docker-compose.yml

services:
  timescaledb:
    image: timescale/timescaledb:latest-pg15
    container_name: wardragon-timescaledb
    environment:
      POSTGRES_DB: wardragon
      POSTGRES_USER: wardragon
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_INITDB_ARGS: "-E UTF8"
      TIMESCALEDB_TELEMETRY: "off"
    volumes:
      - timescale-data:/var/lib/postgresql/data
      - ./timescaledb:/docker-entrypoint-initdb.d:ro
    ports:
      - "127.0.0.1:5432:5432"
    networks:
      wardragon-net:
        ipv4_address: 172.20.0.2
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U wardragon -d wardragon"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    shm_size: 256MB
    command:
      - "postgres"
      - "-c"
      - "max_connections=200"
      - "-c"
      - "shared_buffers=256MB"
      - "-c"
      - "effective_cache_size=1GB"
      - "-c"
      - "work_mem=4MB"
      - "-c"
      - "maintenance_work_mem=64MB"
      - "-c"
      - "random_page_cost=1.1"
      - "-c"
      - "checkpoint_completion_target=0.9"
      - "-c"
      - "wal_buffers=16MB"
      - "-c"
      - "default_statistics_target=100"
      - "-c"
      - "log_min_duration_statement=1000"

  collector:
    build:
      context: ./app
      dockerfile: Dockerfile
      target: collector
    container_name: wardragon-collector
    environment:
      DATABASE_URL: postgresql://wardragon:${DB_PASSWORD}@timescaledb:5432/wardragon
      KITS_CONFIG: /config/kits.yaml
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      POLL_INTERVAL_DRONES: ${POLL_INTERVAL_DRONES:-5}
      POLL_INTERVAL_STATUS: ${POLL_INTERVAL_STATUS:-30}
      MAX_RETRIES: ${MAX_RETRIES:-3}
      RETRY_BACKOFF_FACTOR: ${RETRY_BACKOFF_FACTOR:-2}
    volumes:
      - ./config:/config:ro
      - ./logs/collector:/app/logs
    depends_on:
      timescaledb:
        condition: service_healthy
    networks:
      - wardragon-net
    restart: unless-stopped
    # Use Docker's internal DNS only - prevents hanging when no internet
    dns:
      - 127.0.0.11
    extra_hosts:
      - "timescaledb:172.20.0.2"
      - "host.docker.internal:host-gateway"
    healthcheck:
      test: ["CMD-SHELL", "python -c 'import os; exit(0 if os.path.exists(\"/tmp/collector_healthy\") else 1)' || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  web:
    build:
      context: ./app
      dockerfile: Dockerfile
      target: web
    container_name: wardragon-web
    environment:
      DATABASE_URL: postgresql://wardragon:${DB_PASSWORD}@timescaledb:5432/wardragon
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      API_TITLE: "WarDragon Analytics API"
      API_VERSION: "1.0.0"
      CORS_ORIGINS: ${CORS_ORIGINS:-*}
      MAX_QUERY_RANGE_HOURS: ${MAX_QUERY_RANGE_HOURS:-168}
    ports:
      - "${WEB_PORT:-8090}:8090"
    depends_on:
      timescaledb:
        condition: service_healthy
    networks:
      - wardragon-net
    restart: unless-stopped
    # Use Docker's internal DNS only - prevents hanging when no internet
    dns:
      - 127.0.0.11
    extra_hosts:
      - "timescaledb:172.20.0.2"
      - "host.docker.internal:host-gateway"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8090/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  grafana:
    image: grafana/grafana:10.4.1
    container_name: wardragon-grafana
    user: "472:0"
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD}
      GF_SECURITY_SECRET_KEY: ${GRAFANA_SECRET_KEY}
      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:-http://localhost:3000}
      GF_ANALYTICS_REPORTING_ENABLED: "false"
      GF_ANALYTICS_CHECK_FOR_UPDATES: "false"
      GF_PLUGINS_CHECK_FOR_UPDATES: "false"
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_LOG_LEVEL: ${GRAFANA_LOG_LEVEL:-info}
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      GF_SECURITY_DISABLE_GRAVATAR: "true"
      GF_SECURITY_COOKIE_SECURE: "${GRAFANA_COOKIE_SECURE:-false}"
      GF_SECURITY_COOKIE_SAMESITE: "strict"
      # Disable ALL external connectivity attempts for offline operation
      GF_ANALYTICS_FEEDBACK_LINKS_ENABLED: "false"
      GF_NEWS_NEWS_FEED_ENABLED: "false"
      GF_LIVE_ALLOWED_ORIGINS: ""
      GF_ENTERPRISE_LICENSE_VALIDATION_TYPE: "offline"
      GF_SNAPSHOTS_EXTERNAL_ENABLED: "false"
      GF_RENDERING_SERVER_URL: ""
      GF_RENDERING_CALLBACK_URL: ""
      GF_UNIFIED_ALERTING_SCREENSHOTS_CAPTURE: "false"
      DB_PASSWORD: ${DB_PASSWORD}
    # Use Docker's internal DNS only - prevents hanging when no internet
    dns:
      - 127.0.0.11
    extra_hosts:
      - "timescaledb:172.20.0.2"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./grafana/datasources:/etc/grafana/provisioning/datasources:ro
      - ./grafana/dashboards-json:/var/lib/grafana/dashboards:ro
    ports:
      - "${GRAFANA_PORT:-3000}:3000"
    depends_on:
      timescaledb:
        condition: service_healthy
    networks:
      - wardragon-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3000/api/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # =============================================================================
  # MQTT Services (Enabled by default)
  # =============================================================================
  # These services enable push-based data ingest from WarDragon kits via MQTT.
  # Alternative to HTTP polling - kits send data directly to the Analytics stack.
  #
  # Configuration:
  #   1. Configure DragonSync on kits to publish to this server's IP:1883
  #   2. See docs/mqtt-ingest.md for security hardening options
  #
  # To disable MQTT (use HTTP polling only):
  #   Run: docker compose up -d --scale mosquitto=0 --scale mqtt-ingest=0

