docker-compose.yml

services:
  # TJudge CLI - образ для запуска матчей (только сборка)
  tjudge-cli:
    build:
      context: .
      dockerfile: docker/tjudge/Dockerfile
    image: tjudge-cli:latest
    entrypoint: ["echo", "tjudge-cli image built successfully"]
    restart: "no"
    networks:
      - tjudge-network

  # PostgreSQL Database
  postgres:
    image: postgres:15-alpine
    container_name: tjudge-postgres
    environment:
      POSTGRES_DB: ${DB_NAME:-tjudge}
      POSTGRES_USER: ${DB_USER:-tjudge}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-secret}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8"
    ports:
      - "5433:5432"  # 5433 on host to avoid conflict with local PostgreSQL
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U tjudge"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - tjudge-network

  # Redis Cache
  redis:
    image: redis:7-alpine
    container_name: tjudge-redis
    command: redis-server --appendonly yes --maxmemory ${REDIS_MAXMEMORY:-512mb} --maxmemory-policy volatile-lru --save 900 1 --save 300 10 --save 60 10000
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - tjudge-network

  # Database migrations
  migrate:
    build:
      context: .
      dockerfile: docker/migrate/Dockerfile
    container_name: tjudge-migrate
    environment:
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=${DB_USER:-tjudge}
      - DB_PASSWORD=${DB_PASSWORD:-secret}
      - DB_NAME=${DB_NAME:-tjudge}
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - tjudge-network
    restart: "no"

  # API Server
  api:
    build:
      context: .
      dockerfile: docker/api/Dockerfile
    container_name: tjudge-api
    ports:
      - "8080:8080"
      - "9090:9090"  # Metrics port
    environment:
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=${DB_USER:-tjudge}
      - DB_PASSWORD=${DB_PASSWORD:-secret}
      - DB_NAME=${DB_NAME:-tjudge}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - JWT_SECRET=${JWT_SECRET:-dev-secret-key-change-in-production}
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - LOG_FORMAT=json
      - METRICS_ENABLED=true
      - METRICS_PORT=9090
      - PROGRAMS_PATH=/data/programs
      - BASE_URL=${BASE_URL:-http://localhost:8080}
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    restart: unless-stopped
    volumes:
      - ./data/programs:/data/programs
    networks:
      - tjudge-network
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "-", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

  # Worker Pool
  worker:
    build:
      context: .
      dockerfile: docker/worker/Dockerfile
      args:
        DOCKER_GID: ${DOCKER_GID:-999}
    container_name: tjudge-worker
    # DEV-compose: на macOS/Docker Desktop host docker.sock owned by root:daemon (GID 1),
    # поэтому для локалки допустим root. В проде используйте docker-compose.selfhosted.yml
    # (или prod), где worker запускается от non-root appuser в docker-группе.
    # Чтобы переопределить на Linux: WORKER_USER=1000:999 docker compose up.
    user: "${WORKER_USER:-root}"
    ports:
      - "9091:9090"  # Metrics port
    environment:
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=${DB_USER:-tjudge}
      - DB_PASSWORD=${DB_PASSWORD:-secret}
      - DB_NAME=${DB_NAME:-tjudge}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - WORKER_MIN=${WORKER_MIN:-2}
      - WORKER_MAX=${WORKER_MAX:-10}
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - LOG_FORMAT=json
      - METRICS_ENABLED=true
      - METRICS_PORT=9090
      - PROGRAMS_PATH=/data/programs
      - HOST_PROGRAMS_PATH=${HOST_PROGRAMS_PATH:-./data/programs}
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
      tjudge-cli:
        condition: service_completed_successfully
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data/programs:/data/programs
    networks:
      - tjudge-network

  # Alertmanager для оповещений
  alertmanager:
    image: prom/alertmanager:v0.27.0
    container_name: tjudge-alertmanager
    ports:
      - "9093:9093"
    volumes:
      - ./deployments/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
      - '--web.external-url=http://localhost:9093'
    networks:
      - tjudge-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:9093/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # Prometheus для метрик
  prometheus:
    image: prom/prometheus:v2.53.0
    container_name: tjudge-prometheus
    ports:
      - "9092:9090"
    volumes:
      - ./deployments/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - ./deployments/prometheus/alerts:/etc/prometheus/alerts
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
      - '--storage.tsdb.retention.time=90d'
      - '--web.enable-lifecycle'
    depends_on:
      alertmanager:
        condition: service_healthy
    networks:
      - tjudge-network
    restart: unless-stopped

  # Grafana для визуализации
  grafana:
    image: grafana/grafana:11.1.0
    container_name: tjudge-grafana
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_USER=${GF_ADMIN_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GF_ADMIN_PASSWORD:-admin}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_INSTALL_PLUGINS=
    volumes:
      - grafana_data:/var/lib/grafana
      - ./deployments/grafana/provisioning:/etc/grafana/provisioning
    depends_on:
      - prometheus
      - loki
    networks:
      - tjudge-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # Loki для логов
  loki:
    image: grafana/loki:3.1.0
    container_name: tjudge-loki
    ports:
      - "3100:3100"
    volumes:
      - ./deployments/loki/loki-config.yml:/etc/loki/local-config.yaml
      - loki_data:/loki
    command: -config.file=/etc/loki/local-config.yaml
    networks:
      - tjudge-network
    restart: unless-stopped
    # Note: Loki image has no shell/wget/curl, so we disable health check
    # Loki availability is checked by Promtail connection

  # Promtail для сбора логов
  promtail:
    image: grafana/promtail:3.1.0
    container_name: tjudge-promtail
    volumes:
      - ./deployments/promtail/promtail-config.yml:/etc/promtail/config.yml
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock
    command: -config.file=/etc/promtail/config.yml
    depends_on:
      - loki
    networks:
      - tjudge-network
    restart: unless-stopped

volumes:
  postgres_data:
  redis_data:
  prometheus_data:
  grafana_data:
  loki_data:

networks:
  tjudge-network:
    driver: bridge