docker-compose.yml

x-forail-common: &forail-common
  image: ${FORAIL_BACKEND_IMAGE:-ghcr.io/forail-platform/forail-backend}:${FORAIL_TAG:-2026.07.0}
  env_file: .env
  environment: &forail-env
    DATABASE_HOST: postgres
    DATABASE_PORT: "5432"
    DATABASE_USER: ${POSTGRES_USER:-forail}
    DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
    DATABASE_NAME: ${POSTGRES_DB:-forail}
    REDIS_HOST: redis
    REDIS_PORT: "6379"
    FORAIL_SECRET_KEY: ${FORAIL_SECRET_KEY}
    FORAIL_BROADCAST_WEBSOCKET_SECRET: ${FORAIL_BROADCAST_WEBSOCKET_SECRET}
    FORAIL_ADMIN_USER: ${FORAIL_ADMIN_USER:-admin}
    FORAIL_ADMIN_PASSWORD: ${FORAIL_ADMIN_PASSWORD}
    FORAIL_ADMIN_EMAIL: ${FORAIL_ADMIN_EMAIL:-admin@example.com}
    # needtofix M9: no wildcard default (Host-header injection). Set to your host.
    FORAIL_ALLOWED_HOSTS: ${FORAIL_ALLOWED_HOSTS:-localhost,127.0.0.1}
    FORAIL_CSRF_TRUSTED_ORIGINS: ${FORAIL_CSRF_TRUSTED_ORIGINS:-}
    FORAIL_NODE_NAME: ${FORAIL_NODE_NAME:-forail-node}
    FORAIL_NODE_TYPE: ${FORAIL_NODE_TYPE:-hybrid}
    OTEL_ENABLED: ${OTEL_ENABLED:-true}
    OTEL_EXPORTER_ENDPOINT: ${OTEL_EXPORTER_ENDPOINT:-http://forail-otel-collector:4317}
    OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-forail}
    OTEL_TRACES_SAMPLER: ${OTEL_TRACES_SAMPLER:-parentbased_traceidratio}
    OTEL_TRACES_SAMPLER_ARG: ${OTEL_TRACES_SAMPLER_ARG:-0.1}
    TENANCY_ENABLED: ${TENANCY_ENABLED:-false}
  volumes: &forail-volumes
    - ./settings/settings.py:/etc/tower/settings.py:ro
    - ./settings/database.py:/etc/tower/conf.d/database.py:ro
    - ./settings/redis_settings.py:/etc/tower/conf.d/redis_settings.py:ro
    - ./settings/secret_key.py:/etc/tower/conf.d/secret_key.py:ro
    - ./settings/websocket_secret.py:/etc/tower/conf.d/websocket_secret.py:ro
    - ./settings/custom_settings.py:/etc/tower/conf.d/custom_settings.py:ro
    - ./receptor/receptor.conf:/etc/receptor/receptor.conf:ro
    - forail_projects:/var/lib/awx/projects
    - forail_receptor:/var/run/awx-receptor
  networks:
    - forail

services:
  # ── Database ───────────────────────────────────────────
  postgres:
    image: postgres:15-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-forail}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-forail}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - forail
    healthcheck:
      test: pg_isready -U ${POSTGRES_USER:-forail} -d ${POSTGRES_DB:-forail}
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  # ── Cache / Message Broker ─────────────────────────────
  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - forail
    healthcheck:
      test: redis-cli ping | grep -q PONG
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  # ── OPA sidecar (Policy-as-Code) ───────────────────────
  forail-opa:
    image: openpolicyagent/opa:latest-rootless
    command: ["run", "--server", "--addr", ":8181", "--log-level", "error"]
    networks:
      - forail
    # OPA rootless image has no shell utilities; rely on the built-in
    # /health endpoint via the docker network rather than an in-container
    # healthcheck.
    restart: unless-stopped

  # ── One-shot init (migrations, admin, provision) ───────
  forail-init:
    <<: *forail-common
    command: /bin/bash /etc/forail/init.sh
    volumes:
      - ./settings/settings.py:/etc/tower/settings.py:ro
      - ./settings/database.py:/etc/tower/conf.d/database.py:ro
      - ./settings/redis_settings.py:/etc/tower/conf.d/redis_settings.py:ro
      - ./settings/secret_key.py:/etc/tower/conf.d/secret_key.py:ro
      - ./settings/websocket_secret.py:/etc/tower/conf.d/websocket_secret.py:ro
      - ./settings/custom_settings.py:/etc/tower/conf.d/custom_settings.py:ro
      - ./receptor/receptor.conf:/etc/receptor/receptor.conf:ro
      - ./scripts/init.sh:/etc/forail/init.sh:ro
      - forail_projects:/var/lib/awx/projects
      - forail_receptor:/var/run/awx-receptor
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: "no"

  # ── Web (nginx + uwsgi + daphne) ──────────────────────
  forail-web:
    <<: *forail-common
    command: launch_awx_web.sh
    volumes:
      - ./settings/settings.py:/etc/tower/settings.py:ro
      - ./settings/database.py:/etc/tower/conf.d/database.py:ro
      - ./settings/redis_settings.py:/etc/tower/conf.d/redis_settings.py:ro
      - ./settings/secret_key.py:/etc/tower/conf.d/secret_key.py:ro
      - ./settings/websocket_secret.py:/etc/tower/conf.d/websocket_secret.py:ro
      - ./settings/custom_settings.py:/etc/tower/conf.d/custom_settings.py:ro
      - ./settings/nginx-internal.conf:/etc/nginx/nginx.conf:ro
      - ./receptor/receptor.conf:/etc/receptor/receptor.conf:ro
      - ./scripts/healthcheck-web.sh:/etc/forail/healthcheck-web.sh:ro
      - forail_projects:/var/lib/awx/projects
      - forail_receptor:/var/run/awx-receptor
    depends_on:
      forail-init:
        condition: service_completed_successfully
    healthcheck:
      test: bash /etc/forail/healthcheck-web.sh
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 120s
    restart: unless-stopped

  # ── Task (dispatcher + callback receiver + wsrelay) ────
  forail-task:
    <<: *forail-common
    command: launch_awx_task.sh
    # needtofix H4: podman (used by ansible-runner for EE process isolation)
    # needs cgroup/user-namespace/mount capabilities, for which privileged +
    # host cgroup is the simplest working setup. That is also a trivial
    # container escape to host-root, so both default OFF and must be turned on
    # explicitly for the job-execution path:
    #   FORAIL_TASK_PRIVILEGED=true FORAIL_TASK_CGROUP=host docker compose up -d
    # Prefer running this host as a dedicated, isolated job runner when enabled.
    privileged: ${FORAIL_TASK_PRIVILEGED:-false}
    cgroup: ${FORAIL_TASK_CGROUP:-private}
    volumes:
      - ./settings/settings.py:/etc/tower/settings.py:ro
      - ./settings/database.py:/etc/tower/conf.d/database.py:ro
      - ./settings/redis_settings.py:/etc/tower/conf.d/redis_settings.py:ro
      - ./settings/secret_key.py:/etc/tower/conf.d/secret_key.py:ro
      - ./settings/websocket_secret.py:/etc/tower/conf.d/websocket_secret.py:ro
      - ./settings/custom_settings.py:/etc/tower/conf.d/custom_settings.py:ro
      - ./receptor/receptor.conf:/etc/receptor/receptor.conf:ro
      - ./scripts/healthcheck-task.sh:/etc/forail/healthcheck-task.sh:ro
      - ./scripts/backup.sh:/etc/forail/backup.sh:ro
      - ./scripts/restore.sh:/etc/forail/restore.sh:ro
      - forail_projects:/var/lib/awx/projects
      - forail_receptor:/var/run/awx-receptor
      - forail_backups:/var/lib/awx/backups
    depends_on:
      forail-web:
        condition: service_healthy
    healthcheck:
      test: bash /etc/forail/healthcheck-task.sh
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    restart: unless-stopped

  # ── Frontend (React UI served by nginx) ────────────────
  forail-frontend:
    image: ${FORAIL_FRONTEND_IMAGE:-ghcr.io/forail-platform/forail-frontend}:${FORAIL_TAG:-2026.07.0}
    networks:
      - forail
    healthcheck:
      test: wget -qO /dev/null http://127.0.0.1:80/health || exit 1
      interval: 30s
      timeout: 5s
      retries: 3
    restart: unless-stopped

  # ── OpenTelemetry Collector (Tier 3.6 Observability) ──
  forail-otel-collector:
    image: otel/opentelemetry-collector-contrib:latest
    command: ["--config=/etc/otel/config.yaml"]
    volumes:
      - ./otel/config.yaml:/etc/otel/config.yaml:ro
    ports:
      - "4317:4317"
      - "4318:4318"
    networks:
      - forail
    restart: unless-stopped

  # ── External nginx (TLS termination + routing) ─────────
  nginx:
    image: nginx:1.27-alpine
    ports:
      - "${NGINX_HTTP_PORT:-80}:80"
      - "${NGINX_HTTPS_PORT:-443}:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    networks:
      - forail
    depends_on:
      forail-web:
        condition: service_healthy
      forail-frontend:
        condition: service_healthy
    healthcheck:
      test: wget -qO /dev/null http://127.0.0.1:80/ || true
      interval: 30s
      timeout: 5s
      retries: 3
    restart: unless-stopped

volumes:
  postgres_data:
  redis_data:
  forail_projects:
  forail_receptor:
  forail_backups:

networks:
  forail:
    driver: bridge