docker-compose.yaml

# --------------------------------------------------------------------
# Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
#
# WSO2 LLC. licenses this file to you under the Apache License,
# Version 2.0 (the "License"); you may not use this file except
# in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
# --------------------------------------------------------------------

# NOTE: gateway-controller and gateway-runtime are duplicated in docker-compose.debug.yaml — keep in sync.

services:
  gateway-controller:
    image: ghcr.io/wso2/api-platform/gateway-controller:0.10.0-SNAPSHOT
    mem_limit: 60m
    mem_reservation: 60m
    cpus: 0.025
    command: ["-config", "/etc/gateway-controller/config.toml"]
    ports:
      - "9090:9090"   # REST API
      - "9094:9092"   # Admin API
      - "18000:18000" # xDS gRPC
      - "18001:18001"
      - "9011:9091"   # Metrics
    environment:
      - APIP_GW_CONTROLLER_STORAGE_TYPE=sqlite
      - APIP_GW_CONTROLLER_STORAGE_SQLITE_PATH=./data/gateway.db
      - APIP_GW_CONTROLLER_LOGGING_LEVEL=info
      - APIP_GW_CONTROLLER_METRICS_PORT=9091
      - APIP_GW_GATEWAY_REGISTRATION_TOKEN=${GATEWAY_REGISTRATION_TOKEN:-}
      - APIP_GW_CONTROLPLANE_HOST=${GATEWAY_CONTROLPLANE_HOST:-host.docker.internal:9243}
    volumes:
      - controller-data:/app/data
      - ./configs/config.toml:/etc/gateway-controller/config.toml:ro
      - ./gateway-controller/certificates:/app/certificates  # Read-write for dynamic certificate management
      - ./gateway-controller/listener-certs:/app/listener-certs:ro  # Read-only for HTTPS listener certificates
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - gateway-network

  gateway-runtime:
    image: ghcr.io/wso2/api-platform/gateway-runtime:0.10.0-SNAPSHOT
    mem_limit: 180m
    mem_reservation: 180m
    cpus: 0.175
    command: ["--pol.config", "/etc/policy-engine/config.toml"]
    ports:
      # Router (Envoy)
      - "8080:8080"   # HTTP ingress
      - "8443:8443"   # HTTPS ingress
      - "8081:8081"   # xDS-managed API listener
      - "8082:8082"   # WebSub Hub dynamic forward proxy
      - "8083:8083"   # WebSub Hub internal listener
      - "9901:9901"   # Envoy admin
      # Policy Engine
      - "9002:9002"   # Admin API
      - "9003:9003"   # Metrics
    environment:
      - GATEWAY_CONTROLLER_HOST=gateway-controller
      - MOESIF_KEY=${MOESIF_KEY:-}
      - LOG_LEVEL=info
    volumes:
      - ./configs/config.toml:/etc/policy-engine/config.toml:ro
    networks:
      - gateway-network

  sample-backend:
    image: ghcr.io/wso2/api-platform/sample-service:latest
    ports:
      - "5000:5000"
    command: ["-addr", ":5000", "-pretty"]
    # command: ["-addr", ":5000", "-pretty", "-https", "-cert", "/app/certs/server.pem", "-key", "/app/certs/server.key"]
    networks:
      - gateway-network

  jaeger:
    image: jaegertracing/all-in-one:1.76.0
    environment:
      - COLLECTOR_OTLP_ENABLED=true
    ports:
      - "16686:16686"     # Jaeger UI
      - "14268:14268"     # Jaeger collector HTTP
    networks:
      - gateway-network
    profiles: ["tracing"]

  otel-collector:
    image: otel/opentelemetry-collector:0.112.0
    command: ["--config=/etc/otel-collector-config.yaml"]
    volumes:
      - ./observability/otel-collector/config.yaml:/etc/otel-collector-config.yaml
    ports:
      - "4317:4317"   # OTLP gRPC receiver
      - "4318:4318"   # OTLP HTTP receiver
    networks:
      - gateway-network
    depends_on:
      - jaeger
    profiles: ["tracing"]

  opensearch:
    image: opensearchproject/opensearch:3.4.0
    environment:
      - cluster.name=opensearch-cluster
      - node.name=opensearch-node1
      - discovery.type=single-node
      - OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m
      - DISABLE_SECURITY_PLUGIN=true
      - DISABLE_INSTALL_DEMO_CONFIG=true
    ports:
      - "9200:9200"
      - "9600:9600"
    volumes:
      - opensearch-data:/usr/share/opensearch/data
    networks:
      - gateway-network
    profiles: ["logging"]

  opensearch-dashboards:
    image: opensearchproject/opensearch-dashboards:3.4.0
    environment:
      - OPENSEARCH_HOSTS=["http://opensearch:9200"]
      - DISABLE_SECURITY_DASHBOARDS_PLUGIN=true
    ports:
      - "5601:5601"
    networks:
      - gateway-network
    depends_on:
      - opensearch
    profiles: ["logging"]

  fluent-bit:
    image: fluent/fluent-bit:4.2.1
    volumes:
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - ./observability/fluent-bit/fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf
      - ./observability/fluent-bit/parsers.conf:/fluent-bit/etc/parsers.conf
      - ./observability/fluent-bit/add_component.lua:/fluent-bit/scripts/add_component.lua
    command: /fluent-bit/bin/fluent-bit -c /fluent-bit/etc/fluent-bit.conf
    networks:
      - gateway-network
    depends_on:
      - opensearch
    profiles: ["logging"]

  prometheus:
    image: prom/prometheus:v3.3.1
    volumes:
      - ./observability/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.enable-lifecycle'
    ports:
      - "9092:9090"   # Prometheus UI (9092 to avoid conflict with gateway-controller)
    networks:
      - gateway-network
    profiles: ["metrics"]

  grafana:
    image: "grafana/grafana:latest"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH=/etc/grafana/provisioning/dashboards/infrastructure-overview.json
    volumes:
      - grafana-data:/var/lib/grafana
      - ./observability/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
      - ./observability/grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./observability/grafana/dashboards:/etc/grafana/dashboards:ro
    ports:
      - "3000:3000"   # Grafana UI
    networks:
      - gateway-network
    depends_on:
      - prometheus
    profiles: ["metrics"]

volumes:
  controller-data:
    driver: local
  opensearch-data:
    driver: local
  prometheus-data:
    driver: local
  grafana-data:
    driver: local

networks:
  gateway-network:
    driver: bridge