services:
  postgres:
    image: pgvector/pgvector:pg17
    ports:
      - '${PG_HOST_PORT:-5433}:5432'
    environment:
      POSTGRES_USER: mosaic
      POSTGRES_PASSWORD: mosaic
      POSTGRES_DB: mosaic
    volumes:
      - pg_data:/var/lib/postgresql/data
      - ./infra/pg-init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U mosaic']
      interval: 5s
      timeout: 3s
      retries: 5

  valkey:
    image: valkey/valkey:8-alpine
    ports:
      - '${VALKEY_HOST_PORT:-6380}:6379'
    volumes:
      - valkey_data:/data
    healthcheck:
      test: ['CMD', 'valkey-cli', 'ping']
      interval: 5s
      timeout: 3s
      retries: 5

  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.100.0
    ports:
      - '4317:4317' # OTLP gRPC
      - '4318:4318' # OTLP HTTP
    volumes:
      - ./infra/otel-collector.yml:/etc/otelcol-contrib/config.yaml:ro
    depends_on:
      jaeger:
        condition: service_started

  jaeger:
    image: jaegertracing/jaeger:2.6.0
    ports:
      - '16686:16686' # Jaeger UI
      - '4319:4317' # Jaeger OTLP gRPC (internal, collector forwards here)
    environment:
      COLLECTOR_OTLP_ENABLED: 'true'


  gateway:
    # Standalone-tier application service (compose `stack` profile).
    # Default image = local build of docker/gateway.Dockerfile (works with
    # no registry auth); override GATEWAY_IMAGE to a CI-published sha tag
    # for registry deploys (git.mosaicstack.dev/mosaicstack/stack/gateway:sha-XXXXXXX).
    profiles: [stack]
    image: ${GATEWAY_IMAGE:-mosaic-gateway:dev}
    build:
      context: .
      dockerfile: docker/gateway.Dockerfile
    ports:
      - '${GATEWAY_HOST_PORT:-14242}:14242'
    environment:
      GATEWAY_PORT: '14242'
      DATABASE_URL: postgresql://mosaic:mosaic@postgres:5432/mosaic
      VALKEY_URL: valkey://valkey:6379
      # The compose IS the standalone tier by declaration (mode contract:
      # mode chosen at install); pinning skips cross-container probe races.
      MOSAIC_STORAGE_TIER: standalone
      # Standalone-tier secrets: generated at install (see .env.example).
      # Enterprise tier replaces these with Vault/Openbao plumbing.
      BETTER_AUTH_SECRET: '${BETTER_AUTH_SECRET:?set in .env — openssl rand -hex 32}'
    volumes:
      - gateway_workspaces:/opt/mosaic/.workspaces
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
    healthcheck:
      test: ['CMD-SHELL', 'wget -qO- http://127.0.0.1:14242/health || exit 1']
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s

volumes:
  gateway_workspaces:
  pg_data:
  valkey_data: