docker-compose.yml

services:
  mysql:
    image: mysql:8.4
    container_name: mysql
    environment:
      MYSQL_DATABASE: channel_db
      MYSQL_USER: ${MYSQL_USER:-fix}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-fix}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-root}
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -u${MYSQL_USER:-fix} -p${MYSQL_PASSWORD:-fix}"]
      interval: 5s
      timeout: 3s
      retries: 20
    volumes:
      - mysql-data:/var/lib/mysql
      - ./docker/mysql/init:/docker-entrypoint-initdb.d:ro
    networks:
      - fix-net

  mysql-grant-repair:
    image: mysql:8.4
    container_name: mysql-grant-repair
    restart: "no"
    depends_on:
      mysql:
        condition: service_healthy
    environment:
      MYSQL_HOST: mysql
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-root}
      MYSQL_USER: ${MYSQL_USER:-fix}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-fix}
    entrypoint: ["/bin/sh", "/bootstrap/repair-service-databases.sh"]
    volumes:
      - ./scripts/infra-bootstrap/repair-service-databases.sh:/bootstrap/repair-service-databases.sh:ro
    networks:
      - fix-net

  redis:
    image: redis:7.2-alpine
    container_name: redis
    command: ["redis-server", "--appendonly", "yes"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20
    volumes:
      - redis-data:/data
    networks:
      - fix-net

  redis-recovery-probe:
    image: curlimages/curl:8.12.1
    profiles:
      - ops-drills
    command: ["sh", "-c", "sleep infinity"]
    networks:
      - fix-net

  prometheus:
    image: prom/prometheus:v3.3.1
    container_name: prometheus
    profiles:
      - observability
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--web.enable-lifecycle"
    depends_on:
      channel-service:
        condition: service_healthy
      corebank-service:
        condition: service_healthy
      fep-gateway:
        condition: service_healthy
      fep-simulator:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:9090/-/healthy"]
      interval: 10s
      timeout: 5s
      retries: 20
    ports:
      - "127.0.0.1:9090:9090"
    volumes:
      - prometheus-data:/prometheus
      - ./docker/observability/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    networks:
      - fix-net

  grafana:
    image: grafana/grafana-oss:11.6.2
    container_name: grafana
    profiles:
      - observability
    depends_on:
      prometheus:
        condition: service_healthy
    environment:
      GF_SECURITY_ADMIN_USER: ${OBSERVABILITY_GRAFANA_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${OBSERVABILITY_GRAFANA_ADMIN_PASSWORD:-admin}
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1:3000/api/health >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20
    ports:
      - "127.0.0.1:3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./docker/observability/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./docker/observability/grafana/dashboards:/var/lib/grafana/dashboards:ro
    networks:
      - fix-net

  vault:
    image: hashicorp/vault:1.15
    container_name: vault
    profiles:
      - local-vault
    cap_add:
      - IPC_LOCK
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: ${VAULT_DEV_ROOT_TOKEN_ID:?VAULT_DEV_ROOT_TOKEN_ID must be provided}
    command: ["server", "-dev", "-dev-root-token-id=${VAULT_DEV_ROOT_TOKEN_ID:?VAULT_DEV_ROOT_TOKEN_ID must be provided}", "-dev-listen-address=0.0.0.0:8200"]
    healthcheck:
      test: ["CMD-SHELL", "VAULT_ADDR=http://127.0.0.1:8200 VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:?VAULT_DEV_ROOT_TOKEN_ID must be provided} vault status >/dev/null 2>&1"]
      interval: 5s
      timeout: 3s
      retries: 30
    volumes:
      - vault-data:/vault/file
    networks:
      - fix-net

  vault-init:
    image: hashicorp/vault:1.15
    container_name: vault-init
    profiles:
      - local-vault
    depends_on:
      vault:
        condition: service_healthy
    restart: "no"
    environment:
      VAULT_ADDR: ${VAULT_ADDR:-http://vault:8200}
      VAULT_TOKEN: ${VAULT_DEV_ROOT_TOKEN_ID:?VAULT_DEV_ROOT_TOKEN_ID must be provided}
      INTERNAL_SECRET_BOOTSTRAP: ${INTERNAL_SECRET_BOOTSTRAP:?INTERNAL_SECRET_BOOTSTRAP must be provided}
      GITHUB_OIDC_DISCOVERY_URL: ${GITHUB_OIDC_DISCOVERY_URL:-https://token.actions.githubusercontent.com}
      GITHUB_OIDC_ISSUER: ${GITHUB_OIDC_ISSUER:-https://token.actions.githubusercontent.com}
      GITHUB_OIDC_AUDIENCE: ${GITHUB_OIDC_AUDIENCE:-https://github.com/DoYouLikeFIx}
      GITHUB_REPOSITORY_BOUND: ${GITHUB_REPOSITORY_BOUND:-DoYouLikeFIx/FIXYZ}
      GITHUB_JOB_WORKFLOW_REF_GLOB: ${GITHUB_JOB_WORKFLOW_REF_GLOB:-DoYouLikeFIx/FIXYZ/.github/workflows/docs-publish.yml@*}
      VAULT_AUDIT_LOG_PATH: ${VAULT_AUDIT_LOG_PATH:-/vault/file/audit.log}
      VAULT_RUNTIME_ROLE: ${VAULT_RUNTIME_ROLE:-runtime-core-services}
      VAULT_ROTATION_ROLE: ${VAULT_ROTATION_ROLE:-ops-rotate-internal-secret}
    entrypoint: ["/bin/sh", "/vault/bootstrap/init/vault-bootstrap.sh"]
    volumes:
      - vault-data:/vault/file
      - ./docker/vault:/vault/bootstrap:ro
    networks:
      - fix-net

  corebank-service:
    container_name: corebank-service
    build:
      context: ./BE
      dockerfile: Dockerfile
      args:
        SERVICE_MODULE: corebank-service
    environment:
      CORE_DB_URL: jdbc:mysql://mysql:3306/core_db?createDatabaseIfNotExist=true&useSSL=false&allowPublicKeyRetrieval=true
      CORE_DB_USERNAME: ${MYSQL_USER:-fix}
      CORE_DB_PASSWORD: ${MYSQL_PASSWORD:-fix}
      MANAGEMENT_HEALTH_DB_ENABLED: "false"
      COREBANK_PROVISIONING_DEFAULT_CASH_BALANCE: ${COREBANK_PROVISIONING_DEFAULT_CASH_BALANCE:-100000000.0000}
      COREBANK_MARKET_DATA_QUOTE_SOURCE_MODE: ${COREBANK_MARKET_DATA_QUOTE_SOURCE_MODE:-REPLAY}
      COREBANK_MARKET_DATA_MAX_QUOTE_AGE_MS: ${COREBANK_MARKET_DATA_MAX_QUOTE_AGE_MS:-31536000000}
      FEP_GATEWAY_BASE_URL: http://fep-gateway:8083
      INTERNAL_SECRET: ${INTERNAL_SECRET:?INTERNAL_SECRET must be provided from Vault}
      COREBANK_MANAGEMENT_ADDRESS: 0.0.0.0
    depends_on:
      mysql:
        condition: service_healthy
      mysql-grant-repair:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:19081/actuator/health >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20
    networks:
      - fix-net

  fep-gateway:
    container_name: fep-gateway
    build:
      context: ./BE
      dockerfile: Dockerfile
      args:
        SERVICE_MODULE: fep-gateway
    environment:
      FEP_GATEWAY_DB_URL: jdbc:mysql://mysql:3306/fep_gateway_db?createDatabaseIfNotExist=true&useSSL=false&allowPublicKeyRetrieval=true
      FEP_GATEWAY_DB_USERNAME: ${MYSQL_USER:-fix}
      FEP_GATEWAY_DB_PASSWORD: ${MYSQL_PASSWORD:-fix}
      MANAGEMENT_HEALTH_DB_ENABLED: "false"
      FEP_MARKETDATA_PROVIDER: ${FEP_MARKETDATA_PROVIDER:-REPLAY}
      FEP_MARKETDATA_SOURCE_MODE: ${FEP_MARKETDATA_SOURCE_MODE:-REPLAY}
      FEP_MARKETDATA_KIS_ENV: ${FEP_MARKETDATA_KIS_ENV:-paper}
      FEP_MARKETDATA_KIS_APP_KEY: ${FEP_MARKETDATA_KIS_APP_KEY:-}
      FEP_MARKETDATA_KIS_APP_SECRET: ${FEP_MARKETDATA_KIS_APP_SECRET:-}
      FEP_MARKETDATA_KIS_WS_TR_ID: ${FEP_MARKETDATA_KIS_WS_TR_ID:-H0STCNT0}
      FEP_MARKETDATA_KIS_WS_CUSTTYPE: ${FEP_MARKETDATA_KIS_WS_CUSTTYPE:-P}
      FEP_MARKETDATA_KIS_SYMBOLS: ${FEP_MARKETDATA_KIS_SYMBOLS:-005930}
      INTERNAL_SECRET: ${INTERNAL_SECRET:?INTERNAL_SECRET must be provided from Vault}
      FEP_GATEWAY_MANAGEMENT_ADDRESS: 0.0.0.0
    depends_on:
      corebank-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:18083/actuator/health >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20
    networks:
      - fix-net

  fep-simulator:
    container_name: fep-simulator
    build:
      context: ./BE
      dockerfile: Dockerfile
      args:
        SERVICE_MODULE: fep-simulator
    environment:
      FEP_SIMULATOR_DB_URL: jdbc:mysql://mysql:3306/fep_simulator_db?createDatabaseIfNotExist=true&useSSL=false&allowPublicKeyRetrieval=true
      FEP_SIMULATOR_DB_USERNAME: ${MYSQL_USER:-fix}
      FEP_SIMULATOR_DB_PASSWORD: ${MYSQL_PASSWORD:-fix}
      MANAGEMENT_HEALTH_DB_ENABLED: "false"
      INTERNAL_SECRET: ${INTERNAL_SECRET:?INTERNAL_SECRET must be provided from Vault}
      FEP_SIMULATOR_MANAGEMENT_ADDRESS: 0.0.0.0
    depends_on:
      fep-gateway:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:18082/actuator/health >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20
    networks:
      - fix-net

  channel-service:
    container_name: channel-service
    build:
      context: ./BE
      dockerfile: Dockerfile
      args:
        SERVICE_MODULE: channel-service
    environment:
      CHANNEL_DB_URL: jdbc:mysql://mysql:3306/channel_db?createDatabaseIfNotExist=true&useSSL=false&allowPublicKeyRetrieval=true
      CHANNEL_DB_USERNAME: ${MYSQL_USER:-fix}
      CHANNEL_DB_PASSWORD: ${MYSQL_PASSWORD:-fix}
      MANAGEMENT_HEALTH_DB_ENABLED: "false"
      SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE: ${CHANNEL_HIKARI_MAXIMUM_POOL_SIZE:-48}
      SPRING_DATASOURCE_HIKARI_MINIMUM_IDLE: ${CHANNEL_HIKARI_MINIMUM_IDLE:-8}
      SPRING_DATASOURCE_HIKARI_CONNECTION_TIMEOUT: ${CHANNEL_HIKARI_CONNECTION_TIMEOUT:-60000}
      SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-false}
      AUTH_PASSWORD_RECOVERY_CHALLENGE_V2_ENABLED: ${AUTH_PASSWORD_RECOVERY_CHALLENGE_V2_ENABLED:-false}
      AUTH_PASSWORD_RECOVERY_CHALLENGE_COHORT_PERCENTAGE: ${AUTH_PASSWORD_RECOVERY_CHALLENGE_COHORT_PERCENTAGE:-0}
      AUTH_PASSWORD_RECOVERY_CHALLENGE_DETERMINISTIC_OVERRIDE_ENABLED: ${AUTH_PASSWORD_RECOVERY_CHALLENGE_DETERMINISTIC_OVERRIDE_ENABLED:-false}
      AUTH_PASSWORD_RECOVERY_CHALLENGE_DETERMINISTIC_OVERRIDE_HEADER: ${AUTH_PASSWORD_RECOVERY_CHALLENGE_DETERMINISTIC_OVERRIDE_HEADER:-X-Fixyz-Recovery-Challenge-Mode}
      AUTH_PASSWORD_RECOVERY_FORGOT_IP_MAX_ATTEMPTS: ${AUTH_PASSWORD_RECOVERY_FORGOT_IP_MAX_ATTEMPTS:-5}
      AUTH_PASSWORD_RECOVERY_FORGOT_EMAIL_MAX_ATTEMPTS: ${AUTH_PASSWORD_RECOVERY_FORGOT_EMAIL_MAX_ATTEMPTS:-3}
      AUTH_PASSWORD_RECOVERY_FORGOT_MAIL_COOLDOWN: ${AUTH_PASSWORD_RECOVERY_FORGOT_MAIL_COOLDOWN:-5m}
      AUTH_PASSWORD_RECOVERY_CHALLENGE_IP_MAX_ATTEMPTS: ${AUTH_PASSWORD_RECOVERY_CHALLENGE_IP_MAX_ATTEMPTS:-5}
      AUTH_PASSWORD_RECOVERY_CHALLENGE_EMAIL_MAX_ATTEMPTS: ${AUTH_PASSWORD_RECOVERY_CHALLENGE_EMAIL_MAX_ATTEMPTS:-3}
      AUTH_PASSWORD_RECOVERY_CHALLENGE_GLOBAL_MAX_ATTEMPTS: ${AUTH_PASSWORD_RECOVERY_CHALLENGE_GLOBAL_MAX_ATTEMPTS:-60}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      COREBANK_INTERNAL_BASE_URL: http://corebank-service:8081
      INTERNAL_SECRET: ${INTERNAL_SECRET:?INTERNAL_SECRET must be provided from Vault}
      OBSERVABILITY_PROMETHEUS_BASE_URL: ${OBSERVABILITY_PROMETHEUS_BASE_URL:-http://prometheus:9090}
      CHANNEL_MANAGEMENT_ADDRESS: 0.0.0.0
    depends_on:
      corebank-service:
        condition: service_healthy
      fep-gateway:
        condition: service_healthy
      fep-simulator:
        condition: service_healthy
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy
    ports:
      - "8080:8080"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:18080/actuator/health >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20
    networks:
      - fix-net

  edge-gateway:
    container_name: edge-gateway
    build:
      context: ./docker/nginx
      dockerfile: Dockerfile
    environment:
      EDGE_SERVER_NAME: ${EDGE_SERVER_NAME:-localhost}
      EDGE_TLS_CERT_PATH: /etc/nginx/certs/tls.crt
      EDGE_TLS_KEY_PATH: /etc/nginx/certs/tls.key
      CHANNEL_SERVICE_HOST: channel-service
      CHANNEL_SERVICE_PORT: 8080
      COREBANK_SERVICE_HOST: corebank-service
      COREBANK_SERVICE_PORT: 8081
      FEP_GATEWAY_HOST: fep-gateway
      FEP_GATEWAY_PORT: 8083
      FEP_SIMULATOR_HOST: fep-simulator
      FEP_SIMULATOR_PORT: 8082
    depends_on:
      channel-service:
        condition: service_healthy
      corebank-service:
        condition: service_healthy
      fep-gateway:
        condition: service_healthy
      fep-simulator:
        condition: service_healthy
    ports:
      - "80:80"
      - "443:443"
    healthcheck:
      test: ["CMD-SHELL", "curl -k -fsS https://localhost/health/channel >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20
    volumes:
      - edge-certs:/etc/nginx/certs
    networks:
      - fix-net

volumes:
  mysql-data:
  redis-data:
  vault-data:
  edge-certs:
  prometheus-data:
  grafana-data:

networks:
  fix-net:
    driver: bridge