docker-compose.yml

services:
  # TJudge CLI - образ для запуска матчей (только сборка)
  tjudge-cli:
    build:
      context: .
      dockerfile: docker/tjudge/Dockerfile
    image: tjudge-cli:latest
    entrypoint: ["echo", "tjudge-cli image built successfully"]
    restart: "no"
    networks:
      - tjudge-network

  # Песочница компиляции загруженных программ (только сборка).
  # Без этого образа программы зависают в failed: worker компилирует
  # их в изолированном tjudge-builder контейнере (network none).
  tjudge-builder:
    build:
      context: .
      dockerfile: docker/builder/Dockerfile
    image: tjudge-builder:latest
    entrypoint: ["echo", "tjudge-builder image built successfully"]
    restart: "no"
    networks:
      - tjudge-network

  # PostgreSQL Database
  postgres:
    image: postgres:15-alpine
    container_name: tjudge-postgres
    environment:
      POSTGRES_DB: ${DB_NAME:-tjudge}
      POSTGRES_USER: ${DB_USER:-tjudge}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-secret}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8"
    ports:
      - "5433:5432"  # 5433 on host to avoid conflict with local PostgreSQL
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U tjudge"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - tjudge-network
      - monitoring
    labels:
      monitoring: "enabled"
      prometheus_service: "database"

  # Redis Cache
  redis:
    image: redis:7-alpine
    container_name: tjudge-redis
    command: redis-server --appendonly yes --maxmemory ${REDIS_MAXMEMORY:-512mb} --maxmemory-policy volatile-lru --save 900 1 --save 300 10 --save 60 10000
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - tjudge-network
      - monitoring
    labels:
      monitoring: "enabled"
      prometheus_service: "cache"

  # Database migrations
  migrate:
    build:
      context: .
      dockerfile: docker/migrate/Dockerfile
    container_name: tjudge-migrate
    environment:
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=${DB_USER:-tjudge}
      - DB_PASSWORD=${DB_PASSWORD:-secret}
      - DB_NAME=${DB_NAME:-tjudge}
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - tjudge-network
    restart: "no"

  # API Server
  api:
    build:
      context: .
      dockerfile: docker/api/Dockerfile
    container_name: tjudge-api
    ports:
      - "8080:8080"
      - "9090:9090"  # Metrics port
    environment:
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=${DB_USER:-tjudge}
      - DB_PASSWORD=${DB_PASSWORD:-secret}
      - DB_NAME=${DB_NAME:-tjudge}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - JWT_SECRET=${JWT_SECRET:-dev-secret-key-change-in-production}
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - LOG_FORMAT=json
      - METRICS_ENABLED=true
      - METRICS_PORT=9090
      - PROGRAMS_PATH=/data/programs
      - BASE_URL=${BASE_URL:-http://localhost:8080}
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    restart: unless-stopped
    volumes:
      - ./data/programs:/data/programs
    networks:
      - tjudge-network
      - monitoring
    labels:
      monitoring: "enabled"
      prometheus_job: "tjudge-api"
      prometheus_port: "9090"
      prometheus_service: "api"
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "-", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

  # Worker Pool
  worker:
    build:
      context: .
      dockerfile: docker/worker/Dockerfile
      args:
        DOCKER_GID: ${DOCKER_GID:-999}
    container_name: tjudge-worker
    # DEV-compose: на macOS/Docker Desktop host docker.sock owned by root:daemon (GID 1),
    # поэтому для локалки допустим root. В проде используйте docker-compose.selfhosted.yml
    # (или prod), где worker запускается от non-root appuser в docker-группе.
    # Чтобы переопределить на Linux: WORKER_USER=1000:999 docker compose up.
    user: "${WORKER_USER:-root}"
    ports:
      - "9091:9090"  # Metrics port
    environment:
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=${DB_USER:-tjudge}
      - DB_PASSWORD=${DB_PASSWORD:-secret}
      - DB_NAME=${DB_NAME:-tjudge}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - WORKER_MIN=${WORKER_MIN:-2}
      - WORKER_MAX=${WORKER_MAX:-10}
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - LOG_FORMAT=json
      - METRICS_ENABLED=true
      - METRICS_PORT=9090
      - PROGRAMS_PATH=/data/programs
      - HOST_PROGRAMS_PATH=${HOST_PROGRAMS_PATH:-./data/programs}
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
      tjudge-cli:
        condition: service_completed_successfully
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data/programs:/data/programs
    networks:
      - tjudge-network
      - monitoring
    labels:
      monitoring: "enabled"
      prometheus_job: "tjudge-worker"
      prometheus_port: "9090"
      prometheus_service: "worker"

# Monitoring stack (Prometheus, Grafana, Loki, Promtail, Alertmanager)
# вынесен в deployments/monitoring/docker-compose.yml как отдельный shared-стек,
# работающий через внешнюю docker-сеть `monitoring`. См. deployments/monitoring/README.md.

volumes:
  postgres_data:
  redis_data:

networks:
  tjudge-network:
    driver: bridge
  monitoring:
    name: monitoring
    external: true