compose.yaml

name: moderate

services:
  caddy:
    image: caddy:2.11.7-alpine
    restart: unless-stopped
    # Resolve service names without the host's DNS search suffix.
    dns_search: .
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    environment:
      DOMAIN: ${DOMAIN}
    volumes:
      - ./config/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    networks:
      default:
        aliases:
          - keycloak.${DOMAIN}
          - api.gw.${DOMAIN}
          - s3.${DOMAIN}

  postgres:
    image: postgis/postgis:15-3.5-alpine
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      KEYCLOAK_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
      OPENMETADATA_DB_PASSWORD: ${OPENMETADATA_DB_PASSWORD}
      API_DB_PASSWORD: ${API_DB_PASSWORD}
      DAGSTER_DB_PASSWORD: ${DAGSTER_DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./config/postgres/init-databases.sh:/docker-entrypoint-initdb.d/init-databases.sh:ro
    healthcheck:
      test: [CMD-SHELL, "pg_isready -h 127.0.0.1 -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 12

  rabbitmq:
    image: rabbitmq:4.3
    restart: unless-stopped
    hostname: rabbitmq
    environment:
      RABBITMQ_DEFAULT_USER: moderate
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD}
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq
    healthcheck:
      test: [CMD, rabbitmq-diagnostics, -q, ping]
      interval: 10s
      timeout: 5s
      retries: 12

  seaweedfs:
    image: chrislusf/seaweedfs:4.48
    restart: unless-stopped
    command: server -dir=/data -s3
    environment:
      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
      AWS_SECRET_ACCESS_KEY: ${S3_SECRET}
    volumes:
      - seaweedfs_data:/data
    healthcheck:
      test: [CMD, curl, -fsS, "http://127.0.0.1:8333/healthz"]
      interval: 10s
      timeout: 5s
      retries: 12

  keycloak:
    image: quay.io/keycloak/keycloak:26.8.0
    restart: unless-stopped
    command: start --import-realm
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      KC_HOSTNAME: https://keycloak.${DOMAIN}
      KC_PROXY_HEADERS: xforwarded
      KC_HTTP_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
      JAVA_OPTS_KC_HEAP: -Xms256m -Xmx1g
      DOMAIN: ${DOMAIN}
      APISIX_CLIENT_SECRET: ${APISIX_CLIENT_SECRET}
      PLATFORM_ADMIN_PASSWORD: ${PLATFORM_ADMIN_PASSWORD}
      WORKFLOWS_PASSWORD: ${WORKFLOWS_PASSWORD}
    volumes:
      - ./config/keycloak/moderate-realm.json:/opt/keycloak/data/import/moderate-realm.json:ro
    healthcheck:
      test:
        - CMD
        - bash
        - -ec
        - "{ printf 'HEAD /health/ready HTTP/1.0\r\n\r\n' >&0; grep 'HTTP/1.0 200'; } 0<>/dev/tcp/localhost/9000"
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 90s

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.10.2
    restart: unless-stopped
    environment:
      discovery.type: single-node
      xpack.security.enabled: "false"
      ES_JAVA_OPTS: -Xms1g -Xmx1g
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data
    healthcheck:
      test:
        [
          CMD-SHELL,
          'curl -fsS localhost:9200/_cluster/health | grep -qE ''"status":"(green|yellow)"''',
        ]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 60s

  openmetadata-migrate:
    image: &openmetadata-image openmetadata/server:1.5.15
    command: ./bootstrap/openmetadata-ops.sh migrate
    depends_on:
      postgres:
        condition: service_healthy
      elasticsearch:
        condition: service_healthy
    environment: &openmetadata-environment
      DB_DRIVER_CLASS: org.postgresql.Driver
      DB_SCHEME: postgresql
      DB_HOST: postgres
      DB_PORT: "5432"
      DB_USER: openmetadata
      DB_USER_PASSWORD: ${OPENMETADATA_DB_PASSWORD}
      OM_DATABASE: openmetadata
      DB_PARAMS: sslmode=disable
      ELASTICSEARCH_HOST: elasticsearch
      ELASTICSEARCH_PORT: "9200"
      ELASTICSEARCH_SCHEME: http
      SEARCH_TYPE: elasticsearch
      AUTHENTICATION_PROVIDER: custom-oidc
      CUSTOM_OIDC_AUTHENTICATION_PROVIDER_NAME: Keycloak
      AUTHENTICATION_CLIENT_TYPE: public
      AUTHENTICATION_CLIENT_ID: openmetadata
      AUTHENTICATION_PUBLIC_KEYS: "[https://keycloak.${DOMAIN}/realms/moderate/protocol/openid-connect/certs,http://localhost:8585/api/v1/system/config/jwks]"
      AUTHENTICATION_AUTHORITY: https://keycloak.${DOMAIN}/realms/moderate
      AUTHENTICATION_CALLBACK_URL: https://openmetadata.${DOMAIN}/callback
      AUTHORIZER_ADMIN_PRINCIPALS: "[admin]"
      AUTHORIZER_PRINCIPAL_DOMAIN: ${DOMAIN}
      RSA_PRIVATE_KEY_FILE_PATH: /etc/openmetadata/jwtkeys/private_key.der
      RSA_PUBLIC_KEY_FILE_PATH: /etc/openmetadata/jwtkeys/public_key.der
      FERNET_KEY: ${OPENMETADATA_FERNET_KEY}
      PIPELINE_SERVICE_CLIENT_ENABLED: "false"
    volumes: &openmetadata-volumes
      - ./secrets/openmetadata_jwt_private_pkcs8.der:/etc/openmetadata/jwtkeys/private_key.der:ro
      - ./secrets/openmetadata_jwt_public.der:/etc/openmetadata/jwtkeys/public_key.der:ro

  openmetadata:
    image: *openmetadata-image
    restart: unless-stopped
    depends_on:
      openmetadata-migrate:
        condition: service_completed_successfully
      keycloak:
        condition: service_healthy
    environment: *openmetadata-environment
    volumes: *openmetadata-volumes
    healthcheck:
      test: [CMD, wget, -q, --spider, "http://localhost:8586/healthcheck"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 90s

  api:
    image: &api-image ghcr.io/moderate-project/moderate-api:0.4.0
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      seaweedfs:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      trust:
        condition: service_healthy
      kafka-rest:
        condition: service_healthy
      reporter:
        condition: service_healthy
      nifi-bootstrap:
        condition: service_completed_successfully
    environment:
      MODERATE_API_POSTGRES_URL: postgresql+asyncpg://moderateapi:${API_DB_PASSWORD}@postgres:5432/moderateapi
      MODERATE_API_OPENID_CONFIG_URL: https://keycloak.${DOMAIN}/realms/moderate/.well-known/openid-configuration
      MODERATE_API_S3__ENDPOINT_URL: http://seaweedfs:8333
      MODERATE_API_S3__PUBLIC_ENDPOINT_URL: https://s3.${DOMAIN}
      MODERATE_API_S3__USE_SSL: "false"
      MODERATE_API_S3__REGION: eu-central-1
      MODERATE_API_S3__BUCKET: platform-api
      MODERATE_API_S3__ACCESS_KEY: ${S3_ACCESS_KEY}
      MODERATE_API_S3__SECRET_KEY: ${S3_SECRET}
      MODERATE_API_RABBIT_ROUTER_URL: amqp://moderate:${RABBITMQ_PASSWORD}@rabbitmq:5672/
      MODERATE_API_TRUST_SERVICE__ENDPOINT_URL: http://trust:8081
      MODERATE_API_OPEN_METADATA_SERVICE__ENDPOINT_URL: ${OPENMETADATA_BOT_TOKEN:+http://openmetadata:8585}
      MODERATE_API_OPEN_METADATA_SERVICE__BEARER_TOKEN: ${OPENMETADATA_BOT_TOKEN:-}
      MODERATE_API_DIVA__ENABLED: "true"
      MODERATE_API_DIVA__KAFKA_REST_URL: http://kafka-rest:8082
      MODERATE_API_DIVA__QUALITY_REPORTER_URL: http://reporter:8000
      MODERATE_API_PLATFORM_APPLICATIONS_FILE: /etc/moderate/platform-applications.yaml
    volumes:
      - ./config/api/platform-applications.yaml:/etc/moderate/platform-applications.yaml:ro
    healthcheck:
      test:
        [
          CMD,
          /root/venv/bin/python,
          -c,
          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/ping', timeout=5)",
        ]
      interval: 10s
      timeout: 10s
      retries: 12

  api-migrate:
    image: *api-image
    working_dir: /app
    command: /root/venv/bin/poetry run alembic upgrade head
    depends_on:
      api:
        condition: service_healthy
    environment:
      MIGRATIONS_SQLALCHEMY_URL: postgresql://moderateapi:${API_DB_PASSWORD}@postgres:5432/moderateapi

  dagster-code:
    image: &dagster-image ghcr.io/moderate-project/moderate-workflows:sha-cdade44
    restart: unless-stopped
    command: [dagster, api, grpc, -h, 0.0.0.0, -p, "4000", -m, moderate]
    depends_on:
      postgres:
        condition: service_healthy
      api-migrate:
        condition: service_completed_successfully
      apisix:
        condition: service_healthy
      caddy:
        condition: service_started
    environment:
      DAGSTER_HOME: /opt/dagster/dagster_home
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_USERNAME: dagster
      POSTGRES_PASSWORD: ${DAGSTER_DB_PASSWORD}
      KEYCLOAK_SERVER_URL: https://keycloak.${DOMAIN}
      KEYCLOAK_ADMIN_USERNAME: admin
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
      OPEN_METADATA_HOST: http://openmetadata
      OPEN_METADATA_PORT: "8585"
      OPEN_METADATA_TOKEN: ${OPENMETADATA_BOT_TOKEN:-}
      API_BASE_URL: https://api.gw.${DOMAIN}
      API_USERNAME: workflows
      API_PASSWORD: ${WORKFLOWS_PASSWORD}
      S3_ENDPOINT_URL: http://seaweedfs:8333
      S3_REGION: eu-central-1
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET}
      S3_BUCKET_NAME: platform-api
      S3_JOB_OUTPUTS_BUCKET_NAME: platform-api
      RABBIT_URL: amqp://moderate:${RABBITMQ_PASSWORD}@rabbitmq:5672/
      DOCKER_JOB_NETWORK: moderate
      MATRIX_PROFILE_JOB_TAG: sha-47e7843
    volumes:
      - ./config/dagster/dagster.yaml:/opt/dagster/dagster_home/dagster.yaml:ro
      - dagster_storage:/opt/dagster/dagster_home/storage
      # Only the code server starts matrix-profile containers.
      - /var/run/docker.sock:/var/run/docker.sock
    healthcheck:
      test: [CMD, dagster, api, grpc-health-check, -p, "4000"]
      interval: 10s
      timeout: 10s
      retries: 12
      start_period: 60s

  dagster-webserver:
    image: *dagster-image
    restart: unless-stopped
    command: [dagster-webserver, -h, 0.0.0.0, -p, "3000", -w, /opt/dagster/dagster_home/workspace.yaml]
    depends_on:
      dagster-code:
        condition: service_healthy
    # Private operational UI.
    ports: ["127.0.0.1:3000:3000"]
    environment: &dagster-environment
      DAGSTER_HOME: /opt/dagster/dagster_home
      POSTGRES_PASSWORD: ${DAGSTER_DB_PASSWORD}
    volumes: &dagster-volumes
      - ./config/dagster/dagster.yaml:/opt/dagster/dagster_home/dagster.yaml:ro
      - ./config/dagster/workspace.yaml:/opt/dagster/dagster_home/workspace.yaml:ro
      - dagster_storage:/opt/dagster/dagster_home/storage
    healthcheck:
      test: [CMD, curl, -fsS, "http://127.0.0.1:3000/server_info"]
      interval: 10s
      timeout: 5s
      retries: 12

  dagster-sensors:
    image: *dagster-image
    command: [bash, /etc/moderate/start-dagster-sensors.sh]
    depends_on:
      dagster-webserver:
        condition: service_healthy
    environment:
      <<: *dagster-environment
      OPEN_METADATA_TOKEN: ${OPENMETADATA_BOT_TOKEN:-}
    volumes:
      - ./config/dagster/dagster.yaml:/opt/dagster/dagster_home/dagster.yaml:ro
      - ./config/dagster/workspace.yaml:/opt/dagster/dagster_home/workspace.yaml:ro
      - dagster_storage:/opt/dagster/dagster_home/storage
      - ./scripts/start-dagster-sensors.sh:/etc/moderate/start-dagster-sensors.sh:ro

  dagster-daemon:
    image: *dagster-image
    restart: unless-stopped
    command: [dagster-daemon, run, -w, /opt/dagster/dagster_home/workspace.yaml]
    depends_on:
      dagster-sensors:
        condition: service_completed_successfully
    environment: *dagster-environment
    volumes: *dagster-volumes
    healthcheck:
      test: [CMD, dagster-daemon, liveness-check]
      interval: 30s
      timeout: 15s
      retries: 6
      start_period: 60s

  ui:
    image: ghcr.io/moderate-project/moderate-ui:0.4.0
    restart: unless-stopped
    depends_on:
      api-migrate:
        condition: service_completed_successfully
    environment:
      MODERATE_API_URL: http://api:8000
      MODERATE_UI_KEYCLOAK_URL: https://keycloak.${DOMAIN}
    healthcheck:
      test: [CMD, wget, -q, -O, /dev/null, "http://127.0.0.1/config.json"]
      interval: 10s
      timeout: 5s
      retries: 12

  apisix:
    image: apache/apisix:3.19.0-debian
    restart: unless-stopped
    depends_on:
      api-migrate:
        condition: service_completed_successfully
    environment:
      APISIX_STAND_ALONE: "true"
      DOMAIN: ${DOMAIN}
      APISIX_CLIENT_SECRET: ${APISIX_CLIENT_SECRET}
    volumes:
      - ./config/apisix/config.yaml:/usr/local/apisix/conf/config.yaml:ro
      - ./config/apisix/apisix.yaml:/usr/local/apisix/conf/apisix.yaml:ro
    healthcheck:
      test:
        - CMD
        - bash
        - -ec
        - "{ printf 'GET /status/ready HTTP/1.0\r\n\r\n' >&0; grep 'HTTP/1.1 200'; } 0<>/dev/tcp/127.0.0.1/7085"
      interval: 10s
      timeout: 5s
      retries: 12

  mongo:
    image: mongo:7.0.43
    restart: unless-stopped
    command: [--wiredTigerCacheSizeGB, "0.5"]
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD}
    volumes:
      - mongo_data:/data/db
    healthcheck:
      test: [CMD, mongosh, --quiet, --eval, "db.adminCommand('ping')"]
      interval: 10s
      timeout: 5s
      retries: 12

  ipfs:
    image: ipfs/kubo:v0.43.1
    restart: unless-stopped
    volumes:
      - ipfs_data:/data/ipfs

  trust-iota:
    image: iotaledger/hornet-nest:2.0.1
    restart: unless-stopped
    entrypoint: [bash, /etc/moderate/start-iota.sh]
    stop_grace_period: 5m
    volumes:
      - trust_iota_data:/app
      - ./config/trust-iota/start-iota.sh:/etc/moderate/start-iota.sh:ro
    healthcheck:
      test:
        - CMD
        - bash
        - -ec
        - "exec 3<>/dev/tcp/127.0.0.1/14265; printf 'GET /health HTTP/1.0\\r\\n\\r\\n' >&3; head -n1 <&3 | grep -q ' 200 '; exec 4<>/dev/tcp/127.0.0.1/8091"
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 60s

  trust-evm:
    image: ghcr.io/foundry-rs/foundry:v1.8.4
    restart: unless-stopped
    entrypoint: [anvil]
    command:
      [
        --host,
        0.0.0.0,
        --chain-id,
        "1074",
        --state,
        /home/foundry/state.json,
        --state-interval,
        "1",
      ]
    volumes:
      - trust_evm_data:/home/foundry
    healthcheck:
      test: [CMD, cast, chain-id]
      interval: 5s
      timeout: 5s
      retries: 30

  trust-contracts:
    image: &trust-image ghcr.io/moderate-project/trust-service:sha-15f883c
    entrypoint: [deploy-contracts]
    depends_on:
      trust-evm:
        condition: service_healthy
    environment:
      RPC_PROVIDER: http://trust-evm:8545
      CHAIN_ID: "1074"
      ASSET_FACTORY_ADDR: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512"
      # Anvil's public, prefunded account 0 deploys contracts on this local chain.
      DEPLOYER_PRIVATE_KEY: ac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80

  trust:
    image: *trust-image
    restart: unless-stopped
    depends_on:
      mongo:
        condition: service_healthy
      ipfs:
        condition: service_healthy
      trust-iota:
        condition: service_healthy
      trust-contracts:
        condition: service_completed_successfully
    environment:
      # Anvil's public, prefunded account 1 signs service transactions.
      L2_PRIVATE_KEY: 59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d
      MNEMONIC: ${TRUST_MNEMONIC}
      KEY_STORAGE_MNEMONIC: ${TRUST_KEY_STORAGE_MNEMONIC}
      STRONGHOLD_PASSWORD: ${TRUST_STRONGHOLD_PASSWORD}
      KEY_STORAGE_STRONGHOLD_PASSWORD: ${TRUST_KEY_STORAGE_STRONGHOLD_PASSWORD}
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD}
      MONGO_ENDPOINT_D: mongo:27017
      MONGO_DATABASE: moderatetrust
      NODE_URL: http://trust-iota:14265
      FAUCET_URL: http://trust-iota:8091/api/enqueue
      EXPLORER_URL: http://trust-iota:8081/dashboard/explorer
      RPC_PROVIDER: http://trust-evm:8545
      CHAIN_ID: "1074"
      ASSET_FACTORY_ADDR: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512"
      # Keep local-chain wallets separate from wallets created on earlier networks.
      WALLET_DB_PATH: /var/lib/trust/local/walletdb
      STRONGHOLD_SNAPSHOT_PATH: /var/lib/trust/local/snapshot.stronghold
      KEY_STORAGE_STRONGHOLD_SNAPSHOT_PATH: /var/lib/trust/local/key_storage.stronghold
    volumes:
      - trust_data:/var/lib/trust
    healthcheck:
      test: [CMD, nc, -z, 127.0.0.1, "8081"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 60s

  geoserver:
    image: ghcr.io/moderate-project/moderate-geoserver:sha-89c77f1
    restart: unless-stopped
    environment:
      GEOSERVER_ADMIN_USER: admin
      GEOSERVER_ADMIN_PASSWORD: ${GEOSERVER_ADMIN_PASSWORD}
      GEOSERVER_DATA_DIR: /opt/geoserver/data_dir
      GEOWEBCACHE_CACHE_DIR: /opt/geoserver/data_dir/gwc
      STABLE_EXTENSIONS: excel-plugin,charts-plugin
      TOMCAT_EXTRAS: "false"
      ROOT_WEBAPP_REDIRECT: "true"
      HTTP_SCHEME: https
      HTTP_PROXY_NAME: geoserver.${DOMAIN}
      HTTP_PROXY_PORT: "443"
      INITIAL_MEMORY: 512M
      MAXIMUM_MEMORY: 2G
    volumes:
      - geoserver_data:/opt/geoserver/data_dir
    healthcheck:
      test: [CMD, curl, -fs, "http://127.0.0.1:8080/geoserver/web/"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 180s

  kafka:
    image: &kafka-image confluentinc/cp-kafka:7.8.11
    restart: unless-stopped
    environment:
      CLUSTER_ID: 6pKOGDCjRJumCIzamlDnig
      KAFKA_NODE_ID: "1"
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_LISTENERS: PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,CONTROLLER:PLAINTEXT
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: "1"
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: "1"
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: "1"
      KAFKA_DEFAULT_REPLICATION_FACTOR: "1"
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "false"
      KAFKA_LOG_DIRS: /var/lib/kafka/data
      KAFKA_HEAP_OPTS: -Xms256m -Xmx512m
    volumes:
      - kafka_data:/var/lib/kafka/data
    healthcheck:
      test: [CMD, kafka-topics, --bootstrap-server, "kafka:9092", --list]
      interval: 10s
      timeout: 10s
      retries: 12
      start_period: 30s

  kafka-topics:
    image: *kafka-image
    entrypoint: [bash, /etc/moderate/create-kafka-topics.sh]
    depends_on:
      kafka:
        condition: service_healthy
    volumes:
      - ./scripts/create-kafka-topics.sh:/etc/moderate/create-kafka-topics.sh:ro

  kafka-rest:
    image: confluentinc/cp-kafka-rest:7.8.11
    restart: unless-stopped
    depends_on:
      kafka-topics:
        condition: service_completed_successfully
    environment:
      KAFKA_REST_HOST_NAME: kafka-rest
      KAFKA_REST_BOOTSTRAP_SERVERS: kafka:9092
      KAFKA_REST_LISTENERS: http://0.0.0.0:8082
      KAFKA_REST_CLIENT_SECURITY_PROTOCOL: PLAINTEXT
      KAFKAREST_HEAP_OPTS: -Xms128m -Xmx256m
    healthcheck:
      test: [CMD, curl, -fsS, "http://127.0.0.1:8082/topics"]
      interval: 10s
      timeout: 5s
      retries: 12

  nifi:
    image: &nifi-image ghcr.io/moderate-project/moderate-nifi:sha-7d82c8f
    restart: unless-stopped
    hostname: nifi
    entrypoint: [bash, /etc/moderate/start-nifi.sh]
    stop_grace_period: 2m
    depends_on:
      kafka-topics:
        condition: service_completed_successfully
    ports: ["127.0.0.1:8443:8443"]
    environment:
      NIFI_WEB_HTTPS_HOST: 0.0.0.0
      NIFI_WEB_HTTPS_PORT: "8443"
      NIFI_WEB_PROXY_HOST: localhost:8443,127.0.0.1:8443,nifi:8443
      SINGLE_USER_CREDENTIALS_USERNAME: admin
      SINGLE_USER_CREDENTIALS_PASSWORD: ${NIFI_PASSWORD}
      NIFI_JVM_HEAP_INIT: 256m
      NIFI_JVM_HEAP_MAX: 1g
    volumes:
      - ./scripts/start-nifi.sh:/etc/moderate/start-nifi.sh:ro
      - ./secrets/nifi.crt:/etc/nifi-tls/nifi.crt:ro
      - ./secrets/nifi.key:/etc/nifi-tls/nifi.key:ro
      - nifi_conf:/opt/nifi/nifi-current/conf
      - nifi_database:/opt/nifi/nifi-current/database_repository
      - nifi_flowfile:/opt/nifi/nifi-current/flowfile_repository
      - nifi_content:/opt/nifi/nifi-current/content_repository
      - nifi_provenance:/opt/nifi/nifi-current/provenance_repository
      - nifi_state:/opt/nifi/nifi-current/state
      - nifi_logs:/opt/nifi/nifi-current/logs
      - nifi_python_extensions:/opt/nifi/nifi-current/python_extensions
      - nifi_nar_extensions:/opt/nifi/nifi-current/nar_extensions
    healthcheck:
      test: [CMD, curl, -fsS, --cacert, /etc/nifi-tls/nifi.crt, "https://localhost:8443/nifi/"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 120s

  nifi-bootstrap:
    image: *nifi-image
    entrypoint: [python3, /opt/moderate/scripts/bootstrap_nifi.py, --timeout, "900"]
    depends_on:
      nifi:
        condition: service_healthy
      reporter:
        condition: service_healthy
    environment:
      NIFI_URL: https://nifi:8443
      NIFI_KAFKA_BOOTSTRAP_SERVERS: kafka:9092
      NIFI_USER: admin
      NIFI_PASSWORD: ${NIFI_PASSWORD}
      NIFI_CA_BUNDLE: /etc/nifi-tls/nifi.crt
    volumes:
      - ./secrets/nifi.crt:/etc/nifi-tls/nifi.crt:ro

  reporter:
    image: ghcr.io/moderate-project/moderate-quality-reporter:sha-7d82c8f
    restart: unless-stopped
    depends_on:
      kafka-topics:
        condition: service_completed_successfully
    environment:
      KAFKA_BOOTSTRAP_SERVERS: kafka:9092
      KAFKA_SECURITY_PROTOCOL: PLAINTEXT
      VALIDATION_TOPIC: validation
      KAFKA_CONSUMER_GROUP_ID: moderate-quality-reporter
      KAFKA_AUTO_OFFSET_RESET: earliest
      DATABASE_PATH: sqlite:////data/report.db
    volumes:
      - reporter_data:/data
      - ./scripts/check-reporter.py:/etc/moderate/check-reporter.py:ro
    healthcheck:
      test: [CMD, python, /etc/moderate/check-reporter.py]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s

  kafka-ui:
    image: ghcr.io/kafbat/kafka-ui:v1.5.0
    restart: unless-stopped
    depends_on:
      kafka-topics:
        condition: service_completed_successfully
    ports: ["127.0.0.1:8080:8080"]
    environment:
      KAFKA_CLUSTERS_0_NAME: moderate
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka:9092
      AUTH_TYPE: DISABLED
      JAVA_OPTS: -Xms128m -Xmx256m
    healthcheck:
      test: [CMD, wget, -q, -O, /dev/null, "http://127.0.0.1:8080/actuator/health"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s

  grafana:
    image: grafana/grafana:13.2.3
    restart: unless-stopped
    depends_on:
      reporter:
        condition: service_healthy
    ports: ["127.0.0.1:3001:3000"]
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_SERVER_ROOT_URL: http://localhost:3001/
      GF_PLUGINS_PREINSTALL_SYNC: yesoreyeram-infinity-datasource@4.1.1
    volumes:
      - grafana_data:/var/lib/grafana
      - ./config/grafana/datasources.yaml:/etc/grafana/provisioning/datasources/reporter.yaml:ro
    healthcheck:
      test: [CMD, wget, -q, -O, /dev/null, "http://127.0.0.1:3000/api/health"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 60s

volumes:
  caddy_data:
  caddy_config:
  postgres_data:
  rabbitmq_data:
  seaweedfs_data:
  elasticsearch_data:
  mongo_data:
  ipfs_data:
  trust_data:
  trust_iota_data:
  trust_evm_data:
  geoserver_data:
  dagster_storage:
  kafka_data:
  nifi_conf:
  nifi_database:
  nifi_flowfile:
  nifi_content:
  nifi_provenance:
  nifi_state:
  nifi_logs:
  nifi_python_extensions:
  nifi_nar_extensions:
  reporter_data:
  grafana_data:

networks:
  default:
    # Fixed network name allows external containers to join.
    name: moderate