docker-compose.yml

services:
  nginx:
    image: nginx:1.30.3-alpine
    container_name: jnop-nginx
    restart: unless-stopped
    networks:
      - public
      - internal
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1/healthz || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    image: jorahone/jnop-backend:latest
    container_name: jnop-backend
    restart: unless-stopped
    volumes:
      - backend_logs:/logs
      - /srv/jnop/data:/srv/jnop/data:ro
    networks:
      - internal
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - REDIS_URL=${REDIS_URL}
      - SECRET_KEY=${SECRET_KEY}
      - BACKEND_CORS_ORIGINS=${BACKEND_CORS_ORIGINS}
      - REDIS_PASSWORD=${REDIS_PASSWORD}
      - GRAFANA_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - MITEL_SNMP_HOST=${MITEL_SNMP_HOST}
      - MITEL_SNMP_COMMUNITY=${MITEL_SNMP_COMMUNITY}
      - OSTICKET_BASE_URL=${OSTICKET_BASE_URL}
      - OSTICKET_API_KEY=${OSTICKET_API_KEY}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "python /app/healthcheck.py"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 15s

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    image: jorahone/jnop-frontend:latest
    container_name: jnop-frontend
    restart: unless-stopped
    networks:
      - public
      - internal
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1/ || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  postgres:
    image: postgres:16.14-alpine
    container_name: jnop-postgres
    restart: unless-stopped
    volumes:
      - pg_data:/var/lib/postgresql/data
    networks:
      - internal
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s

  redis:
    image: redis:7.4.9-alpine
    container_name: jnop-redis
    restart: unless-stopped
    command: >
      redis-server
      --requirepass ${REDIS_PASSWORD}
      --appendonly yes
      --save 20 1
    volumes:
      - redis_data:/data
    networks:
      - internal
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD} ping | grep PONG || true"]
      interval: 10s
      timeout: 3s
      retries: 3

  prometheus:
    network_mode: bridge
    image: prom/prometheus:v2.53.0
    container_name: jnop-prometheus
    restart: unless-stopped
    volumes:
      - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=30d'
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:9090/-/healthy || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  grafana:
    image: grafana/grafana:11.4.0
    container_name: jnop-grafana
    restart: unless-stopped
    volumes:
      - grafana_data:/var/lib/grafana
    networks:
      - internal
      - public
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GF_USERS_ALLOW_SIGN_UP=false
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:3000/api/health || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  loki:
    network_mode: bridge
    image: grafana/loki:3.2.0
    container_name: jnop-loki
    restart: unless-stopped
    volumes:
      - ./monitoring/loki/local-config.yaml:/etc/loki/local-config.yaml:ro
      - loki_data:/loki
    ports:
      - "3100:3100"
    command: ['-config.file=/etc/loki/local-config.yaml']
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:3100/ready || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  crowdsec:
    image: crowdsecurity/crowdsec:v1.7.8
    container_name: jnop-crowdsec
    restart: unless-stopped
    dns:
      - 8.8.8.8
      - 1.1.1.1
    volumes:
      - crowdsec_data:/var/lib/crowdsec
      - crowdsec_config:/etc/crowdsec
      - /var/log/auth.log:/var/log/auth.log:ro
      - /var/log/syslog:/var/log/syslog:ro
    networks:
      - internal
    environment:
      - COLLECTIONS=crowdsecurity/linux crowdsecurity/http-cve

  snmp-exporter:
    image: prom/snmp-exporter:v0.30.1
    container_name: jnop-snmp-exporter
    restart: unless-stopped
    volumes:
      - ./monitoring/snmp-exporter/snmp.yml:/etc/snmp-exporter/snmp.yml:ro
    networks:
      - internal
    command: ['--config.file=/etc/snmp-exporter/snmp.yml']

volumes:
  pg_data:
    name: jnop_pg_data
  redis_data:
    name: jnop_redis_data
  backend_logs:
    name: jnop_backend_logs
  prometheus_data:
    name: jnop_prometheus_data
  grafana_data:
    name: jnop_grafana_data
  loki_data:
    name: jnop_loki_data
  crowdsec_data:
    name: jnop_crowdsec_data
  crowdsec_config:
    name: jnop_crowdsec_config
  frontend_dist:
    name: jnop_frontend_dist

networks:
  public:
    name: jnop_public
  internal:
    name: jnop_internal
    internal: true