docker-compose.yml

# =============================================================================
# docker-compose.yml — Local development stack
#
# ── Profile taxonomy ─────────────────────────────────────────────────────────
# Services are grouped into profiles so `docker compose up -d` on a fresh
# clone stays small (~5 containers / ~1 GB) instead of pulling every
# optional tool (~15 containers / ~12 GB). Opt into extras as needed.
#
#   (core, no profile)  db, kafka, redis, app
#                       → the minimum to boot the Spring Boot API.
#
#   --profile full      keycloak, ollama
#                       → heavy extras most contributors don't need
#                         day-to-day (OAuth2 IdP, local LLM).
#
#   --profile admin     cloudbeaver, pgweb-local, kafka-ui, redisinsight,
#                       redis-commander, sonarqube
#                       → nice-to-have browsing / quality tools for
#                         inspecting DB, Kafka, Redis, static-analysis.
#
#   --profile docs      maven-site, compodoc
#                       → local-only documentation servers (Maven site,
#                         Angular Compodoc reference).
#
#   --profile kind-tunnel / --profile prod-tunnel
#                       → pgweb variants that proxy to kind/GKE via the
#                         corresponding bin/cluster/port-forward/*.sh port-forwards.
#
# Observability (LGTM, cors-proxy, docker-proxy) lives in its own file:
#   deploy/compose/observability.yml — also profile-tagged as
#   `observability`, so you can opt into the full picture with:
#   docker compose -f docker-compose.yml -f deploy/compose/observability.yml \
#     --profile full --profile admin --profile observability up -d
# ── Usage ────────────────────────────────────────────────────────────────────
#   docker compose up -d                       → core only
#   docker compose --profile full up -d        → core + keycloak + ollama
#   docker compose --profile admin up -d       → core + browsing tools
#   docker compose --profile full --profile admin up -d   → "kitchen sink"
#   docker compose logs -f app                 → tail application logs
#
# Environment variables are loaded from .env (see .env.example for required keys).
# =============================================================================

services:

  # ---------------------------------------------------------------------------
  # PostgreSQL 17 — primary relational database
  # Schema is created by Flyway at application startup (not by Docker init scripts).
  # The healthcheck ensures the app container waits until Postgres is ready
  # before starting, preventing "Connection refused" errors on first boot.
  # ---------------------------------------------------------------------------
  db:
    image: postgres:17
    container_name: postgres-demo
    environment:
      # Credentials are injected from .env — never hardcode credentials here
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    ports:
      - "${DB_PORT}:5432"
    volumes:
      # Named volume: data persists across container restarts
      - postgres_data:/var/lib/postgresql/data
      # Init script creates the 'sonar' database for SonarQube on first start.
      # Postgres runs all *.sql files in docker-entrypoint-initdb.d/ on a fresh volume.
      - ./infra/postgres/init-sonar.sql:/docker-entrypoint-initdb.d/init-sonar.sql:ro
    healthcheck:
      # pg_isready returns exit code 0 only when Postgres is accepting connections
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ---------------------------------------------------------------------------
  # Apache Kafka (KRaft mode — no ZooKeeper)
  # Single-node broker + controller in one process.
  #
  # Listener configuration:
  #   PLAINTEXT_HOST (9092)     — accessible from the host machine
  #   PLAINTEXT_INTERNAL (29092) — used by app container (internal Docker network)
  #   CONTROLLER (9093)         — KRaft inter-broker communication (internal only)
  #
  # The healthcheck runs kafka-topics.sh to verify the broker is fully started.
  # start_period=30s accounts for KRaft startup time before health checks begin.
  # ---------------------------------------------------------------------------
  kafka:
    image: apache/kafka:4.0.0
    container_name: kafka-demo
    ports:
      - "${KAFKA_PORT:-9092}:9092"
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: broker,controller      # Combined broker+controller (single node)
      KAFKA_LISTENERS: PLAINTEXT_HOST://:9092,PLAINTEXT_INTERNAL://:29092,CONTROLLER://:9093
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT_HOST://localhost:9092,PLAINTEXT_INTERNAL://kafka:29092
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: CONTROLLER:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT,PLAINTEXT_INTERNAL:PLAINTEXT
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@localhost:9093
      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT_INTERNAL
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      # Replication factor = 1: acceptable for single-node; increase for multi-node clusters
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      # Auto-create topics: KafkaAdmin also creates them at app startup (KafkaConfig)
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
      # ACL authorizer — required to manage ACLs via Kafka UI
      # StandardAuthorizer is the KRaft-native authorizer (replaces AclAuthorizer)
      # allow.everyone.if.no.acl.found=true preserves open access (no ACL = allow all)
      KAFKA_AUTHORIZER_CLASS_NAME: org.apache.kafka.metadata.authorizer.StandardAuthorizer
      KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND: "true"
      KAFKA_SUPER_USERS: "User:ANONYMOUS"  # keep unauthenticated (PLAINTEXT) connections as super-users
    healthcheck:
      test: ["CMD-SHELL", "/opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:9092 --list"]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s    # Give KRaft time to elect a leader before health checks start

  # ---------------------------------------------------------------------------
  # Redis 7 — distributed cache for RecentCustomerBuffer
  # Replaces the in-process LinkedList so the buffer survives pod restarts and
  # is shared across all application replicas (stateless horizontal scaling).
  # Uses Redis LIST operations: LPUSH + LTRIM to maintain a capped 10-entry ring.
  # ---------------------------------------------------------------------------
  redis:
    image: redis:7
    container_name: redis-demo
    ports:
      - "6379:6379"
    healthcheck:
      # redis-cli PING returns PONG when the server is accepting connections
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  # ---------------------------------------------------------------------------
  # Ollama — local LLM runtime for Spring AI (GET /customers/{id}/bio)
  # Downloads the llama3.2 model (~2 GB) on the first start.
  # Subsequent starts reuse the cached model from the ollama_data volume.
  # Note: model download may take several minutes on first run.
  # ---------------------------------------------------------------------------
  ollama:
    profiles: ["full"]
    image: ollama/ollama:0.9.0
    container_name: ollama
    ports:
      - "11434:11434"
    volumes:
      # Persist downloaded models across container restarts (~2 GB for llama3.2)
      - ollama_data:/root/.ollama
    # serve in background, then pull the model, then keep the server running
    entrypoint: ["/bin/sh", "-c", "ollama serve & sleep 5 && ollama pull llama3.2 && wait"]

  # ---------------------------------------------------------------------------
  # Keycloak — identity provider (optional; activated by KEYCLOAK_URL env var)
  #
  # Provides OAuth2 / OIDC authentication alongside the built-in JWT mode.
  # The realm "customer-service" is auto-imported from infra/keycloak/realm-dev.json
  # on first boot via --import-realm.
  #
  # Two confidential clients use the Client Credentials grant (M2M):
  #   api-gateway         / dev-secret          → ROLE_USER + ROLE_ADMIN
  #   monitoring-service  / dev-secret-readonly  → ROLE_USER
  #
  # See infra/keycloak/README.md for the full architecture and production guidance.
  # Access the admin console at http://localhost:8888 (admin / admin).
  # Port migrated 2026-04-26 from 9090 → 8888 — 9090 conflicts with the
  # elgato-mcp host process on dev machines, and 8090 was already taken by
  # the kind ingress in this repo's docs/scripts. 8888 is well clear of
  # both ranges.
  # ---------------------------------------------------------------------------
  keycloak:
    profiles: ["full"]
    image: quay.io/keycloak/keycloak:26.2.5
    container_name: keycloak
    # --spi-realm-default-default-ssl-required=NONE overrides the persisted sslRequired
    # value on the master realm (env vars only apply to new realms, not existing ones).
    command: >
      start-dev
      --import-realm
      --spi-realm-default-default-ssl-required=NONE
    environment:
      # LOCAL DEV ONLY — these credentials are intentionally public demo values.
      # Keycloak is replaced by Auth0 in production; this container is never deployed.
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      # Disable HTTPS for local development
      KC_HTTP_ENABLED: "true"
      KC_HOSTNAME_STRICT: "false"
      KC_HOSTNAME_STRICT_HTTPS: "false"
    ports:
      - "8888:8080"
    volumes:
      # realm-dev.json (and realm-prod.json) are imported once at first startup (--import-realm flag)
      - ./infra/keycloak:/opt/keycloak/data/import
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8080/realms/customer-service || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 30s

  # ---------------------------------------------------------------------------
  # Spring Boot application
  # Built from the Dockerfile in this directory (multi-stage, layered JAR).
  # Waits for DB (healthy), Kafka (healthy), and Redis (healthy) before starting.
  # Ollama is optional — condition: service_started (not healthy) since the model
  # download can take minutes and we don't want to block app startup.
  # ---------------------------------------------------------------------------
  app:
    build: .
    container_name: spring-app
    depends_on:
      db:
        condition: service_healthy     # Must be ready before app starts (Flyway migrations run at startup)
      kafka:
        condition: service_healthy     # Must be ready before app starts (Kafka topics created at startup)
      redis:
        condition: service_healthy     # Must be ready before app starts (RecentCustomerBuffer uses Redis)
      # Ollama dropped from `depends_on` — it now lives in `profiles: ["full"]`
      # so `docker compose up` gives a fast minimal stack (cold start
      # <30 s vs. ~2 min). The Spring app handles ollama-down gracefully
      # (BioService falls back to a canned bio). Use
      # `docker compose --profile full up` to bring ollama + every dev
      # tool back.
      # Keycloak is optional — only declared if COMPOSE_PROFILES includes keycloak
      # Use: KEYCLOAK_URL=http://keycloak:8080 docker compose --profile keycloak up
    ports:
      - "${SERVER_PORT}:8080"
    environment:
      # Use the internal Docker network hostname "db" (the Compose service name, not localhost)
      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/${DB_NAME}
      SPRING_DATASOURCE_USERNAME: ${DB_USER}
      SPRING_DATASOURCE_PASSWORD: ${DB_PASSWORD}
      SPRING_JPA_HIBERNATE_DDL_AUTO: validate
      SPRING_JPA_SHOW_SQL: false
      # Use the internal Kafka listener (29092), not the host-accessible one (9092)
      KAFKA_BOOTSTRAP_SERVERS: kafka:29092
      OLLAMA_BASE_URL: http://ollama:11434
      # Redis host for the RecentCustomerBuffer (uses the service name in Docker network)
      SPRING_DATA_REDIS_HOST: redis
      # Auth0 integration — lets the backend validate JWTs issued by the
      # configured Auth0 tenant (in addition to the built-in HS256 tokens
      # from /auth/login for admin/admin). All three are required together:
      #   - AUTH0_ISSUER_URI: trailing slash mandatory, Auth0 puts it in the
      #     `iss` claim and Spring Security does a string-compare.
      #   - AUTH0_AUDIENCE: matches the API identifier registered in Auth0
      #     Dashboard → Applications → APIs (value mirrored in UI
      #     src/app/app.config.ts as AUTH0_AUDIENCE).
      #   - AUTH0_DOMAIN: informational; used by package docs + logs.
      # Without these, Auth0 JWTs fall through to HS256 validation with the
      # internal secret, fail, and the UI's authInterceptor redirects to
      # /login on 401. See docs/how-to/auth0-tenant-setup.md (UI repo) for
      # the full setup flow and why these 3 are the minimum surface.
      AUTH0_DOMAIN: dev-ksxj46zlkhk2gcvo.us.auth0.com
      AUTH0_ISSUER_URI: https://dev-ksxj46zlkhk2gcvo.us.auth0.com/
      AUTH0_AUDIENCE: https://iris-api

  # ---------------------------------------------------------------------------
  # CloudBeaver — DBeaver web edition, self-hosted SQL browser.
  #
  # Replaces pgAdmin + pgweb (see commit history). Same Eclipse-based UI as
  # the DBeaver desktop app — familiar ERD, SQL formatter, multi-connection
  # tree — but served from a Docker container so the whole team gets the
  # same tool on every OS.
  #
  # First-boot flow: open http://localhost:8978, set the admin password
  # (prompted once, stored in the named volume), then click "New Connection"
  # → the PostgreSQL JDBC driver is pre-bundled. Host = "db", port = 5432,
  # db = customer-service, user = demo, password = demo.
  #
  # The connection is NOT pre-provisioned (CloudBeaver's config JSON for
  # pre-registered servers is undocumented and fragile across minor
  # versions). Five clicks once > brittle auto-wiring broken after upgrade.
  # ---------------------------------------------------------------------------
  cloudbeaver:
    # admin profile: nice-to-have SQL browser, not part of the hot path.
    profiles: ["admin"]
    image: dbeaver/cloudbeaver:26.0.2
    container_name: cloudbeaver
    depends_on:
      db:
        condition: service_healthy
    ports:
      # Upstream default is 8978 — keep it, since DBeaver docs / community
      # bookmarks reference that port.
      - "8978:8978"
    volumes:
      - cloudbeaver_data:/opt/cloudbeaver/workspace
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # pgweb (local) — HTTP ↔ Postgres bridge for the Angular UI's Database page.
  #
  # ADR-0026: the Angular UI calls pgweb directly; Spring Boot is not in the
  # SQL path. pgweb itself speaks the Postgres wire protocol as a client
  # (connects to `db:5432`) and exposes a JSON REST API the browser can hit.
  #
  # `--readonly` rejects writes at the HTTP layer before they reach Postgres
  # (defense in depth; the `demo` PG role also has limited grants).
  # `--cors-origin=http://localhost:4200` locks the CORS allowlist to the
  # Angular dev server — no other site in the browser can call this pgweb.
  # ---------------------------------------------------------------------------
  pgweb-local:
    # admin profile: HTTP↔Postgres bridge used by the Angular Database page;
    # only needed when exercising the UI's SQL browser end-to-end locally.
    profiles: ["admin"]
    image: sosedoff/pgweb:0.16.2
    container_name: pgweb-local
    depends_on:
      db:
        condition: service_healthy
    environment:
      PGWEB_DATABASE_URL: "postgres://demo:demo@db:5432/customer-service?sslmode=disable"
    command:
      - pgweb
      - --bind=0.0.0.0
      - --listen=8081
      - --readonly
      - --cors
      - --cors-origin=http://localhost:4200
    ports:
      # Bind on 127.0.0.1 only — never exposed on the LAN even if the host
      # firewall is lax. ADR-0025 pattern applied to compose services too.
      - "127.0.0.1:8081:8081"
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # pgweb (kind) — same image, points at the KIND cluster Postgres through
  # the port-forward that bin/cluster/port-forward/kind.sh opens on localhost:15432 (kind = +10000).
  #
  # Activation:
  #   1. bin/cluster/port-forward/kind.sh --daemon        (opens localhost:15432 → kind Postgres)
  #   2. bin/cluster/pgweb/kind-up.sh            (fetches DB password from the kind Secret,
  #                                        starts this on :8082)
  # profile `kind-tunnel` keeps it off when you are not using kind.
  # ---------------------------------------------------------------------------
  pgweb-kind:
    image: sosedoff/pgweb:0.16.2
    container_name: pgweb-kind
    profiles: ["kind-tunnel"]
    environment:
      PGWEB_DATABASE_URL: "postgres://demo:${PGWEB_DB_PASSWORD:-}@host.docker.internal:15432/customer-service?sslmode=disable"
    command: [pgweb, --bind=0.0.0.0, --listen=8081, --readonly, --cors, --cors-origin=http://localhost:4200]
    ports:
      - "127.0.0.1:8082:8081"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # pgweb (prod tunnel) — same image, points at the GKE cluster Postgres
  # through the port-forward that bin/cluster/port-forward/prod.sh opens on localhost:25432
  # (prod = +20000).
  #
  # Activation:
  #   1. bin/cluster/port-forward/prod.sh --daemon        (opens localhost:25432 → GKE Postgres)
  #   2. bin/cluster/pgweb/prod-up.sh            (fetches DB password from GSM via ESO,
  #                                        starts this on :8083)
  # profile `prod-tunnel` keeps it off unless explicitly activated.
  # ---------------------------------------------------------------------------
  pgweb-prod:
    image: sosedoff/pgweb:0.16.2
    container_name: pgweb-prod
    profiles: ["prod-tunnel"]
    environment:
      PGWEB_DATABASE_URL: "postgres://demo:${PGWEB_DB_PASSWORD:-}@host.docker.internal:25432/customer-service?sslmode=disable"
    command: [pgweb, --bind=0.0.0.0, --listen=8081, --readonly, --cors, --cors-origin=http://localhost:4200]
    ports:
      - "127.0.0.1:8083:8081"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Kafka UI — web interface for Apache Kafka
  # Browse topics, messages, consumer groups, and lag in real time.
  # Connects to the internal Kafka listener (29092) on the Docker network.
  # Access: http://localhost:9080
  # ---------------------------------------------------------------------------
  kafka-ui:
    # admin profile: web UI to inspect topics/consumers, rarely needed
    # on a fresh clone where the app boots against empty topics.
    profiles: ["admin"]
    image: provectuslabs/kafka-ui:v0.7.2
    container_name: kafka-ui
    depends_on:
      kafka:
        condition: service_healthy
    environment:
      KAFKA_CLUSTERS_0_NAME: local
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka:29092
    ports:
      - "9080:8080"
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # RedisInsight — Redis data browser and CLI
  # Visual explorer for keys, types, TTLs, and memory usage.
  # On first launch, add the connection manually: host=redis, port=6379.
  # Access: http://localhost:5540
  # ---------------------------------------------------------------------------
  redisinsight:
    # admin profile: Redis key browser, only useful when debugging caches.
    profiles: ["admin"]
    image: redis/redisinsight:2.68.0
    container_name: redisinsight
    depends_on:
      redis:
        condition: service_healthy
    ports:
      - "5540:5540"
    volumes:
      - redisinsight_data:/data
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Redis Commander — lightweight Redis web UI with live monitoring
  # Alternative to RedisInsight — smaller footprint, auto-connects, shows
  # real-time command stream. Useful for watching idempotency keys and rate
  # limit buckets change in real time.
  # Access: http://localhost:8082
  # ---------------------------------------------------------------------------
  redis-commander:
    # admin profile: alternative Redis UI with live command stream; kept
    # alongside redisinsight for contributors who prefer the lighter tool.
    profiles: ["admin"]
    image: rediscommander/redis-commander:0.8.1
    container_name: redis-commander
    depends_on:
      redis:
        condition: service_healthy
    environment:
      REDIS_HOSTS: "local:redis:6379"
    ports:
      - "8082:8081"
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Maven Site Server — serves the generated Maven quality reports as a
  # standalone static web site, independent of the Spring Boot backend.
  #
  # Why independent?
  #   The Maven site is regenerated by the daily CI schedule (generate-reports job
  #   with REPORT_PIPELINE=true). Serving it via nginx decouples the report lifecycle
  #   from the application lifecycle — the site stays up even when the backend
  #   restarts, and report data is frozen at the last CI run (no live updates).
  #
  # How to populate target/site/ locally before starting this container:
  #   ./run.sh site                  (generates reports + starts this container)
  # Or manually:
  #   mvn verify && mvn site
  #   docker compose up -d maven-site
  #
  # Access: http://localhost:8084
  # ---------------------------------------------------------------------------
  maven-site:
    # docs profile: local static-site server for Maven-generated quality
    # reports. Only relevant when reviewing reports locally (normally
    # consumed via the CI-published `reports/` branch).
    profiles: ["docs"]
    image: nginx:1.27-alpine
    container_name: maven-site
    volumes:
      # Mount the local Maven-generated site directory (populated by `mvn site post-site`).
      # In production, mount the path where the reports/ branch is checked out.
      - ./target/site:/usr/share/nginx/html:ro
      - ./infra/nginx/maven-site.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "8084:80"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:80/index.html"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 5s

  sonarqube:
    # admin profile: SonarQube dashboard — heavyweight (Elasticsearch,
    # ~1 GB RAM) and only needed when analysing a branch locally rather
    # than via CI.
    profiles: ["admin"]
    # SonarQube Community Edition — static analysis dashboard for Java + TypeScript.
    # Free, self-hosted, no branch analysis (Community limitation — one branch per project).
    # First startup: visit http://localhost:9000, login admin/admin, change password,
    # generate a project token, then set SONAR_TOKEN in .env.
    # Analysis: mvn verify sonar:sonar  OR  ./run.sh sonar
    image: sonarqube:community
    container_name: sonarqube
    depends_on:
      db:
        condition: service_healthy
    environment:
      SONAR_JDBC_URL: jdbc:postgresql://db:5432/sonar
      SONAR_JDBC_USERNAME: sonar
      SONAR_JDBC_PASSWORD: sonar
      # Note: force-authentication is disabled via the SonarQube settings API (persisted in
      # the sonarqube_data volume). This allows anonymous read access for local dev.
      # To reconfigure on a fresh volume: run `./run.sh sonar-setup` or manually call:
      #   curl -X POST -u admin:admin http://localhost:9000/api/settings/set \
      #     -d "key=sonar.forceAuthentication&value=false"
    ports:
      - "9000:9000"
    volumes:
      - sonarqube_data:/opt/sonarqube/data
      - sonarqube_extensions:/opt/sonarqube/extensions
      - sonarqube_logs:/opt/sonarqube/logs
    ulimits:
      # SonarQube uses Elasticsearch internally which requires raised file descriptor limits
      nofile:
        soft: 131072
        hard: 131072
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:9000/api/system/status || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 120s

  compodoc:
    # docs profile: Angular API reference (Compodoc) — static-site only,
    # mirrors the maven-site role for the UI side.
    profiles: ["docs"]
    # Angular API reference generated by Compodoc (npm run compodoc in iris-ui).
    # Serves the same role as Javadoc for the backend — components, services, interfaces,
    # routes and their JSDoc descriptions browseable at http://localhost:8086.
    # Generate: cd ../../js/iris-ui && npm run compodoc    (relative to this file)
    # The bind mount path assumes iris-ui is at ../../js/iris-ui relative to this file.
    image: nginx:1.27-alpine
    container_name: compodoc
    volumes:
      - ../../js/iris-ui/docs/compodoc:/usr/share/nginx/html:ro
      - ./infra/nginx/compodoc.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "8086:80"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:80/index.html"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 5s

volumes:
  # Named volumes persist across "docker compose down" (use "docker compose down -v" to delete)
  postgres_data:
  ollama_data:
  cloudbeaver_data:
  redisinsight_data:
  sonarqube_data:
  sonarqube_extensions:
  sonarqube_logs: