# =============================================================================
# DC Overview - Docker Compose Configuration
# Generated by: dc-overview setup
# =============================================================================

services:
  # ===========================================================================
  # DC Overview - Main Application
  # ===========================================================================
  dc-overview:
    image: ghcr.io/cryptolabsza/dc-overview:{{ image_tag | default('latest') }}
    container_name: dc-overview
    restart: unless-stopped
{% if not enable_proxy %}
    ports:
      - "{{ dc_port | default(5001) }}:{{ dc_port | default(5001) }}"
{% endif %}
    environment:
      - DC_OVERVIEW_PORT={{ dc_port | default(5001) }}
      - SECRET_KEY=${SECRET_KEY}
      - GRAFANA_URL=http://grafana:3000
      - PROMETHEUS_URL=http://prometheus:9090
{% if enable_proxy %}
      - APPLICATION_ROOT=/dc
{% endif %}
    volumes:
      - dc_data:/data
      - ./prometheus_targets.json:/data/prometheus_targets.json
{% if ssh_keys_dir %}
      - ./ssh_keys:/etc/dc-overview/ssh_keys:ro
{% endif %}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:{{ dc_port | default(5001) }}/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
{% if enable_watchtower_all %}
    labels:
      com.centurylinklabs.watchtower.enable: "true"
{% endif %}
    networks:
      - cryptolabs

  # ===========================================================================
  # Prometheus - Metrics Collection
  # ===========================================================================
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
{% if not enable_proxy %}
    ports:
      - "{{ prometheus_port | default(9090) }}:9090"
{% endif %}
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./prometheus_targets.json:/etc/prometheus/targets/dc_targets.json:ro
      - prometheus_data:/prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.retention.time={{ retention_time | default('30d') }}"
{% if enable_proxy %}
      - "--web.external-url=/prometheus/"
      - "--web.route-prefix=/prometheus/"
{% endif %}
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:9090/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
{% if enable_watchtower_all %}
    labels:
      com.centurylinklabs.watchtower.enable: "true"
{% endif %}
    networks:
      - cryptolabs

  # ===========================================================================
  # Grafana - Visualization
  # ===========================================================================
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
{% if not enable_proxy %}
    ports:
      - "{{ grafana_port | default(3000) }}:3000"
{% endif %}
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}
{% if enable_proxy %}
      - GF_SERVER_ROOT_URL=%(protocol)s://%(domain)s{{ ':' ~ external_port if external_port and external_port != 443 else '' }}/grafana/
      - GF_SERVER_SERVE_FROM_SUB_PATH=true
      # Proxy authentication - allows Fleet Management to pass auth headers
      - GF_AUTH_ANONYMOUS_ENABLED=false
      - GF_AUTH_DISABLE_LOGIN_FORM=true
      - GF_AUTH_PROXY_ENABLED=true
      - GF_AUTH_PROXY_HEADER_NAME=X-WEBAUTH-USER
      - GF_AUTH_PROXY_HEADER_PROPERTY=username
      - GF_AUTH_PROXY_AUTO_SIGN_UP=true
      # Role sync from proxy - maps X-WEBAUTH-ROLE header to Grafana roles
      - GF_AUTH_PROXY_HEADERS=Role:X-WEBAUTH-ROLE
      - GF_AUTH_PROXY_ENABLE_LOGIN_TOKEN=false
      # Sync user role on each request (requires Grafana 9.4+)
      - GF_AUTH_PROXY_SYNC_TTL=60
{% endif %}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-piechart-panel
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
      - ./grafana/dashboards:/var/lib/grafana/dashboards:ro
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    start_period: 30s
{% if enable_watchtower_all %}
    labels:
      com.centurylinklabs.watchtower.enable: "true"
{% endif %}
    networks:
      - cryptolabs

{# cryptolabs-proxy always has watchtower label; cryptolabs-watchtower deployed when proxy enabled #}

{% if enable_proxy %}
  # ===========================================================================
  # CryptoLabs Proxy - Unified Reverse Proxy with SSL
  # Always has watchtower label (primary auto-update target)
  # ===========================================================================
  cryptolabs-proxy:
    image: ghcr.io/cryptolabsza/cryptolabs-proxy:{{ proxy_tag | default('latest') }}
    container_name: cryptolabs-proxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./ssl:/etc/nginx/ssl:ro
{% if use_letsencrypt %}
      - ./certbot/conf:/etc/letsencrypt:ro
      - ./certbot/www:/var/www/certbot:ro
{% endif %}
    depends_on:
      - dc-overview
      - prometheus
      - grafana
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    networks:
      - cryptolabs

  # cryptolabs-watchtower - auto-updates cryptolabs-proxy (default) and other labeled containers when opted in
  cryptolabs-watchtower:
    image: containrrr/watchtower
    container_name: cryptolabs-watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_POLL_INTERVAL=300
      - WATCHTOWER_LABEL_ENABLE=true
      - WATCHTOWER_INCLUDE_STOPPED=true
      - WATCHTOWER_ROLLING_RESTART=true
    networks:
      - cryptolabs
    labels:
      com.centurylinklabs.watchtower.enable: "true"
{% endif %}

{% if vast_enabled %}
  # ===========================================================================
  # Vast.ai Exporter - Earnings & Reliability Metrics
  # ===========================================================================
  vastai-exporter:
    image: ghcr.io/cryptolabsza/vastai-exporter:latest
    container_name: vastai-exporter
    restart: unless-stopped
    ports:
      - "8622:8622"
    command:
      - "-api-key"
      - "${VAST_API_KEY}"
{% if enable_watchtower_all %}
    labels:
      com.centurylinklabs.watchtower.enable: "true"
{% endif %}
    networks:
      - cryptolabs
{% endif %}

# =============================================================================
# Volumes
# =============================================================================
volumes:
  dc_data:
    name: dc-overview-data
  prometheus_data:
    name: prometheus-data
  grafana_data:
    name: grafana-data

# =============================================================================
# Networks
# =============================================================================
networks:
  cryptolabs:
    name: cryptolabs
    driver: bridge