  mosquitto:
    image: eclipse-mosquitto:2
    container_name: wardragon-mosquitto
    volumes:
      - ./mosquitto/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
      - ./mosquitto/certs:/mosquitto/certs:ro
      - mosquitto-data:/mosquitto/data
      - mosquitto-log:/mosquitto/log
    ports:
      - "${MQTT_BROKER_PORT:-1883}:1883"
      - "${MQTT_TLS_PORT:-8883}:8883"
    networks:
      wardragon-net:
        ipv4_address: 172.20.0.10
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "mosquitto_sub", "-t", "$$SYS/#", "-C", "1", "-i", "healthcheck", "-W", "3"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  mqtt-ingest:
    build:
      context: ./app
      dockerfile: Dockerfile
      target: mqtt-ingest
    container_name: wardragon-mqtt-ingest
    environment:
      DATABASE_URL: postgresql://wardragon:${DB_PASSWORD}@timescaledb:5432/wardragon
      MQTT_BROKER_HOST: mosquitto
      MQTT_BROKER_PORT: 1883
      MQTT_USERNAME: ${MQTT_USERNAME:-}
      MQTT_PASSWORD: ${MQTT_PASSWORD:-}
      MQTT_USE_TLS: ${MQTT_TLS_ENABLED:-false}
      MQTT_TOPIC_DRONES: ${MQTT_TOPIC_DRONES:-wardragon/drones}
      MQTT_TOPIC_DRONE_PREFIX: ${MQTT_TOPIC_DRONE_PREFIX:-wardragon/drone/}
      MQTT_TOPIC_AIRCRAFT: ${MQTT_TOPIC_AIRCRAFT:-wardragon/aircraft}
      MQTT_TOPIC_SIGNALS: ${MQTT_TOPIC_SIGNALS:-wardragon/signals}
      MQTT_TOPIC_SYSTEM: ${MQTT_TOPIC_SYSTEM:-wardragon/system}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    depends_on:
      timescaledb:
        condition: service_healthy
      mosquitto:
        condition: service_healthy
    networks:
      - wardragon-net
    restart: unless-stopped
    dns:
      - 127.0.0.11
    extra_hosts:
      - "timescaledb:172.20.0.2"
      - "mosquitto:172.20.0.10"
    healthcheck:
      test: ["CMD-SHELL", "python -c 'import os; exit(0 if os.path.exists(\"/tmp/mqtt_ingest_healthy\") else 1)' || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

networks:
  wardragon-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

volumes:
  timescale-data:
  grafana-data:
  mosquitto-data:
  mosquitto-log: