services:
  edge:
    build:
      context: .
      dockerfile: edge/docker/Dockerfile
    image: localhost/pxxl-edge:local
    container_name: pxxl-proxy-edge
    restart: unless-stopped
    environment:
      PXXL_CONFIG: /app/config/pxxl.toml
      PXXL_ADMIN_ADDR: 0.0.0.0:8081
      PXXL_METRICS_ADDR: 0.0.0.0:9090
      PXXL_ADMIN_EMAIL: ${PXXL_ADMIN_EMAIL:-}
      PXXL_ADMIN_PASSWORD_HASH: ${PXXL_ADMIN_PASSWORD_HASH:-}
      PXXL_ADMIN_BOOTSTRAP_TOKEN: ${PXXL_ADMIN_BOOTSTRAP_TOKEN:-}
      PXXL_ADMIN_BOOTSTRAP_TOKEN_PERMANENT: ${PXXL_ADMIN_BOOTSTRAP_TOKEN_PERMANENT:-false}
      PXXL_ADMIN_IP_ALLOWLIST: ${PXXL_ADMIN_IP_ALLOWLIST:-}
      PXXL_METRICS_BEARER_TOKEN: ${PXXL_METRICS_BEARER_TOKEN:-}
      PXXL_DOCKER_ENABLED: ${PXXL_DOCKER_ENABLED:-false}
      PXXL_PODMAN_ENABLED: ${PXXL_PODMAN_ENABLED:-false}
      PXXL_ALLOW_HOST_GATEWAY_UPSTREAMS: ${PXXL_ALLOW_HOST_GATEWAY_UPSTREAMS:-false}
      PXXL_ALLOW_PRIVATE_UPSTREAMS: ${PXXL_ALLOW_PRIVATE_UPSTREAMS:-true}
      PXXL_ACME_CHALLENGE_DIR: ${PXXL_ACME_CHALLENGE_DIR:-/data/acme-challenges}
      PXXL_ROUTE_SNAPSHOT_PATH: ${PXXL_ROUTE_SNAPSHOT_PATH:-/data/routes/routes.snapshot.json}
      PXXL_STATIC_LOCAL_CERT: ${PXXL_STATIC_LOCAL_CERT:-}
      PXXL_STATIC_LOCAL_KEY: ${PXXL_STATIC_LOCAL_KEY:-}
      PXXL_DATABASE_PROXY_ENABLED: ${PXXL_DATABASE_PROXY_ENABLED:-false}
      PXXL_DATABASE_PROXY_PUBLIC_BIND_HOST: ${PXXL_DATABASE_PROXY_PUBLIC_BIND_HOST:-0.0.0.0}
      PXXL_DATABASE_PROXY_PUBLIC_PORT_RANGE: ${PXXL_DATABASE_PROXY_PUBLIC_PORT_RANGE:-25000-40000}
      PXXL_TRUSTED_CLIENT_IP_CIDRS: ${PXXL_TRUSTED_CLIENT_IP_CIDRS:-10.88.0.0/16,10.89.0.0/16,127.0.0.1/32,::1/128}
      PXXL_GATEWAY_API_URL: ${PXXL_GATEWAY_API_URL:-}
      PXXL_RUNTIME_DIAGNOSTICS_URL: ${PXXL_RUNTIME_DIAGNOSTICS_URL:-}
      PXXL_PROXY_DIAGNOSTICS_TOKEN: ${PXXL_PROXY_DIAGNOSTICS_TOKEN:-}
      PXXL_RUNTIME_DIAGNOSTICS_TIMEOUT_MS: ${PXXL_RUNTIME_DIAGNOSTICS_TIMEOUT_MS:-800}
      RUST_LOG: pxxl_edge=info,pxxl=info
    ports:
      - "80:80"
      - "443:443"
      - "${PXXL_PROXY_ADMIN_BIND_ADDR:-127.0.0.1}:8081:8081"
      - "${PXXL_PROXY_METRICS_BIND_ADDR:-127.0.0.1}:9090:9090"
      - "${PXXL_DATABASE_PROXY_PUBLIC_BIND_HOST:-0.0.0.0}:${PXXL_DATABASE_PROXY_PUBLIC_PORT_RANGE:-25000-40000}:${PXXL_DATABASE_PROXY_PUBLIC_PORT_RANGE:-25000-40000}"
    volumes:
      - ./config:/app/config:ro
      - ./data:/data
    networks:
      - default
      - frontend_default
      - gateway_default
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    mem_limit: 15g
    cpus: "${PXXL_EDGE_CPUS:-4.0}"
    healthcheck:
      test: ["CMD-SHELL", "test -x /usr/local/bin/pxxl-edge"]
      interval: 30s
      timeout: 5s
      retries: 3
    depends_on:
      - redis
      - postgres
      - clickhouse

  redis:
    image: docker.io/library/redis:7-alpine
    container_name: pxxl-proxy-redis
    restart: unless-stopped
    command: redis-server --appendonly yes
    volumes:
      - ./data/redis:/data

  postgres:
    image: docker.io/library/postgres:16-alpine
    container_name: pxxl-proxy-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: pxxl
      POSTGRES_PASSWORD: pxxl
      POSTGRES_DB: pxxl
    volumes:
      - ./data/postgres:/var/lib/postgresql/data

  clickhouse:
    image: docker.io/clickhouse/clickhouse-server:24.8
    container_name: pxxl-proxy-clickhouse
    restart: unless-stopped
    environment:
      CLICKHOUSE_DB: pxxl
      CLICKHOUSE_USER: pxxl
      CLICKHOUSE_PASSWORD: pxxl
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
    ports:
      - "${PXXL_PROXY_CLICKHOUSE_BIND_ADDR:-127.0.0.1}:18124:8123"
    volumes:
      - ./data/clickhouse:/var/lib/clickhouse

  prometheus:
    image: docker.io/prom/prometheus:v2.55.0
    container_name: pxxl-proxy-prometheus
    restart: unless-stopped
    ports:
      - "127.0.0.1:9091:9090"
    volumes:
      - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./data/prometheus:/prometheus
    depends_on:
      - edge

  loki:
    image: docker.io/grafana/loki:3.2.0
    container_name: pxxl-proxy-loki
    restart: unless-stopped
    command: -config.file=/etc/loki/local-config.yaml
    volumes:
      - ./monitoring/loki/loki-config.yml:/etc/loki/local-config.yaml:ro
      - ./data/loki:/loki

  promtail:
    image: docker.io/grafana/promtail:3.2.0
    container_name: pxxl-proxy-promtail
    profiles:
      - runtime-discovery
    restart: unless-stopped
    command: -config.file=/etc/promtail/config.yml
    volumes:
      - ./monitoring/promtail/promtail-config.yml:/etc/promtail/config.yml:ro
      - ${PXXL_PROMTAIL_SOCKET:-/dev/null}:/var/run/docker.sock:ro
    depends_on:
      - loki

  grafana:
    image: docker.io/grafana/grafana:11.2.0
    container_name: pxxl-proxy-grafana
    restart: unless-stopped
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?set GRAFANA_ADMIN_PASSWORD}
    ports:
      - "127.0.0.1:${GRAFANA_PORT:-13000}:3000"
    volumes:
      - ./data/grafana:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
    depends_on:
      - prometheus
      - loki

networks:
  default: {}
  frontend_default:
    external: true
  gateway_default:
    external: true