---
# Ports `8080` for relayer server, `6379`for redis server.
services:
  relayer:
    image: openzeppelin/openzeppelin-relayer:latest
    build:
      context: .
      dockerfile: ${DOCKERFILE:-Dockerfile.development}
    ports:
      - 8080:8080/tcp
    secrets:
      - api_key
      - keystore_passphrase
      - webhook_signing_key
    environment:
      APP_PORT: ${APP_PORT:-8080}
      METRICS_PORT: ${METRICS_PORT:-8081}
      REDIS_URL: redis://redis:6379
      RATE_LIMIT_REQUESTS_PER_SECOND: ${RATE_LIMIT_REQUESTS_PER_SECOND:-10}
      RATE_LIMIT_BURST: ${RATE_LIMIT_BURST:-30}
      METRICS_ENABLED: ${METRICS_ENABLED:-false}
      # Pipeline runtime / HTTP worker sizing. Pin these to the container's vCPU quota
      # (NOT host cores) — auto-detection returns host cores on AWS Fargate (cpu.shares).
      # ACTIX_WORKERS + TOKIO_WORKER_THREADS should be <= the allocated vCPU. Unset =
      # auto (actix = vcpu/2, tokio = remainder).
      TOKIO_WORKER_THREADS: ${TOKIO_WORKER_THREADS:-}
      ACTIX_WORKERS: ${ACTIX_WORKERS:-}
      WEBHOOK_SIGNING_KEY: ${WEBHOOK_SIGNING_KEY:-/dev/null}
      KEYSTORE_PASSPHRASE: ${KEYSTORE_PASSPHRASE:-/dev/null}
      API_KEY: ${API_KEY}
      # Options: trace, debug, info, warn, error
      # Default: info
      LOG_LEVEL: ${LOG_LEVEL:-info}
      # Options: stdout, file
      # Default: stdout
      LOG_MODE: ${LOG_MODE:-stdout}
      # Only used if LOG_MODE is file
      # Default: 1GB (1073741824 bytes)
      LOG_MAX_SIZE: ${LOG_MAX_SIZE:-1073741824}
      IN_DOCKER: 'true'
    depends_on:
      - redis
    restart: on-failure:5
    mem_swappiness: 0
    security_opt:
      - no-new-privileges
    volumes:
      - ${CONFIG_DIR:-./config}:/app/config/:ro
      # Default: writes to stdout/console
      - ${LOGS_DATA_DIR:-./logs}:/app/logs
    networks:
      - relayer-network
      - metrics-network
  redis:
    image: redis:bookworm
    security_opt:
      - no-new-privileges
    volumes:
      - redis_data:/data
    command:
      - redis-server
      - --appendonly
      - 'yes'
      - --save
      - '60'
      - '1'
    networks:
      - relayer-network
      - metrics-network
    restart: on-failure:5
  redis-exporter:
    image: oliver006/redis_exporter:v1.67.0
    environment:
      - REDIS_ADDR=redis://redis:6379
    security_opt:
      - no-new-privileges
    profiles:
      - metrics
    depends_on:
      - redis
    networks:
      - metrics-network
    restart: on-failure:5
  prometheus:
    image: prom/prometheus:v3.1.0
    security_opt:
      - no-new-privileges
    command: --log.level=warn --config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/prometheus --storage.tsdb.retention.time=30d --web.console.libraries=/usr/share/prometheus/console_libraries --web.console.templates=/usr/share/prometheus/consoles
    ports:
      - 9090:9090/tcp
    networks:
      - metrics-network
      - relayer-network
    volumes:
      - ./cmd/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
    restart: on-failure:5
    profiles:
      - metrics
  grafana:
    image: grafana/grafana:11.5.1
    security_opt:
      - no-new-privileges
    ports:
      - 3000:3000/tcp
    networks:
      - metrics-network
      - relayer-network
    volumes:
      - ./cmd/prometheus/grafana.ini:/etc/grafana/grafana.ini
      - ./cmd/prometheus/datasources:/etc/grafana/provisioning/datasources
      - ./cmd/prometheus/dashboards:/etc/grafana/provisioning/dashboards
    restart: on-failure:5
    profiles:
      - metrics
networks:
  metrics-network:
    internal: true
  relayer-network:
    driver: bridge
volumes:
  redis_data:
    driver: local
secrets:
  api_key:
    environment: API_KEY
  webhook_signing_key:
    environment: WEBHOOK_SIGNING_KEY
  keystore_passphrase:
    environment: KEYSTORE_PASSPHRASE