URL: '${WORKER_URL:-}'
      DASHBOARD_DIR: '/app/apps/dashboard/dist'
      PAWS_VERSION: '${PAWS_VERSION:-0.5.2}'
      DOMAIN: '${DOMAIN:-}'
      # OIDC (configured when domain is set; on bare IP, use API key auth only)
      OIDC_ISSUER: '${OIDC_ISSUER:-}'
      OIDC_CLIENT_ID: '${OIDC_CLIENT_ID:-paws-control-plane}'
      OIDC_CLIENT_SECRET: '${OIDC_CLIENT_SECRET:-}'
      OIDC_REDIRECT_URI: '${OIDC_REDIRECT_URI:-}'
      OIDC_AUTH_EXTERNAL_URL: '${OIDC_AUTH_EXTERNAL_URL:-}'
      AUTH_SECRET: '${AUTH_SECRET:-change-me-to-a-random-32-char-string}'
      # Metrics + Tracing
      VICTORIAMETRICS_URL: 'http://victoriametrics:8428'
      OTEL_EXPORTER_OTLP_ENDPOINT: 'http://tempo:4318'
    healthcheck:
      test: ['CMD', 'wget', '-qO-', 'http://localhost:3000/health']
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 10s

  # ── Dex (OIDC Identity Provider) ─────────────────────────────────────────
  dex:
    image: ghcr.io/dexidp/dex:v2.41.1
    container_name: paws-dex
    restart: unless-stopped
    networks:
      - paws
    expose:
      - '5556'
    volumes:
      - ./config/dex/config.yaml:/etc/dex/config.docker.yaml:ro
      - dex-data:/data
    environment:
      DOMAIN: '${DOMAIN:-localhost}'
      OIDC_CLIENT_SECRET: '${OIDC_CLIENT_SECRET:-paws-dex-secret-changeme}'
      GITHUB_CLIENT_ID: '${GITHUB_CLIENT_ID:-}'
      GITHUB_CLIENT_SECRET: '${GITHUB_CLIENT_SECRET:-}'

  # ── VictoriaMetrics (Metrics Storage) ────────────────────────────────────
  victoriametrics:
    image: victoriametrics/victoria-metrics:v1.108.1
    container_name: paws-victoriametrics
    restart: unless-stopped
    networks:
      - paws
    expose:
      - '8428'
    volumes:
      - vm-data:/victoria-metrics-data
      - ./infra/victoriametrics/scrape.compose.yml:/etc/victoria-metrics/scrape.yml:ro
      - ./infra/victoriametrics/alerts.yml:/etc/victoria-metrics/alerts.yml:ro
    command:
      - '--storageDataPath=/victoria-metrics-data'
      - '--retentionPeriod=30d'
      - '--promscrape.config=/etc/victoria-metrics/scrape.yml'
      - '--rule=/etc/victoria-metrics/alerts.yml'
      - '--httpListenAddr=:8428'

  # ── Tempo (Distributed Tracing) ───────────────────────────────────────
  tempo:
    image: grafana/tempo:2.7.2
    container_name: paws-tempo
    restart: unless-stopped
    networks:
      - paws
    expose:
      - '3200' # Tempo HTTP API
      - '4317' # OTLP gRPC
      - '4318' # OTLP HTTP
    volumes:
      - tempo-data:/var/tempo
      - ./infra/tempo/tempo-config.yml:/etc/tempo/config.yml:ro
    command:
      - '-config.file=/etc/tempo/config.yml'

  # ── Loki (Log Aggregation) ─────────────────────────────────────────────
  loki:
    image: grafana/loki:3.4.2
    container_name: paws-loki
    restart: unless-stopped
    networks:
      - paws
    expose:
      - '3100'
    volumes:
      - loki-data:/loki
      - ./infra/loki/loki-config.yml:/etc/loki/local-config.yaml:ro

  # ── Promtail (Log Collector) ─────────────────────────────────────────────
  promtail:
    image: grafana/promtail:3.4.2
    container_name: paws-promtail
    restart: unless-stopped
    networks:
      - paws
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./infra/promtail/promtail-config.yml:/etc/promtail/config.yml:ro
    depends_on:
      - loki

  # ── Grafana (Dashboards) ─────────────────────────────────────────────────
  grafana:
    image: grafana/grafana-oss:11.6.0
    container_name: paws-grafana
    restart: unless-stopped
    networks:
      - paws
    expose:
      - '3001'
    environment:
      GF_SECURITY_ADMIN_PASSWORD: '${GRAFANA_ADMIN_PASSWORD:-admin}'
      GF_SERVER_HTTP_PORT: '3001'
      GF_SERVER_ROOT_URL: 'https://${DOMAIN:-localhost}/grafana/'
      GF_SERVER_SERVE_FROM_SUB_PATH: 'true'
    volumes:
      - grafana-data:/var/lib/grafana
      - ./infra/grafana/datasources.yml:/etc/grafana/provisioning/datasources/datasources.yml:ro
      - ./infra/grafana/dashboards.yml:/etc/grafana/provisioning/dashboards/dashboards.yml:ro
      - ./infra/grafana/dashboards:/var/lib/grafana/dashboards:ro

networks:
  paws:
    driver: bridge

volumes:
  caddy-data:
  caddy-config:
  dex-data:
  gateway-data:
  vm-data:
  loki-data:
  tempo-data:
  grafana-data: