docker-compose.middleware.yml

# NDSEP Middleware Stack — Docker Compose
# Run: docker compose -f docker-compose.middleware.yml up -d
# Provides all 10 middleware services required by NDSEP
# Services: Kafka, Redis, Dapr, Fluvio, Temporal, Keycloak, Permify, APISIX, TigerBeetle, Iceberg

version: "3.9"

networks:
  ndsep-net:
    driver: bridge

volumes:
  redis_data:
  minio_data:
  pg_data:
  fluvio_data:
  kafka_data:

services:

  # ─── PostgreSQL (shared by Temporal + NDSEP) ──────────────────────────────
  postgresql:
    image: postgres:15-alpine
    networks: [ndsep-net]
    ports: ["5432:5432"]
    environment:
      POSTGRES_USER: ndsep_user
      POSTGRES_PASSWORD: ndsep_secure_2026
      POSTGRES_DB: ndsep_db
    volumes: [pg_data:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ndsep_user -d ndsep_db"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ─── Kafka (Confluent) ────────────────────────────────────────────────────
  zookeeper:
    image: confluentinc/cp-zookeeper:7.5.0
    networks: [ndsep-net]
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000
    healthcheck:
      test: ["CMD", "bash", "-c", "echo ruok | nc localhost 2181"]
      interval: 10s
      timeout: 5s
      retries: 5

  kafka:
    image: confluentinc/cp-kafka:7.5.0
    networks: [ndsep-net]
    depends_on:
      zookeeper:
        condition: service_healthy
    ports: ["9092:9092"]
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://localhost:9092,PLAINTEXT_INTERNAL://kafka:29092
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,PLAINTEXT_INTERNAL:PLAINTEXT
      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT_INTERNAL
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
    volumes: [kafka_data:/var/lib/kafka/data]
    healthcheck:
      test: ["CMD", "kafka-broker-api-versions", "--bootstrap-server", "localhost:9092"]
      interval: 15s
      timeout: 10s
      retries: 5

  # ─── Redis ────────────────────────────────────────────────────────────────
  redis:
    image: redis:7-alpine
    networks: [ndsep-net]
    ports: ["6379:6379"]
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    volumes: [redis_data:/data]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ─── Dapr Placement Service ───────────────────────────────────────────────
  dapr-placement:
    image: daprio/dapr:1.13.0
    networks: [ndsep-net]
    command: ["./placement", "-port", "50005", "-log-level", "warn"]
    ports: ["50005:50005"]
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:50005/healthz"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ─── Fluvio ───────────────────────────────────────────────────────────────
  fluvio:
    image: infinyon/fluvio:latest
    networks: [ndsep-net]
    ports: ["9003:9003", "9010:9010"]
    command: ["fluvio", "cluster", "start", "--local"]
    volumes: [fluvio_data:/var/lib/fluvio]
    environment:
      FLUVIO_CLUSTER_NAME: ndsep-cluster
    healthcheck:
      test: ["CMD", "fluvio", "cluster", "status"]
      interval: 15s
      timeout: 10s
      retries: 5

  # ─── Temporal ─────────────────────────────────────────────────────────────
  temporal:
    image: temporalio/auto-setup:1.24.2
    networks: [ndsep-net]
    depends_on:
      postgresql:
        condition: service_healthy
    ports: ["7233:7233"]
    environment:
      DB: postgresql
      DB_PORT: 5432
      POSTGRES_USER: ndsep_user
      POSTGRES_PWD: ndsep_secure_2026
      POSTGRES_SEEDS: postgresql
      TEMPORAL_ADDRESS: temporal:7233
      DYNAMIC_CONFIG_FILE_PATH: /etc/temporal/config/dynamicconfig/development-sql.yaml
    healthcheck:
      test: ["CMD", "tctl", "--address", "temporal:7233", "cluster", "health"]
      interval: 15s
      timeout: 10s
      retries: 10

  temporal-ui:
    image: temporalio/ui:2.26.2
    networks: [ndsep-net]
    depends_on:
      temporal:
        condition: service_healthy
    ports: ["8233:8080"]
    environment:
      TEMPORAL_ADDRESS: temporal:7233
      TEMPORAL_CORS_ORIGINS: http://localhost:3000

  # ─── Keycloak ─────────────────────────────────────────────────────────────
  keycloak:
    image: quay.io/keycloak/keycloak:24.0.1
    networks: [ndsep-net]
    command: start-dev --import-realm
    ports: ["8180:8080"]
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: ndsep_admin_2026
      KC_DB: dev-mem
      KC_HEALTH_ENABLED: "true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/health/ready || exit 1"]
      interval: 15s
      timeout: 10s
      retries: 10

  # ─── Permify ──────────────────────────────────────────────────────────────
  permify:
    image: ghcr.io/permify/permify:v0.9.6
    networks: [ndsep-net]
    ports: ["3476:3476", "3478:3478"]
    command: serve
    environment:
      PERMIFY_DATABASE_ENGINE: memory
      PERMIFY_LOG_LEVEL: warn
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3476/healthz"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ─── APISIX ───────────────────────────────────────────────────────────────
  apisix-etcd:
    image: bitnami/etcd:3.5.12
    networks: [ndsep-net]
    environment:
      ALLOW_NONE_AUTHENTICATION: "yes"
      ETCD_ADVERTISE_CLIENT_URLS: http://apisix-etcd:2379
    healthcheck:
      test: ["CMD", "etcdctl", "endpoint", "health"]
      interval: 10s
      timeout: 5s
      retries: 5

  apisix:
    image: apache/apisix:3.9.0-debian
    networks: [ndsep-net]
    ports: ["9080:9080", "9180:9180"]
    volumes:
      - ./apisix/config.yaml:/usr/local/apisix/conf/config.yaml:ro
    depends_on:
      apisix-etcd:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9180/apisix/admin/routes", "-H", "X-API-KEY: ndsep-apisix-key-2026"]
      interval: 15s
      timeout: 10s
      retries: 5

  # ─── TigerBeetle HTTP Proxy ───────────────────────────────────────────────
  # Note: TigerBeetle requires a data file. Initialize with:
  # docker run --rm -v tigerbeetle_data:/data ghcr.io/tigerbeetle/tigerbeetle format --cluster=0 --replica=0 --replica-count=1 /data/0_0.tigerbeetle
  tigerbeetle:
    image: ghcr.io/tigerbeetle/tigerbeetle:latest
    networks: [ndsep-net]
    ports: ["3000:3000"]
    command: start --addresses=0.0.0.0:3000 /data/0_0.tigerbeetle
    volumes:
      - tigerbeetle_data:/data

  tigerbeetle-proxy:
    image: node:20-alpine
    networks: [ndsep-net]
    ports: ["3901:3901"]
    depends_on: [tigerbeetle]
    environment:
      TIGERBEETLE_ADDRESS: tigerbeetle:3000
      PORT: "3901"
    command: >
      sh -c "npm install -g @tigerbeetle/tigerbeetle-node-http-proxy 2>/dev/null ||
             npx --yes @tigerbeetle/node-http-proxy --address tigerbeetle:3000 --port 3901"

  # ─── Apache Iceberg REST Catalog ──────────────────────────────────────────
  minio:
    image: minio/minio:RELEASE.2024-01-16T16-07-38Z
    networks: [ndsep-net]
    ports: ["9000:9000", "9001:9001"]
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    volumes: [minio_data:/data]
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 5

  iceberg-rest:
    image: tabulario/iceberg-rest:0.10.0
    networks: [ndsep-net]
    ports: ["8181:8181"]
    depends_on:
      minio:
        condition: service_healthy
    environment:
      CATALOG_WAREHOUSE: s3://ndsep-lakehouse/
      CATALOG_IO__IMPL: org.apache.iceberg.aws.s3.S3FileIO
      CATALOG_S3_ENDPOINT: http://minio:9000
      CATALOG_S3_ACCESS__KEY__ID: minioadmin
      CATALOG_S3_SECRET__ACCESS__KEY: minioadmin
      CATALOG_S3_PATH__STYLE__ACCESS: "true"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8181/v1/config"]
      interval: 15s
      timeout: 10s
      retries: 5

volumes:
  redis_data:
  minio_data:
  pg_data:
  fluvio_data:
  kafka_data:
  tigerbeetle_data:

  # ─── Phase 25 Workers ─────────────────────────────────────────────────────
  # Go Workers (ports 8150-8153)
  dapr-bridge:
    build:
      context: ./workers/go
      dockerfile: Dockerfile
      args:
        WORKER: dapr_bridge
    networks: [ndsep-net]
    ports: ["8150:8150"]
    environment:
      PORT: "8150"
      DAPR_HOST: dapr-sidecar
      DAPR_PORT: "3500"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8150/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  fluvio-relay:
    build:
      context: ./workers/go
      dockerfile: Dockerfile
      args:
        WORKER: fluvio_relay
    networks: [ndsep-net]
    ports: ["8151:8151"]
    environment:
      PORT: "8151"
      FLUVIO_ENDPOINT: fluvio:9003
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8151/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  mojaloop-adapter:
    build:
      context: ./workers/go
      dockerfile: Dockerfile
      args:
        WORKER: mojaloop_adapter
    networks: [ndsep-net]
    ports: ["8152:8152"]
    environment:
      PORT: "8152"
      MOJALOOP_HUB_URL: http://ml-api-adapter:3000
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8152/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  apisix-manager:
    build:
      context: ./workers/go
      dockerfile: Dockerfile
      args:
        WORKER: apisix_manager
    networks: [ndsep-net]
    ports: ["8153:8153"]
    environment:
      PORT: "8153"
      APISIX_ADMIN_URL: http://apisix:9180
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8153/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  # Rust Workers (ports 8160-8163)
  tigerbeetle-worker:
    build:
      context: ./workers/rust
      dockerfile: Dockerfile
      args:
        WORKER: tigerbeetle_ledger
    networks: [ndsep-net]
    ports: ["8160:8160"]
    environment:
      PORT: "8160"
      TIGERBEETLE_ADDRESS: tigerbeetle:3000
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8160/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  opensearch-indexer:
    build:
      context: ./workers/rust
      dockerfile: Dockerfile
      args:
        WORKER: opensearch_indexer
    networks: [ndsep-net]
    ports: ["8161:8161"]
    environment:
      PORT: "8161"
      OPENSEARCH_URL: http://opensearch:9200
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8161/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  keycloak-validator:
    build:
      context: ./workers/rust
      dockerfile: Dockerfile
      args:
        WORKER: keycloak_validator
    networks: [ndsep-net]
    ports: ["8162:8162"]
    environment:
      PORT: "8162"
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_REALM: ndsep
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8162/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  lakehouse-ingest:
    build:
      context: ./workers/rust
      dockerfile: Dockerfile
      args:
        WORKER: lakehouse_ingest
    networks: [ndsep-net]
    ports: ["8163:8163"]
    environment:
      PORT: "8163"
      ICEBERG_REST_URL: http://iceberg-rest:8181
      S3_ENDPOINT: http://minio:9000
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8163/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  # Python Workers (ports 8164-8167)
  permify-rbac-sync:
    build:
      context: ./workers/python
      dockerfile: Dockerfile
    networks: [ndsep-net]
    ports: ["8164:8164"]
    command: ["python3", "permify_rbac_sync.py"]
    environment:
      PORT: "8164"
      PERMIFY_URL: http://permify:3476
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8164/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  fluvio-consumer:
    build:
      context: ./workers/python
      dockerfile: Dockerfile
    networks: [ndsep-net]
    ports: ["8165:8165"]
    command: ["python3", "fluvio_consumer.py"]
    environment:
      PORT: "8165"
      FLUVIO_ENDPOINT: fluvio:9003
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8165/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  opensearch-query:
    build:
      context: ./workers/python
      dockerfile: Dockerfile
    networks: [ndsep-net]
    ports: ["8166:8166"]
    command: ["python3", "opensearch_query_service.py"]
    environment:
      PORT: "8166"
      OPENSEARCH_URL: http://opensearch:9200
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8166/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  dapr-state-bridge:
    build:
      context: ./workers/python
      dockerfile: Dockerfile
    networks: [ndsep-net]
    ports: ["8167:8167"]
    command: ["python3", "dapr_state_bridge.py"]
    environment:
      PORT: "8167"
      DAPR_HOST: dapr-sidecar
      DAPR_PORT: "3500"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8167/health"]
      interval: 30s
      timeout: 5s
      retries: 3