docker-compose.swarm.yml

# Obiente Cloud - Docker Swarm Deployment
# This is a simplified setup. For high availability, use docker-compose.swarm.ha.yml



# This file requires docker-compose.base.yml to be merged before use.
# Use scripts/deploy-swarm.sh so required node ownership labels are preserved.
# Usage: ./scripts/deploy-swarm.sh obiente docker-compose.swarm.yml

# Swarm-specific common environment variables
# Override ENABLE_SWARM to default to true for Swarm deployments
x-common-swarm-orchestrator: &common-swarm-orchestrator
  <<: [*common-orchestrator]
  ENABLE_SWARM: ${ENABLE_SWARM:-true}  # Default to true for Swarm stack deployments

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-obiente_postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-obiente_postgres}
      POSTGRES_DB: ${POSTGRES_DB:-obiente}
      # Configure PostgreSQL to listen on all interfaces (required for Docker Swarm overlay network)
      POSTGRES_HOST_AUTH_METHOD: md5
      # Overlay network subnet for pg_hba.conf configuration
      OVERLAY_SUBNET: ${OVERLAY_SUBNET:-10.15.3.0/24}
      # Allowed hosts for pg_hba.conf (comma-separated IPs or subnets, e.g., "10.10.10.1,10.0.0.0/8")
      POSTGRES_ALLOWED_HOSTS: ${POSTGRES_ALLOWED_HOSTS:-}
    command:
      - postgres
      - -c
      - listen_addresses=*
      - -c
      - max_connections=200
    # Port exposure configuration for Netbird VPN access
    # Default: Exposed on localhost only (127.0.0.1) for security
    # To change binding, set POSTGRES_EXPOSE_PORT and POSTGRES_PORT_MODE environment variables
    # For localhost-only binding, use host mode (default) and configure firewall rules
    # Examples:
    #   - POSTGRES_EXPOSE_PORT=5433  # Default: localhost only (requires firewall rules)
    #   - POSTGRES_PORT_MODE=host    # Default: host mode for localhost binding
    # Note: Port 5432 is reserved for databases-service proxy ingress.
    # Note: Docker Swarm host mode binds to all interfaces by default
    # Configure iptables/firewall to restrict to localhost: iptables -A INPUT -p tcp --dport 5433 -s 127.0.0.1 -j ACCEPT
    ports:
      - target: 5432
        published: ${POSTGRES_EXPOSE_PORT:-5433}
        protocol: tcp
        mode: ${POSTGRES_PORT_MODE:-host}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    configs:
      # Mount custom pg_hba.conf file and init script
      - source: postgres_hba_conf
        target: /docker-entrypoint-initdb.d/pg_hba.conf
        mode: 0644
      - source: postgres_hba_init
        target: /docker-entrypoint-initdb.d/01-init-pg-hba.sh
        mode: 0755
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-obiente_postgres} -d ${POSTGRES_DB:-obiente}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.postgres.enabled == true
      resources:
        limits:
          cpus: "4"
          memory: 4G
        reservations:
          cpus: "0.25"
          memory: 128M
    dns_search: []
    networks:
      - obiente-network

  timescaledb:
    image: timescale/timescaledb:latest-pg16
    environment:
      POSTGRES_USER: ${METRICS_DB_USER:-obiente_postgres}
      POSTGRES_PASSWORD: ${METRICS_DB_PASSWORD:-obiente_postgres}
      POSTGRES_DB: ${METRICS_DB_NAME:-obiente_metrics}
      # Configure PostgreSQL to listen on all interfaces (required for Docker Swarm overlay network)
      POSTGRES_HOST_AUTH_METHOD: md5
      # Overlay network subnet for pg_hba.conf configuration
      OVERLAY_SUBNET: ${OVERLAY_SUBNET:-10.15.3.0/24}
      # Allowed hosts for pg_hba.conf (comma-separated IPs or subnets, e.g., "10.10.10.1,10.0.0.0/8")
      # Falls back to POSTGRES_ALLOWED_HOSTS if not set
      POSTGRES_ALLOWED_HOSTS: ${METRICS_DB_ALLOWED_HOSTS:-${POSTGRES_ALLOWED_HOSTS:-}}
    command:
      - postgres
      - -c
      - listen_addresses=*
      - -c
      - max_connections=200
    # Port exposure configuration for Netbird VPN access
    # Default: Exposed on localhost only (127.0.0.1) for security
    # To change binding, set METRICS_DB_EXPOSE_PORT and METRICS_DB_PORT_MODE environment variables
    # For localhost-only binding, use host mode (default) and configure firewall rules
    # Examples:
    #   - METRICS_DB_EXPOSE_PORT=5434  # Default: localhost only (requires firewall rules)
    #   - METRICS_DB_PORT_MODE=host    # Default: host mode for localhost binding
    # Note: Keep distinct from POSTGRES_EXPOSE_PORT and databases-service proxy ports.
    # Note: Docker Swarm host mode binds to all interfaces by default
    # Configure iptables/firewall to restrict to localhost: iptables -A INPUT -p tcp --dport 5434 -s 127.0.0.1 -j ACCEPT
    ports:
      - target: 5432
        published: ${METRICS_DB_EXPOSE_PORT:-5434}
        protocol: tcp
        mode: ${METRICS_DB_PORT_MODE:-host}
    volumes:
      - timescaledb_data:/var/lib/postgresql/data
    configs:
      # Mount custom pg_hba.conf file and init script
      - source: postgres_hba_conf
        target: /docker-entrypoint-initdb.d/pg_hba.conf
        mode: 0644
      - source: postgres_hba_init
        target: /docker-entrypoint-initdb.d/01-init-pg-hba.sh
        mode: 0755
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${METRICS_DB_USER:-obiente_postgres} -d ${METRICS_DB_NAME:-obiente_metrics}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.metrics.enabled == true
      resources:
        limits:
          cpus: "4"
          memory: 4G
        reservations:
          cpus: "0.25"
          memory: 128M
    dns_search: []
    networks:
      - obiente-network

  redis:
    image: redis:8-alpine
    environment:
      # Redis password authentication (required if port is exposed)
      # If REDIS_PASSWORD is set, Redis will require authentication
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
    command:
      - sh
      - -c
      - |
        if [ -n "$$REDIS_PASSWORD" ]; then
          exec redis-server --appendonly yes --requirepass "$$REDIS_PASSWORD"
        else
          exec redis-server --appendonly yes
        fi
    # Port exposure configuration for Netbird VPN access
    # Default: Exposed on localhost only (127.0.0.1) for security
    # To change binding, set REDIS_EXPOSE_PORT and REDIS_PORT_MODE environment variables
    # For localhost-only binding, use host mode (default) and configure firewall rules
    # Examples:
    #   - REDIS_EXPOSE_PORT=6379  # Default: localhost only (requires firewall rules)
    #   - REDIS_PORT_MODE=host     # Default: host mode for localhost binding
    # Note: Docker Swarm host mode binds to all interfaces by default
    # Configure iptables/firewall to restrict to localhost: iptables -A INPUT -p tcp --dport 6379 -s 127.0.0.1 -j ACCEPT
    ports:
      - target: 6379
        published: ${REDIS_EXPOSE_PORT:-6379}
        protocol: tcp
        mode: ${REDIS_PORT_MODE:-host}
    volumes:
      - redis_data:/data
    healthcheck:
      # Health check with password support
      # If REDIS_PASSWORD is set, use AUTH command
      test: ["CMD-SHELL", "if [ -n \"$$REDIS_PASSWORD\" ]; then redis-cli -a \"$$REDIS_PASSWORD\" ping; else redis-cli ping; fi || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.redis.enabled == true
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
    dns_search: []
    networks:
      - obiente-network

  # ============================================================================
  # MICROSERVICES
  # ============================================================================
  # All functionality has been moved from the monolithic API to microservices
  # API Gateway (port 3001) is the primary entry point and routes to microservices

  # API Gateway - Routes requests to all microservices
  api-gateway:
    image: ghcr.io/obiente/cloud-api-gateway:latest
    environment:
      PORT: 3001
      <<: [*common-auth, *common-api-gateway]
    ports:
      - target: 3001
        published: ${API_GATEWAY_PORT:-3001}
        protocol: tcp
        mode: ingress  
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
        failure_action: rollback
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=api-gateway"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.api-gateway.rule=Host(`api.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.api-gateway.entrypoints=web"
        - "traefik.http.routers.api-gateway.service=api-gateway"
        # Retry middleware for transient failures
        - "traefik.http.middlewares.api-gateway-retry.retry.attempts=3"
        - "traefik.http.middlewares.api-gateway-retry.retry.initialInterval=100ms"
        # Circuit breaker removed from API gateway - gateway should always be accessible
        # Circuit breaker is applied to backend services, not the gateway itself
        - "traefik.http.routers.api-gateway.middlewares=api-gateway-retry"
        - "traefik.http.services.api-gateway.loadbalancer.server.port=3001"
        - "traefik.docker.network=obiente_obiente-network"  # Use overlay network IP, not ingress network
        - "traefik.http.services.api-gateway.loadbalancer.passHostHeader=true"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.path=/health"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.interval=10s"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.timeout=8s"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.scheme=http"
        - "traefik.http.services.api-gateway.loadbalancer.healthcheck.followRedirects=true"
        - "traefik.http.routers.api-gateway-secure.rule=Host(`api.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.api-gateway-secure.entrypoints=websecure"
        - "traefik.http.routers.api-gateway-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.api-gateway-secure.service=api-gateway"
        - "traefik.http.routers.api-gateway-secure.middlewares=api-gateway-retry"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3001/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Auth Service - Microservice for authentication
  auth-service:
    image: ghcr.io/obiente/cloud-auth-service:latest
    environment:
      PORT: 3002
      <<: [*common-database, *common-metrics-db, *common-auth, *common-dashboard, *common-github]
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=auth-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.auth-service.rule=Host(`auth-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.auth-service.entrypoints=web"
        - "traefik.http.services.auth-service.loadbalancer.server.port=3002"
        - "traefik.http.routers.auth-service-secure.rule=Host(`auth-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.auth-service-secure.entrypoints=websecure"
        - "traefik.http.routers.auth-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.auth-service-secure.service=auth-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3002/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Organizations Service - Microservice for organization management
  organizations-service:
    image: ghcr.io/obiente/cloud-organizations-service:latest
    environment:
      PORT: 3003
      <<: [*common-database, *common-metrics-db, *common-auth, *common-smtp, *common-dashboard, *common-notifications]
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=organizations-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.organizations-service.rule=Host(`organizations-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.organizations-service.entrypoints=web"
        - "traefik.http.services.organizations-service.loadbalancer.server.port=3003"
        - "traefik.http.routers.organizations-service-secure.rule=Host(`organizations-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.organizations-service-secure.entrypoints=websecure"
        - "traefik.http.routers.organizations-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.organizations-service-secure.service=organizations-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3003/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Billing Service - Microservice for billing and Stripe integration
  billing-service:
    image: ghcr.io/obiente/cloud-billing-service:latest
    environment:
      PORT: 3004
      <<: [*common-database, *common-metrics-db, *common-auth, *common-stripe, *common-dashboard, *common-notifications]
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=billing-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.billing-service.rule=Host(`billing-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.billing-service.entrypoints=web"
        - "traefik.http.services.billing-service.loadbalancer.server.port=3004"
        - "traefik.http.routers.billing-service-secure.rule=Host(`billing-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.billing-service-secure.entrypoints=websecure"
        - "traefik.http.routers.billing-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.billing-service-secure.service=billing-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3004/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Deployments Service - Microservice for deployment management
  deployments-service:
    image: ghcr.io/obiente/cloud-deployments-service:latest
    environment:
      PORT: 3005
      STACK_NAME: __STACK_NAME__
      DEPLOYMENTS_INTERNAL_SERVICE_SECRET: ${DEPLOYMENTS_INTERNAL_SERVICE_SECRET:-}
      PREVIEW_STATUS_BASE_URL: ${PREVIEW_STATUS_BASE_URL:-}
      <<: [*common-database, *common-metrics-db, *common-auth, *common-redis, *common-github, *common-swarm-orchestrator, *common-dns-delegation, *common-notifications, *common-dashboard]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/obiente:/var/lib/obiente
      - /var/obiente/tmp/obiente-volumes:/tmp/obiente-volumes
      - /var/obiente/tmp/obiente-deployments:/tmp/obiente-deployments
    deploy:
      mode: global  # One instance per node for local Docker access
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
        failure_action: rollback
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "2"
          memory: 2G
        reservations:
          cpus: "0.25"
          memory: 128M
      labels:
        - "cloud.obiente.service=deployments-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.deployments-service.rule=Host(`deployments-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.deployments-service.entrypoints=web"
        - "traefik.http.services.deployments-service.loadbalancer.server.port=3005"
        - "traefik.http.routers.deployments-service-secure.rule=Host(`deployments-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.deployments-service-secure.entrypoints=websecure"
        - "traefik.http.routers.deployments-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.deployments-service-secure.service=deployments-service"
        - "traefik.http.routers.preview-status.rule=Host(`${DOMAIN:-localhost}`) && PathPrefix(`/previews/`)"
        - "traefik.http.routers.preview-status.entrypoints=web"
        - "traefik.http.routers.preview-status.priority=300"
        - "traefik.http.routers.preview-status.service=deployments-service"
        - "traefik.http.routers.preview-status-secure.rule=Host(`${DOMAIN:-localhost}`) && PathPrefix(`/previews/`)"
        - "traefik.http.routers.preview-status-secure.entrypoints=websecure"
        - "traefik.http.routers.preview-status-secure.priority=300"
        - "traefik.http.routers.preview-status-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.preview-status-secure.service=deployments-service"
        - "traefik.http.routers.preview-domain-fallback.rule=HostRegexp(`^pr-[a-z0-9-]+[.]my[.]obiente[.]cloud$$`)"
        - "traefik.http.routers.preview-domain-fallback.entrypoints=web"
        - "traefik.http.routers.preview-domain-fallback.priority=1"
        - "traefik.http.routers.preview-domain-fallback.service=deployments-service"
        - "traefik.http.routers.preview-domain-fallback-secure.rule=HostRegexp(`^pr-[a-z0-9-]+[.]my[.]obiente[.]cloud$$`)"
        - "traefik.http.routers.preview-domain-fallback-secure.entrypoints=websecure"
        - "traefik.http.routers.preview-domain-fallback-secure.priority=1"
        - "traefik.http.routers.preview-domain-fallback-secure.tls=true"
        - "traefik.http.routers.preview-domain-fallback-secure.service=deployments-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3005/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Databases Service - Microservice for managed database management
  databases-service:
    image: ghcr.io/obiente/cloud-databases-service:latest
    environment:
      PORT: 3014
      ENABLE_SWARM: ${ENABLE_SWARM:-true}
      DATABASES_SERVICE_MODE: control-plane
      <<: [*common-database, *common-metrics-db, *common-auth, *common-redis]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      placement:
        constraints:
          # Keep all node-local provisioning/lifecycle calls on the same Docker
          # daemon that owns managed database containers.
          - node.labels.databases.enabled == true
      labels:
        - "cloud.obiente.service=databases-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.databases-service.rule=Host(`databases-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.databases-service.entrypoints=web"
        - "traefik.http.services.databases-service.loadbalancer.server.port=3014"
        - "traefik.docker.network=obiente_obiente-network"  # Ensure Traefik targets the shared overlay network
        - "traefik.http.routers.databases-service-secure.rule=Host(`databases-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.databases-service-secure.entrypoints=websecure"
        - "traefik.http.routers.databases-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.databases-service-secure.service=databases-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3014/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network
      - obiente-databases
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  # Global data-plane proxy. Every possible database owner node exposes the
  # host-mode listeners used by owner-specific database DNS records.
  databases-proxy:
    image: ghcr.io/obiente/cloud-databases-service:latest
    environment:
      PORT: 3014
      ENABLE_SWARM: ${ENABLE_SWARM:-true}
      DATABASES_SERVICE_MODE: proxy
      <<: [*common-database, *common-metrics-db, *common-auth, *common-redis]
    deploy:
      mode: global
      update_config:
        parallelism: 1
        delay: 10s
        order: stop-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=databases-proxy"
        - "cloud.obiente.traefik=false"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3014/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network
      - obiente-databases
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - target: 5432
        published: 5432
        protocol: tcp
        mode: host
      - target: 3306
        published: 3306
        protocol: tcp
        mode: host
      - target: 27017
        published: 27017
        protocol: tcp
        mode: host
      # Redis uses port-per-instance in range 16379-16478 (host mode)

  # Game Servers Service - Microservice for game server management
  gameservers-service:
    image: ghcr.io/obiente/cloud-gameservers-service:latest
    environment:
      PORT: 3006
      DOMAIN: ${DOMAIN:-localhost}
      FILE_TRANSFER_PUBLIC_HOST: ${FILE_TRANSFER_PUBLIC_HOST:-}
      FILE_TRANSFER_SFTP_PUBLIC_PORT: ${FILE_TRANSFER_SFTP_PUBLIC_PORT:-2223}
      <<: [*common-database, *common-metrics-db, *common-auth, *common-swarm-orchestrator, *common-notifications, *common-redis]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/obiente/volumes:/var/lib/obiente/volumes
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "2"
          memory: 10G
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=gameservers-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.gameservers-service.rule=Host(`gameservers-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.gameservers-service.entrypoints=web"
        - "traefik.http.services.gameservers-service.loadbalancer.server.port=3006"
        - "traefik.http.routers.gameservers-service-secure.rule=Host(`gameservers-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.gameservers-service-secure.entrypoints=websecure"
        - "traefik.http.routers.gameservers-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.gameservers-service-secure.service=gameservers-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3006/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  file-transfer-service:
    image: ghcr.io/obiente/cloud-file-transfer-service:latest
    environment:
      PORT: 3022
      SFTP_PORT: 2222
      FILE_TRANSFER_VOLUME_ROOT: /var/lib/obiente/volumes
      SFTP_HOST_KEY_PATH: /var/lib/obiente/file-transfer/ssh_host_key
      <<: [*common-database, *common-auth, *common-redis]
    volumes:
      - /var/lib/obiente/volumes:/var/lib/obiente/volumes
      - file_transfer_host_key:/var/lib/obiente/file-transfer
    ports:
      - target: 2222
        published: ${FILE_TRANSFER_SFTP_PUBLIC_PORT:-2223}
        protocol: tcp
        mode: host
    deploy:
      mode: global
      update_config:
        parallelism: 1
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.05"
          memory: 64M
      labels:
        - "cloud.obiente.service=file-transfer-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.file-transfer-service.rule=Host(`file-transfer-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.file-transfer-service.entrypoints=web"
        - "traefik.http.services.file-transfer-service.loadbalancer.server.port=3022"
        - "traefik.http.routers.file-transfer-service-secure.rule=Host(`file-transfer-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.file-transfer-service-secure.entrypoints=websecure"
        - "traefik.http.routers.file-transfer-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.file-transfer-service-secure.service=file-transfer-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3022/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Orchestrator Service - Microservice for container orchestration and metrics
  orchestrator-service:
    image: ghcr.io/obiente/cloud-orchestrator-service:latest
    environment:
      PORT: 3007
      <<: [*common-database, *common-metrics-db, *common-redis, *common-swarm-orchestrator, *common-vps, *common-dns-delegation, *common-notifications]
      ORCHESTRATOR_SYNC_INTERVAL: ${ORCHESTRATOR_SYNC_INTERVAL:-30s}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "2"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 128M
      labels:
        - "cloud.obiente.service=orchestrator-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.orchestrator-service.rule=Host(`orchestrator-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.orchestrator-service.entrypoints=web"
        - "traefik.http.services.orchestrator-service.loadbalancer.server.port=3007"
        - "traefik.http.routers.orchestrator-service-secure.rule=Host(`orchestrator-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.orchestrator-service-secure.entrypoints=websecure"
        - "traefik.http.routers.orchestrator-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.orchestrator-service-secure.service=orchestrator-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3007/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # VPS Service - Microservice for VPS management
  vps-service:
    image: ghcr.io/obiente/cloud-vps-service:latest
    environment:
      PORT: 3008
      <<: [*common-database, *common-metrics-db, *common-auth, *common-swarm-orchestrator, *common-vps, *common-notifications, *common-redis]
    secrets:
      - ssh_proxy_host_key
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=vps-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.vps-service.rule=Host(`vps-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.vps-service.entrypoints=web"
        - "traefik.http.services.vps-service.loadbalancer.server.port=3008"
        - "traefik.http.routers.vps-service-secure.rule=Host(`vps-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.vps-service-secure.entrypoints=websecure"
        - "traefik.http.routers.vps-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.vps-service-secure.service=vps-service"
        # SSH TCP routing through Traefik (SSH proxy runs in vps-service)
        - "traefik.tcp.routers.ssh.rule=HostSNI(`*`)"
        - "traefik.tcp.routers.ssh.entrypoints=ssh"
        - "traefik.tcp.routers.ssh.service=ssh"
        - "traefik.tcp.services.ssh.loadbalancer.server.port=${SSH_PROXY_PORT:-2222}"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3008/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Support Service - Microservice for support ticket management
  support-service:
    image: ghcr.io/obiente/cloud-support-service:latest
    environment:
      PORT: 3009
      <<: [*common-database, *common-metrics-db, *common-auth]
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=support-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.support-service.rule=Host(`support-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.support-service.entrypoints=web"
        - "traefik.http.services.support-service.loadbalancer.server.port=3009"
        - "traefik.http.routers.support-service-secure.rule=Host(`support-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.support-service-secure.entrypoints=websecure"
        - "traefik.http.routers.support-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.support-service-secure.service=support-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3009/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Audit Service - Microservice for audit log management
  audit-service:
    image: ghcr.io/obiente/cloud-audit-service:latest
    environment:
      PORT: 3010
      <<: [*common-database, *common-metrics-db, *common-auth]
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=audit-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.audit-service.rule=Host(`audit-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.audit-service.entrypoints=web"
        - "traefik.http.services.audit-service.loadbalancer.server.port=3010"
        - "traefik.http.routers.audit-service-secure.rule=Host(`audit-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.audit-service-secure.entrypoints=websecure"
        - "traefik.http.routers.audit-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.audit-service-secure.service=audit-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3010/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  notifications-service:
    image: ghcr.io/obiente/cloud-notifications-service:latest
    environment:
      PORT: 3012
      <<: [*common-database, *common-metrics-db, *common-auth, *common-smtp, *common-dashboard, *common-notifications]
    deploy:
      mode: replicated
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=notifications-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.notifications-service.rule=Host(`notifications-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.notifications-service.entrypoints=web"
        - "traefik.http.services.notifications-service.loadbalancer.server.port=3012"
        - "traefik.http.routers.notifications-service-secure.rule=Host(`notifications-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.notifications-service-secure.entrypoints=websecure"
        - "traefik.http.routers.notifications-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.notifications-service-secure.service=notifications-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3012/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # Superadmin Service - Microservice for superadmin operations
  superadmin-service:
    image: ghcr.io/obiente/cloud-superadmin-service:latest
    environment:
      PORT: 3011
      <<: [*common-database, *common-metrics-db, *common-auth, *common-stripe, *common-swarm-orchestrator, *common-vps, *common-notifications]
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=superadmin-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.superadmin-service.rule=Host(`superadmin-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.superadmin-service.entrypoints=web"
        - "traefik.http.services.superadmin-service.loadbalancer.server.port=3011"
        - "traefik.http.routers.superadmin-service-secure.rule=Host(`superadmin-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.superadmin-service-secure.entrypoints=websecure"
        - "traefik.http.routers.superadmin-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.superadmin-service-secure.service=superadmin-service"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3011/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  # DNS Service - Microservice for DNS resolution
  # Set ENABLE_DNS=false to disable this service when using DNS delegation
  dns-service:
    image: ghcr.io/obiente/cloud-dns-service:latest
    environment:
      <<: [*common-database, *common-redis, *common-swarm-orchestrator, *common-dns, *common-dns-delegation]
      HTTP_PORT: ${DNS_HTTP_PORT:-8053}
    ports:
      # Use host mode publishing to expose DNS port directly on the host
      # DNS only runs on nodes labeled with dns.enabled=true
      # Published port uses DNS_PORT environment variable (default: 53)
      - target: 53
        published: ${DNS_PORT:-53}
        protocol: udp
        mode: host
      - target: 53
        published: ${DNS_PORT:-53}
        protocol: tcp
        mode: host
    cap_add:
      - NET_BIND_SERVICE
    deploy:
      mode: replicated
      replicas: ${DNS_REPLICAS:-1}
      placement:
        constraints:
          - node.labels.dns.enabled == true
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 10
        window: 60s
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.service=dns-service"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.dns-service.rule=Host(`dns-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.dns-service.entrypoints=web"
        - "traefik.http.services.dns-service.loadbalancer.server.port=8053"
        - "traefik.http.routers.dns-service-secure.rule=Host(`dns-service.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.dns-service-secure.entrypoints=websecure"
        - "traefik.http.routers.dns-service-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.dns-service-secure.service=dns-service"
        - "traefik.docker.network=obiente_obiente-network"  # Use overlay network IP, not ingress network
    healthcheck:
      # Check HTTP port (8053) instead of DNS port (53) since HTTP server always runs
      # even when ENABLE_DNS=false, and this is what Traefik routes to
      test: ["CMD-SHELL", "curl -sf http://localhost:${HTTP_PORT:-8053}/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    dns_search: []
    networks:
      - obiente-network

  traefik:
    image: traefik:v3.6.1
    secrets:
      - source: preview_tls_cert
        target: preview_tls_cert
        mode: 0400
      - source: preview_tls_key
        target: preview_tls_key
        mode: 0400
    configs:
      - source: preview_tls_config
        target: /etc/traefik/dynamic/preview-tls.yml
        mode: 0444
    command:
      - --api.dashboard=true
      - --api.insecure=true  # Enable API on port 8080 directly
      - --providers.swarm=true  # Use Swarm provider for Docker Swarm mode (v3.0)
      - --providers.swarm.exposedbydefault=false
      - --providers.swarm.watch=true  # Watch for service changes
      - --providers.swarm.constraints=Label(`cloud.obiente.traefik`,`true`)  # Only discover services with this label
      - --providers.file.filename=/etc/traefik/dynamic/preview-tls.yml
      - --providers.file.watch=true
      # Timeout configuration to fail faster on unreachable backends
      # dialTimeout: time to establish connection (increased to 10s to handle network delays)
      - --serversTransport.forwardingTimeouts.dialTimeout=10s
      # responseHeaderTimeout: time to wait for response headers
      - --serversTransport.forwardingTimeouts.responseHeaderTimeout=15s
      # idleConnTimeout: time to keep idle connections open
      - --serversTransport.forwardingTimeouts.idleConnTimeout=90s
      - --entryPoints.web.address=:80
      - --entryPoints.web.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      - --entryPoints.websecure.address=:443
      - --entryPoints.websecure.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      - --entryPoints.deployments.address=:8000
      - --entryPoints.deployments.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      - --entryPoints.ssh.address=:${SSH_PROXY_PORT:-2222}
      - --entryPoints.ssh.proxyProtocol.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
      # Database TCP ports are handled by databases-service proxy (not Traefik)
      # Port 8080 is used by Traefik API (--api.insecure=true)
      # Grafana is accessible via port 80/443 at /grafana
      # Let's Encrypt
      - --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:-admin@example.com}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      # Use Let's Encrypt staging environment if ACME_CA_SERVER is set to staging URL
      # Set ACME_CA_SERVER=https://acme-staging-v02.api.letsencrypt.org/directory to avoid rate limits during testing
      # Default: production (https://acme-v02.api.letsencrypt.org/directory)
      - --certificatesresolvers.letsencrypt.acme.caserver=${ACME_CA_SERVER:-https://acme-v02.api.letsencrypt.org/directory}
      # Metrics
      - --metrics.prometheus=true
      # Logging
      - --accesslog=true
      - --log.level=DEBUG  # Enable debug logging to see service discovery
    ports:
      - target: 80
        published: ${TRAEFIK_HTTP_PORT:-80}
        protocol: tcp
        mode: host  # host mode preserves real client IPs (ingress mode causes SNAT)
      - target: 443
        published: ${TRAEFIK_HTTPS_PORT:-443}
        protocol: tcp
        mode: host  # host mode preserves real client IPs (ingress mode causes SNAT)
      - target: 8000
        published: ${TRAEFIK_DEPLOYMENTS_PORT:-8000}
        protocol: tcp
        mode: host  # host mode preserves real client IPs (ingress mode causes SNAT)
      - target: 8080
        published: ${TRAEFIK_DASHBOARD_PORT:-8080}
        protocol: tcp
        mode: host
      - target: ${SSH_PROXY_PORT:-2222}
        published: ${TRAEFIK_SSH_PORT:-2222}
        protocol: tcp
        mode: host  # host mode preserves real client IPs for SSH connections
      # Database ports are handled by databases-service proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_letsencrypt:/letsencrypt
    deploy:
      mode: global  # Run one instance on each manager node
      update_config:
        parallelism: 1
        # Host-published ports cannot be held by old and replacement tasks on
        # the same node at once.
        order: stop-first
      placement:
        constraints:
          - node.role == manager  # Only run on manager nodes
          - node.labels.traefik.exclude != true  # Exclude nodes labeled with traefik.exclude=true
      resources:
        limits:
          cpus: "2"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.ingress-proxy=true"
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        # Traefik dashboard accessible directly on port 8080 via --api.insecure=true
        # Also route Traefik dashboard via HTTPS
        - "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.traefik.entrypoints=websecure"
        - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
        - "traefik.http.routers.traefik.service=api@internal"
        - "traefik.http.services.traefik.loadbalancer.server.port=8080"
    dns_search: []
    networks:
      - obiente-network
      - obiente-preview-ingress

  # ============================================================================
  # MONITORING & OBSERVABILITY
  # ============================================================================

  # Prometheus - Metrics collection
  prometheus:
    image: prom/prometheus:latest
    user: "0:0"  # Run as root to access Docker socket for Swarm service discovery
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=15d"
    volumes:
      - prometheus_data:/prometheus
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro  # Required for Docker Swarm service discovery
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          cpus: "2"
          memory: 2G
        reservations:
          cpus: "0.25"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.prometheus.rule=Host(`prometheus.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.prometheus.entrypoints=websecure"
        - "traefik.http.routers.prometheus.tls.certresolver=letsencrypt"
        - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
    dns_search: []
    networks:
      - obiente-network

  # Grafana - Metrics visualization dashboard accessible at /grafana via Traefik
  grafana:
    image: grafana/grafana:latest
    user: "0:0"  # Run as root for entrypoint script to write provisioning files
    entrypoint: ["/bin/sh", "/etc/grafana/entrypoint.sh"]
    command: ["/run.sh"]
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-admin}
      GF_SERVER_ROOT_URL: https://grafana.${DOMAIN:-localhost}
      # Disable strict provisioning validation to avoid conflicts
      GF_PROVISIONING_DATASOURCES_ALLOW_DELETION: "true"
      # Allow unsigned plugins (for lokiexplore-app and other community plugins)
      GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS: "grafana-lokiexplore-app"
      # Pass database credentials as environment variables for datasource provisioning
      POSTGRES_USER: ${POSTGRES_USER:-obiente_postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-obiente_postgres}
      METRICS_DB_USER: ${METRICS_DB_USER:-obiente_postgres}
      METRICS_DB_PASSWORD: ${METRICS_DB_PASSWORD:-obiente_postgres}
      # Datasource host configuration (for regular swarm, use direct service names)
      GRAFANA_POSTGRES_HOST: ${GRAFANA_POSTGRES_HOST:-postgres}
      GRAFANA_METRICS_DB_HOST: ${GRAFANA_METRICS_DB_HOST:-timescaledb}
      # Alerting configuration
      ALERT_EMAIL: ${ALERT_EMAIL:-admin@example.com}
      # SMTP configuration for Grafana email notifications (only set if SMTP_HOST is configured)
      # These will be conditionally set by the entrypoint script
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM_ADDRESS: ${SMTP_FROM_ADDRESS:-}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-Grafana}
      SMTP_SKIP_TLS_VERIFY: ${SMTP_SKIP_TLS_VERIFY:-false}
      SMTP_USE_STARTTLS: ${SMTP_USE_STARTTLS:-true}
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:rw
      - ./monitoring/grafana/dashboards:/etc/grafana/dashboards:ro
      - ./monitoring/grafana/entrypoint.sh:/etc/grafana/entrypoint.sh:ro
    depends_on:
      - prometheus
      - postgres
      - timescaledb
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        # Route Grafana at grafana.domain (Host-based routing)
        - "traefik.http.routers.grafana.rule=Host(`grafana.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.grafana.entrypoints=web"
        - "traefik.http.routers.grafana.service=grafana"
        - "traefik.http.services.grafana.loadbalancer.server.port=3000"
        # Route Grafana on HTTPS for production access
        - "traefik.http.routers.grafana-secure.rule=Host(`grafana.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.grafana-secure.entrypoints=websecure"
        - "traefik.http.routers.grafana-secure.tls.certresolver=letsencrypt"
        - "traefik.http.routers.grafana-secure.service=grafana"
    dns_search: []
    networks:
      - obiente-network

  # Docker Registry - Host images for Swarm deployments
  registry:
    image: registry:2
    environment:
      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /var/lib/registry
      REGISTRY_HTTP_ADDR: 0.0.0.0:5000
      # Allow deletion of images (useful for cleanup)
      REGISTRY_STORAGE_DELETE_ENABLED: "true"
      # Enable basic auth for private repositories
      REGISTRY_AUTH: htpasswd
      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
      REGISTRY_AUTH_HTPASSWD_REALM: "Obiente Cloud Registry"
    volumes:
      - registry_data:/var/lib/registry
      # Use bind mount for auth directory to allow easy setup from host
      - /var/lib/obiente/registry-auth:/auth:ro
    healthcheck:
      test: ["CMD-SHELL", "sh -c 'if command -v nc >/dev/null 2>&1; then nc -z localhost 5000 || exit 1; else (apk add --no-cache netcat-openbsd >/dev/null 2>&1 || apt-get update -qq && apt-get install -y -qq netcat-openbsd >/dev/null 2>&1 || yum install -y -q nc >/dev/null 2>&1) && nc -z localhost 5000 || exit 1; fi'"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          cpus: "2"
          memory: 512M
        reservations:
          cpus: "0.1"
          memory: 128M
      labels:
        - "cloud.obiente.traefik=true"
        - "traefik.enable=true"
        - "traefik.http.routers.registry.rule=Host(`registry.${DOMAIN:-localhost}`)"
        - "traefik.http.routers.registry.entrypoints=websecure"
        - "traefik.http.routers.registry.tls.certresolver=letsencrypt"
        - "traefik.http.routers.registry.service=registry"
        - "traefik.http.services.registry.loadbalancer.server.port=5000"
    dns_search: []
    networks:
      - obiente-network

  # Note: Dashboard is deployed separately using docker-compose.dashboard.yml
  # Run: ./scripts/deploy-swarm.sh to deploy both main stack and dashboard
  # Note: vps-gateway service is deployed separately using docker-compose.vps-gateway.yml
  # It should be deployed on the gateway VM/container with network_mode: host

volumes:
  postgres_data:
    driver: local
  timescaledb_data:
    driver: local
  redis_data:
    driver: local
  traefik_letsencrypt:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  registry_data:
    driver: local
  file_transfer_host_key:
    driver: local

networks:
  obiente-network:
    driver: overlay
    attachable: true
    driver_opts:
      encrypted: "true"
    ipam:
      config:
        - subnet: 10.15.3.0/24
    # Docker Swarm will automatically create this network when the stack is deployed
    # Network name will be: {stack-name}_obiente-network (e.g., obiente_obiente-network)
  obiente-preview-ingress:
    name: obiente-preview-ingress
    driver: overlay
    attachable: true
    driver_opts:
      encrypted: "true"
  obiente-databases:
    # Fixed name so API-created database containers can join this network
    name: obiente-databases
    driver: overlay
    attachable: true
    driver_opts:
      encrypted: "true"

configs:
  preview_tls_config:
    file: ./scripts/internal/traefik-preview-tls.yml
  # Custom pg_hba.conf file
  postgres_hba_conf:
    file: ./scripts/internal/pg_hba.conf
  # Init script to copy pg_hba.conf to PGDATA
  postgres_hba_init:
    file: ./scripts/internal/init-pg-hba.sh

secrets:
  preview_tls_cert:
    name: ${PREVIEW_TLS_CERT_SECRET:-preview_tls_cert}
    external: true
  preview_tls_key:
    name: ${PREVIEW_TLS_KEY_SECRET:-preview_tls_key}
    external: true
  ssh_proxy_host_key:
    external: true
    # This secret must be created before deploying the stack:
    # 1. Generate a key: ssh-keygen -t rsa -b 2048 -f ssh_proxy_host_key -N ""
    # 2. Create the secret: docker secret create ssh_proxy_host_key ssh_proxy_host_key
    # 3. Remove the local file: rm ssh_proxy_host_key ssh_proxy_host_key.pub
    #
    # This ensures all vps-service replicas use the same SSH host key,
    # preventing "REMOTE HOST IDENTIFICATION HAS CHANGED" warnings for clients.