docker-compose.yml

services:
  redis:
    image: redis:7-alpine
    ports:
      - "127.0.0.1:6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  postgres:
    image: postgres:16-alpine
    ports:
      - "127.0.0.1:5432:5432"
    environment:
      POSTGRES_DB: nester_dev
      POSTGRES_USER: nester
      POSTGRES_PASSWORD: nester_dev_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U nester"]
      interval: 5s
      timeout: 5s
      retries: 10

  api:
    build:
      context: ./apps/api
      dockerfile: Dockerfile.dev
    ports:
      - "127.0.0.1:8080:8080"
    environment:
      APP_ENV: development
      DATABASE_DSN: postgres://nester:nester_dev_password@postgres:5432/nester_dev?sslmode=disable
      REDIS_ADDR: redis:6379
      STELLAR_NETWORK_PASSPHRASE: "Test SDF Network ; September 2015"
      STELLAR_RPC_URL: https://soroban-testnet.stellar.org
      STELLAR_HORIZON_URL: https://horizon-testnet.stellar.org
      # Development JWT secret. Set via AUTH_JWT_SECRET env var or .env file.
      # The development deny-list in internal/config/config.go accepts the default
      # below, but production rejects it. If unset, falls back to the placeholder.
      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:-dev-nester-jwt-secret-change-in-production}
      LOG_LEVEL: info
      LOG_FORMAT: text
      RUN_MIGRATIONS: "true"
      ALLOWED_ORIGINS: http://localhost:3001
      # Tracing (nester#1054). Off unless TRACING_ENABLED is exported, so the
      # default compose workflow is unchanged. The endpoint targets the
      # collector over the compose network — localhost:4317 would resolve to
      # this container, not the collector.
      TRACING_ENABLED: ${TRACING_ENABLED:-false}
      OTEL_EXPORTER_OTLP_ENDPOINT: otel-collector:4317
      OTEL_EXPORTER_OTLP_INSECURE: "true"
      # 1.0 because the collector applies tail sampling: a trace the head
      # drops never reaches it. See deploy/observability/otel-collector.yaml.
      TRACING_SAMPLE_RATIO: ${TRACING_SAMPLE_RATIO:-1.0}
      # Bound to all interfaces inside the container so Prometheus can reach
      # it over the compose network. Deliberately NOT published under `ports`
      # below: the metrics endpoint stays reachable only from inside the
      # compose network, never from the host's public interface.
      METRICS_ADDR: 0.0.0.0:9090
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - ./apps/api:/app
      - go_mod_cache:/go/pkg/mod
    healthcheck:
      # /healthz is the canonical liveness path (see README "Health
      # endpoints"); /health remains a permanent alias for it. Liveness rather
      # than /readyz on purpose: the services that wait on `service_healthy`
      # need the process to be up, and readiness additionally fails on
      # dependency outages this check should not restart the container for.
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  seed:
    image: postgres:16-alpine
    depends_on:
      api:
        condition: service_healthy
    environment:
      PGPASSWORD: nester_dev_password
    volumes:
      - ./scripts/seed.sql:/seed.sql:ro
    command:
      [
        "psql",
        "-h",
        "postgres",
        "-U",
        "nester",
        "-d",
        "nester_dev",
        "-v",
        "ON_ERROR_STOP=1",
        "-f",
        "/seed.sql",
      ]

  frontend:
    build:
      context: ./apps/dapp/frontend
      dockerfile: Dockerfile.dev
    ports:
      - "127.0.0.1:3001:3001"
    environment:
      NEXT_PUBLIC_API_URL: http://localhost:8080/api/v1
      NEXT_PUBLIC_WS_URL: ws://localhost:8080/ws
      NEXT_PUBLIC_NETWORK: testnet
    volumes:
      - ./apps/dapp/frontend:/app
      - /app/node_modules
      - /app/.next

  # --- Local observability: tracing (nester#1054) -----------------------
  #
  # Note for whoever merges second: PR #1065 (#1043, metrics) adds
  # `prometheus` and `grafana` under this same profile. The two stacks are
  # complementary and share no ports or volume names, so a conflict here is
  # textual only — keep both blocks and both sets of volumes.
  #
  # Started only with an explicit profile:
  #     docker compose --profile observability up
  #
  # Both services are profile-gated, so a normal `docker compose up` is
  # unchanged and tracing infrastructure is never a startup dependency for
  # ordinary development.
  #
  # To send traces, run the app services with tracing switched on:
  #     TRACING_ENABLED=true   #       docker compose --profile observability up
  #
  # Then open the Jaeger UI at http://localhost:16686 and pick the
  # "nester-api" service.
  jaeger:
    image: jaegertracing/all-in-one:1.62.0
    profiles: ["observability"]
    ports:
      # Jaeger UI.
      - "127.0.0.1:16686:16686"
    environment:
      # Jaeger accepts OTLP directly; the collector forwards to it here.
      COLLECTOR_OTLP_ENABLED: "true"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:16686/"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.115.1
    profiles: ["observability"]
    command: ["--config=/etc/otel/config.yaml"]
    volumes:
      - ./deploy/observability/otel-collector.yaml:/etc/otel/config.yaml:ro
    ports:
      # OTLP gRPC — what both services export to by default.
      - "127.0.0.1:4317:4317"
      # OTLP HTTP, for tools that cannot speak gRPC.
      - "127.0.0.1:4318:4318"
    depends_on:
      # Restored in nester#1056: the #1065/#1067 merge left this key with an
      # empty body, which makes the whole compose file fail to parse — every
      # `docker compose` command, not only the observability profile.
      jaeger:
        condition: service_healthy

  # Local observability stack. Started only with:
  #   docker compose --profile observability up
  # Services without a profile keep starting as before, so the default
  # developer workflow is unchanged.
  prometheus:
    image: prom/prometheus:v3.1.0
    profiles: ["observability"]
    ports:
      - "127.0.0.1:9091:9090"
    volumes:
      - ./docker/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      # SLO recording and alerting rules (nester#1056). Mounted read-only from
      # the repo so the rules Prometheus loads locally are byte-identical to
      # the ones CI validates with promtool.
      - ./docker/prometheus/rules:/etc/prometheus/rules:ro
      - prometheus_data:/prometheus
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=24h
      # The local stack is for looking at graphs, not for storing history;
      # 24h keeps the volume small.
    depends_on:
      api:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:9090/-/healthy"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Alertmanager (nester#1056). Receives the burn-rate alerts and applies the
  # routing and inhibition policy in docker/alertmanager/alertmanager.yml.
  #
  # Its receivers are deliberately empty: a local stack must not be able to
  # page anyone. Alerts are still inspectable in the UI at
  # http://localhost:9093, which is what makes the routing testable.
  alertmanager:
    image: prom/alertmanager:v0.28.0
    profiles: ["observability"]
    ports:
      - "127.0.0.1:9093:9093"
    volumes:
      - ./docker/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - alertmanager_data:/alertmanager
    command:
      - --config.file=/etc/alertmanager/alertmanager.yml
      - --storage.path=/alertmanager
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:9093/-/healthy"]
      interval: 10s
      timeout: 5s
      retries: 5

  grafana:
    image: grafana/grafana:11.4.0
    profiles: ["observability"]
    ports:
      - "127.0.0.1:3002:3000"
    environment:
      # Local-only convenience: anonymous viewer access so a developer does
      # not have to log in to look at a graph. Never mirror this in a
      # deployed environment.
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Admin
      GF_SECURITY_ALLOW_EMBEDDING: "true"
    volumes:
      - ./docker/grafana/provisioning:/etc/grafana/provisioning:ro
      # SLO dashboards (nester#1056), generated by
      # scripts/build_slo_dashboards.py and committed. Every panel reads the
      # recorded series the alerts fire on, so a dashboard cannot disagree
      # with the pager during an incident.
      - ./docker/grafana/dashboards:/etc/grafana/dashboards:ro
      - grafana_data:/var/lib/grafana
    depends_on:
      prometheus:
        condition: service_healthy

volumes:
  postgres_data:
  go_mod_cache:
  prometheus_data:
  alertmanager_data:
  grafana_data: