docker-compose.yml

# Persys Cloud Full Stack Docker Compose
#
# This file defines all core services for local development and integration:
# - Persys Gateway, Persys Scheduler, Persys Automation, Persys Forgery, Persys Federation, Persys Intelligence,CoreDNS, Hashicorp Vault, MongoDB, MySQL, Postgres, Prometheus, Grafana, Jaeger, etcd, Node Exporter
# - All services are connected via the 'persys-cloud-net' bridge network

services:

  # --- Persys Gateway (Entry point for all API requests) ---
  persys-gateway:
    build: ../../persys-gateway
    ports:
      - 8551:8551
    depends_on:
      - mongodb
      - vault
      - coredns
      - jaeger
    environment:
      - OTEL_EXPORTER_JAEGER_ENDPOINT=${OTEL_EXPORTER_JAEGER_ENDPOINT:-jaeger:4318}
      - OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT:-jaeger:4318}
      - PERSYS_VAULT_ADDR=${PERSYS_GATEWAY_VAULT_ADDR:-http://vault:8200}
      - PERSYS_VAULT_AUTH_METHOD=${PERSYS_GATEWAY_VAULT_AUTH_METHOD:-approle}
      - PERSYS_VAULT_TOKEN=${PERSYS_GATEWAY_VAULT_TOKEN:-}
      - PERSYS_GATEWAY_VAULT_ADDR=${PERSYS_GATEWAY_VAULT_ADDR:-http://vault:8200}
      - PERSYS_GATEWAY_VAULT_ROLE_ID=${PERSYS_GATEWAY_VAULT_ROLE_ID:-}
      - PERSYS_GATEWAY_VAULT_SECRET_ID=${PERSYS_GATEWAY_VAULT_SECRET_ID:-}
      - PERSYS_GATEWAY_MONGO_URI=${PERSYS_GATEWAY_MONGO_URI:-mongodb://admin:admin@mongodb:27017/persys-gateway?authSource=admin}
      - PERSYS_GATEWAY_GITHUB_WEBHOOK_SECRET=${PERSYS_GATEWAY_GITHUB_WEBHOOK_SECRET:-}
      - PERSYS_GATEWAY_GITHUB_WEBHOOK_SECRET_FILE=${PERSYS_GATEWAY_GITHUB_WEBHOOK_SECRET_FILE:-}
      - PERSYS_GATEWAY_GITHUB_CLIENT_ID=${PERSYS_GATEWAY_GITHUB_CLIENT_ID:-}
      - PERSYS_GATEWAY_GITHUB_CLIENT_ID_FILE=${PERSYS_GATEWAY_GITHUB_CLIENT_ID_FILE:-}
      - PERSYS_GATEWAY_GITHUB_CLIENT_SECRET=${PERSYS_GATEWAY_GITHUB_CLIENT_SECRET:-}
      - PERSYS_GATEWAY_GITHUB_CLIENT_SECRET_FILE=${PERSYS_GATEWAY_GITHUB_CLIENT_SECRET_FILE:-}
      - PERSYS_GATEWAY_FORGERY_GRPC_ADDR=${PERSYS_GATEWAY_FORGERY_GRPC_ADDR:-persys-forgery:8087}
      - PERSYS_GATEWAY_FORGERY_GRPC_SERVER_NAME=${PERSYS_GATEWAY_FORGERY_GRPC_SERVER_NAME:-persys-forgery.persys.local}
    networks:
      - persys-cloud-net

  # --- Persys Scheduler (Workload scheduler and reconciler) ---
  persys-scheduler:
    build: ../../persys-scheduler
    ports:
      - 8084:8084   # HTTP Non-mTLS API
      - 8085:8085   # gRPC + mTLS API
    depends_on:
      - etcd
      - vault
      - coredns
      - jaeger
      - redis
    environment:
      - ETCD_ENDPOINTS=${ETCD_ENDPOINTS:-etcd:2379}
      - OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT:-jaeger:4318}
      - OTEL_EXPORTER_OTLP_INSECURE=${OTEL_EXPORTER_OTLP_INSECURE:-true}
      - OTEL_SERVICE_NAME=${OTEL_SERVICE_NAME:-persys-scheduler}
      - CERT_COMMON_NAME=${CERT_COMMON_NAME:-persys-scheduler}
      - CERT_ORGANIZATION=${CERT_ORGANIZATION:-persys}
      - SCHEDULER_AGENT_TLS_ENABLED=${SCHEDULER_AGENT_TLS_ENABLED:-true}
      - PERSYS_EXTERNAL_IP=${PERSYS_EXTERNAL_IP}
      - PERSYS_VAULT_ADDR=${PERSYS_SCHEDULER_VAULT_ADDR:-http://vault:8200}
      - PERSYS_VAULT_AUTH_METHOD=${PERSYS_SCHEDULER_VAULT_AUTH_METHOD:-approle}
      - PERSYS_VAULT_TOKEN=${PERSYS_SCHEDULER_VAULT_TOKEN}
      - PERSYS_VAULT_APPROLE_ROLE_ID=${PERSYS_SCHEDULER_VAULT_ROLE_ID}
      - PERSYS_VAULT_APPROLE_SECRET_ID=${PERSYS_SCHEDULER_VAULT_SECRET_ID}
      - PERSYS_VAULT_PKI_MOUNT=${PERSYS_VAULT_PKI_MOUNT:-pki}
      - REDIS_ADDR=redis:6379
      - REDIS_PASSWORD=
      - REDIS_DB=1
    networks:
      - persys-cloud-net

  # --- Persys Forgery (Internal build orchestration only) ---
  persys-forgery:
    build: ../../persys-forgery
    ports:
      - 8087:8087
    depends_on:
      - vault
      - mysql
      - redis
    environment:
      - OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT:-jaeger:4318}
      - OTEL_SERVICE_NAME=${PERSYS_FORGERY_OTEL_SERVICE_NAME:-persys-forgery}
      - PERSYS_FORGERY_MYSQL_DSN=${PERSYS_FORGERY_MYSQL_DSN:-forgery:password@tcp(mysql:3306)/forgery_db?parseTime=true}
      - PERSYS_FORGERY_REDIS_ADDR=${PERSYS_FORGERY_REDIS_ADDR:-redis:6379}
      - PERSYS_FORGERY_REDIS_PASSWORD=${PERSYS_FORGERY_REDIS_PASSWORD:-}
      - PERSYS_FORGERY_REDIS_PASSWORD_FILE=${PERSYS_FORGERY_REDIS_PASSWORD_FILE:-}
      - PERSYS_FORGERY_PIPELINE_STATUS_KEY=${PERSYS_FORGERY_PIPELINE_STATUS_KEY:-pipeline_status}
      - PERSYS_FORGERY_VAULT_ADDR=${PERSYS_FORGERY_VAULT_ADDR:-http://vault:8200}
      - PERSYS_FORGERY_VAULT_AUTH_METHOD=${PERSYS_FORGERY_VAULT_AUTH_METHOD:-approle}
      - PERSYS_FORGERY_VAULT_TOKEN=${PERSYS_FORGERY_VAULT_TOKEN:-}
      - PERSYS_FORGERY_VAULT_TOKEN_FILE=${PERSYS_FORGERY_VAULT_TOKEN_FILE:-}
      - PERSYS_FORGERY_VAULT_ROLE_ID=${PERSYS_FORGERY_VAULT_ROLE_ID:-}
      - PERSYS_FORGERY_VAULT_SECRET_ID=${PERSYS_FORGERY_VAULT_SECRET_ID:-}
      - PERSYS_FORGERY_GITHUB_WEBHOOK_SECRET=${PERSYS_FORGERY_GITHUB_WEBHOOK_SECRET:-}
      - PERSYS_FORGERY_GITHUB_WEBHOOK_SECRET_FILE=${PERSYS_FORGERY_GITHUB_WEBHOOK_SECRET_FILE:-}
    networks:
      - persys-cloud-net

  # --- Persys Automation (policy engine and control-plane automation) ---
  persys-automation:
    build: ../../persys-automation
    ports:
      - 8091:8091
      - 8092:8092
    depends_on:
      - persys-scheduler
      - prometheus
      - automation-postgres
      - persys-intelligence
    environment:
      - AUTOMATION_GRPC_ADDR=0.0.0.0
      - AUTOMATION_GRPC_PORT=8091
      - AUTOMATION_METRICS_PORT=8092
      - AUTOMATION_EVAL_INTERVAL=${AUTOMATION_EVAL_INTERVAL:-30s}
      - AUTOMATION_PROMETHEUS_URL=${AUTOMATION_PROMETHEUS_URL:-http://prometheus:9090}
      - AUTOMATION_SCHEDULER_ADDR=${AUTOMATION_SCHEDULER_ADDR:-persys-scheduler:8085}
      - AUTOMATION_SCHEDULER_TLS_ENABLED=${AUTOMATION_SCHEDULER_TLS_ENABLED:-false}
      - AUTOMATION_SCHEDULER_TLS_CA=${AUTOMATION_SCHEDULER_TLS_CA:-/etc/persys/certs/persys_automation/ca.pem}
      - AUTOMATION_CLIENT_TLS_CERT=${AUTOMATION_CLIENT_TLS_CERT:-/etc/persys/certs/persys_automation/persys_automation.crt}
      - AUTOMATION_CLIENT_TLS_KEY=${AUTOMATION_CLIENT_TLS_KEY:-/etc/persys/certs/persys_automation/persys_automation-key.key}
      - AUTOMATION_SERVER_TLS_ENABLED=${AUTOMATION_SERVER_TLS_ENABLED:-false}
      - AUTOMATION_SERVER_TLS_CA=${AUTOMATION_SERVER_TLS_CA:-/etc/persys/certs/persys_automation/ca.pem}
      - AUTOMATION_SERVER_TLS_CERT=${AUTOMATION_SERVER_TLS_CERT:-/etc/persys/certs/persys_automation/persys_automation.crt}
      - AUTOMATION_SERVER_TLS_KEY=${AUTOMATION_SERVER_TLS_KEY:-/etc/persys/certs/persys_automation/persys_automation-key.key}
      - AUTOMATION_VAULT_ENABLED=${AUTOMATION_VAULT_ENABLED:-false}
      - AUTOMATION_VAULT_ADDR=${AUTOMATION_VAULT_ADDR:-http://vault:8200}
      - AUTOMATION_VAULT_AUTH_METHOD=${AUTOMATION_VAULT_AUTH_METHOD:-approle}
      - AUTOMATION_VAULT_TOKEN=${AUTOMATION_VAULT_TOKEN:-}
      - AUTOMATION_VAULT_APPROLE_ROLE_ID=${AUTOMATION_VAULT_APPROLE_ROLE_ID:-}
      - AUTOMATION_VAULT_APPROLE_SECRET_ID=${AUTOMATION_VAULT_APPROLE_SECRET_ID:-}
      - AUTOMATION_VAULT_PKI_MOUNT=${AUTOMATION_VAULT_PKI_MOUNT:-pki}
      - AUTOMATION_VAULT_PKI_ROLE=${AUTOMATION_VAULT_PKI_ROLE:-persys-automation}
      - AUTOMATION_VAULT_CERT_TTL=${AUTOMATION_VAULT_CERT_TTL:-24h}
      - AUTOMATION_VAULT_SERVICE_NAME=${AUTOMATION_VAULT_SERVICE_NAME:-persys-automation}
      - AUTOMATION_VAULT_SERVICE_DOMAIN=${AUTOMATION_VAULT_SERVICE_DOMAIN:-persys.local}
      - AUTOMATION_VAULT_RETRY_INTERVAL=${AUTOMATION_VAULT_RETRY_INTERVAL:-1m}
      - AUTOMATION_FORGERY_REDIS_ENABLED=${AUTOMATION_FORGERY_REDIS_ENABLED:-true}
      - AUTOMATION_FORGERY_REDIS_ADDR=${AUTOMATION_FORGERY_REDIS_ADDR:-redis:6379}
      - AUTOMATION_FORGERY_REDIS_PASSWORD=${AUTOMATION_FORGERY_REDIS_PASSWORD:-}
      - AUTOMATION_FORGERY_REDIS_DB=${AUTOMATION_FORGERY_REDIS_DB:-0}
      - AUTOMATION_FORGERY_PIPELINE_KEY=${AUTOMATION_FORGERY_PIPELINE_KEY:-pipeline_status}
      - AUTOMATION_STORE_BACKEND=${AUTOMATION_STORE_BACKEND:-postgres}
      - AUTOMATION_POSTGRES_DSN=${AUTOMATION_POSTGRES_DSN:-postgres://automation:automation@automation-postgres:5432/persys_automation?sslmode=disable}
      - AUTOMATION_LEADER_ELECTION_ENABLED=${AUTOMATION_LEADER_ELECTION_ENABLED:-true}
      - AUTOMATION_LEADER_ELECTION_LOCK_ID=${AUTOMATION_LEADER_ELECTION_LOCK_ID:-771001}
      - AUTOMATION_LEADER_ELECTION_POLL_INTERVAL=${AUTOMATION_LEADER_ELECTION_POLL_INTERVAL:-5s}
    networks:
      - persys-cloud-net

  # --- Persys Intelligence (read-only AI reasoning + recommendations) ---
  persys-intelligence:
    build: ../../persys-intelligence
    ports:
      - 8093:8093
      - 8094:8094
    depends_on:
      - persys-scheduler
      - prometheus
    environment:
      - INTELLIGENCE_HTTP_ADDR=0.0.0.0
      - INTELLIGENCE_HTTP_PORT=8093
      - INTELLIGENCE_METRICS_ADDR=0.0.0.0
      - INTELLIGENCE_METRICS_PORT=8094
      - INTELLIGENCE_MODE=${INTELLIGENCE_MODE:-advisory}
      - INTELLIGENCE_MODEL_PROVIDER=${INTELLIGENCE_MODEL_PROVIDER:-mock}
      - INTELLIGENCE_DEFAULT_WORKLOAD=${INTELLIGENCE_DEFAULT_WORKLOAD:-demo-c2}
      - INTELLIGENCE_INFERENCE_TIMEOUT=${INTELLIGENCE_INFERENCE_TIMEOUT:-3s}
      - INTELLIGENCE_INFERENCE_RATE_LIMIT_PER_SEC=${INTELLIGENCE_INFERENCE_RATE_LIMIT_PER_SEC:-5}
      - INTELLIGENCE_INFERENCE_FAILURE_THRESHOLD=${INTELLIGENCE_INFERENCE_FAILURE_THRESHOLD:-3}
      - INTELLIGENCE_INFERENCE_COOLDOWN=${INTELLIGENCE_INFERENCE_COOLDOWN:-30s}
      - INTELLIGENCE_POLICY_MIN_CONFIDENCE=${INTELLIGENCE_POLICY_MIN_CONFIDENCE:-0.7}
      - INTELLIGENCE_POLICY_MAX_RISK=${INTELLIGENCE_POLICY_MAX_RISK:-0.6}
      - INTELLIGENCE_SERVER_TLS_ENABLED=${INTELLIGENCE_SERVER_TLS_ENABLED:-false}
      - INTELLIGENCE_SERVER_TLS_CERT=${INTELLIGENCE_SERVER_TLS_CERT:-/etc/persys/certs/persys_intelligence/persys_intelligence.crt}
      - INTELLIGENCE_SERVER_TLS_KEY=${INTELLIGENCE_SERVER_TLS_KEY:-/etc/persys/certs/persys_intelligence/persys_intelligence-key.key}
      - INTELLIGENCE_SERVER_TLS_CA=${INTELLIGENCE_SERVER_TLS_CA:-/etc/persys/certs/persys_scheduler/ca.pem}
      - INTELLIGENCE_VAULT_ENABLED=${INTELLIGENCE_VAULT_ENABLED:-false}
      - INTELLIGENCE_VAULT_ADDR=${INTELLIGENCE_VAULT_ADDR:-http://vault:8200}
      - INTELLIGENCE_VAULT_AUTH_METHOD=${INTELLIGENCE_VAULT_AUTH_METHOD:-approle}
      - INTELLIGENCE_VAULT_TOKEN=${INTELLIGENCE_VAULT_TOKEN:-}
      - INTELLIGENCE_VAULT_APPROLE_ROLE_ID=${INTELLIGENCE_VAULT_APPROLE_ROLE_ID:-}
      - INTELLIGENCE_VAULT_APPROLE_SECRET_ID=${INTELLIGENCE_VAULT_APPROLE_SECRET_ID:-}
      - INTELLIGENCE_VAULT_PKI_MOUNT=${INTELLIGENCE_VAULT_PKI_MOUNT:-pki}
      - INTELLIGENCE_VAULT_PKI_ROLE=${INTELLIGENCE_VAULT_PKI_ROLE:-persys-intelligence}
      - INTELLIGENCE_VAULT_CERT_TTL=${INTELLIGENCE_VAULT_CERT_TTL:-24h}
      - INTELLIGENCE_VAULT_SERVICE_NAME=${INTELLIGENCE_VAULT_SERVICE_NAME:-persys-intelligence}
      - INTELLIGENCE_VAULT_SERVICE_DOMAIN=${INTELLIGENCE_VAULT_SERVICE_DOMAIN:-persys.local}
      - INTELLIGENCE_VAULT_RETRY_INTERVAL=${INTELLIGENCE_VAULT_RETRY_INTERVAL:-1m}
      - INTELLIGENCE_MODEL_ENDPOINT=${INTELLIGENCE_MODEL_ENDPOINT:-}
      - INTELLIGENCE_MODEL_API_KEY=${INTELLIGENCE_MODEL_API_KEY:-}
      - INTELLIGENCE_MODEL_NAME=${INTELLIGENCE_MODEL_NAME:-}
    networks:
      - persys-cloud-net
    
  compute-agent:
    build:
      context: ../../compute-agent
      dockerfile: Dockerfile
    environment:
      - OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT:-jaeger:4318}
      - OTEL_SERVICE_NAME=${COMPUTE_AGENT_OTEL_SERVICE_NAME:-compute-agent}
      - PERSYS_VAULT_ADDR=${COMPUTE_AGENT_VAULT_ADDR:-http://vault:8200}
      - PERSYS_VAULT_AUTH_METHOD=${COMPUTE_AGENT_VAULT_AUTH_METHOD:-approle}
      - PERSYS_VAULT_TOKEN=${COMPUTE_AGENT_VAULT_TOKEN:-}
      - PERSYS_VAULT_ROLE_ID=${COMPUTE_AGENT_VAULT_ROLE_ID:-}
      - PERSYS_VAULT_SECRET_ID=${COMPUTE_AGENT_VAULT_SECRET_ID:-}
      - PERSYS_TLS_ENABLED=${PERSYS_TLS_ENABLED:-true}
      - PERSYS_GRPC_PORT=${PERSYS_GRPC_PORT:-50051}
      - PERSYS_LOG_LEVEL=${PERSYS_LOG_LEVEL:-info}
      - PERSYS_RECONCILE_ENABLED=${PERSYS_RECONCILE_ENABLED:-true}
      - PERSYS_VM_ENABLED=${PERSYS_VM_ENABLED:-false}
      - PERSYS_SCHEDULER_INSECURE=${PERSYS_SCHEDULER_INSECURE:-false}
      - PERSYS_SCHEDULER_ADDR=${PERSYS_SCHEDULER_ADDR:-persys-scheduler:8085}
    user: "0:0"
    volumes:
      - ${DOCKER_SOCK_PATH:-/var/run/docker.sock}:/var/run/docker.sock
    depends_on:
      - vault
      - persys-scheduler
    ports:
      - "50051:50051"
      - "8089:8080"
    networks:
      - persys-cloud-net

  # --- Certificate Authority / Secret Manager ---
  vault:
    image: hashicorp/vault:1.16.2
    container_name: vault
    restart: unless-stopped
    ports:
      - "8200:8200"
    cap_add:
      - IPC_LOCK
    environment:
      VAULT_ADDR: "${VAULT_ADDR:-http://vault:8200}"
      VAULT_API_ADDR: "${VAULT_API_ADDR:-http://vault:8200}"
    command: ["vault", "server", "-config=/vault/config/vault.hcl"]
    volumes:
      - ./vault:/vault/config
      - vault_data:/vault/file
    networks:
      - persys-cloud-net
      
  # --- Vault Bootstrap (runs once to initialize/provision Vault) ---
  vault-manager-setup:
    build: ../../vault-manager
    container_name: vault-manager-setup
    restart: "no"
    profiles: ["setup"]
    depends_on:
      - vault
    environment:
      - VAULT_ROOT_TOKEN=${VAULT_ROOT_TOKEN:-}
    command: ["--vault-addr=${PERSYS_VAULT_ADDR:-http://vault:8200}"]
    networks:
      - persys-cloud-net

  # --- CoreDNS (Service discovery) ---
  coredns:
    image: coredns/coredns:latest
    command: -conf /etc/coredns/Corefile
    volumes:
      - ./coredns:/etc/coredns
    ports:
      - "53531:53"
      - "53531:53/udp"
      - "9153:9153/tcp"
    depends_on:
      - etcd
    networks:
      - persys-cloud-net

  # --- Prometheus (Metrics collection) ---
  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
    ports:
      - "9090:9090"
    networks:
      - persys-cloud-net

  # --- Grafana (Metrics visualization) ---
  grafana:
    image: grafana/grafana:latest
    container_name: grafana_container
    volumes:
      - ./grafana/provisioning:/etc/grafana/provisioning
      - grafana_data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_USER=${GF_SECURITY_ADMIN_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GF_SECURITY_ADMIN_PASSWORD:-admin}
      - GF_USERS_ALLOW_SIGN_UP=${GF_USERS_ALLOW_SIGN_UP:-false}
    ports:
      - "3000:3000"
    networks:
      - persys-cloud-net
    depends_on:
      - prometheus

  # --- Jaeger (Distributed tracing) ---
  jaeger:
    image: jaegertracing/all-in-one:latest
    environment:
      - COLLECTOR_OTLP_ENABLED=${COLLECTOR_OTLP_ENABLED:-true}
    ports:
      - "5775:5775/udp"
      - "6831:6831/udp"
      - "6832:6832/udp"
      - "5778:5778"
      - "16686:16686"
      - "14250:14250"
      - "14268:14268"
      - "14269:14269"
      - "4317:4317"
      - "4318:4318"
    networks:
      - persys-cloud-net

  # --- Node Exporter (Host metrics for Prometheus) ---
  node_exporter:
    container_name: node_exporter_container
    restart: always
    image: prom/node-exporter
    ports:
      - '9100:9100'
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    networks:
      - persys-cloud-net

# --- MySQL (Forgery persistence) ---
  mysql:
    image: mysql:8.0
    restart: unless-stopped
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:-root}
      - MYSQL_DATABASE=${MYSQL_DATABASE:-forgery_db}
      - MYSQL_USER=${MYSQL_USER:-forgery}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-password}
    ports:
      - "3306:3306"
    volumes:
      - mysql_data:/var/lib/mysql
    networks:
      - persys-cloud-net

  # --- Redis (Persys Scheduler/Forgery internal queues) ---
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes"]
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    networks:
      - persys-cloud-net

#  --- Postgres (Automation policy and audit store) ---
  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_DB=${AUTOMATION_POSTGRES_DB:-persys_automation}
      - POSTGRES_USER=${AUTOMATION_POSTGRES_USER:-automation}
      - POSTGRES_PASSWORD=${AUTOMATION_POSTGRES_PASSWORD:-automation}
    ports:
      - "5432:5432"
    volumes:
      - automation_postgres_data:/var/lib/postgresql/data
    networks:
      - persys-cloud-net

#  --- MongoDB (Database for Persys Gateway) ---
  mongodb:
    image: mongo:latest
    restart: always
    environment:
      MONGO_INITDB_ROOT_USERNAME: "${MONGO_INITDB_ROOT_USERNAME:-admin}"
      MONGO_INITDB_ROOT_PASSWORD: "${MONGO_INITDB_ROOT_PASSWORD:-admin}"
      MONGODB_DATABASE: "${MONGODB_DATABASE:-persys-gateway}"
    ports:
      - 27017:27017
    volumes:
      - mongodb_data_container:/data/db
    networks:
      - persys-cloud-net

  # --- etcd (Key-value store for Persys Scheduler and CoreDNS) ---
  etcd:
    image: quay.io/coreos/etcd:v3.5.0
    command: etcd --advertise-client-urls http://etcd:2379 --listen-client-urls http://0.0.0.0:2379 --auto-compaction-retention=1h
    restart: unless-stopped
    volumes:
      - etcd_data:/etcd-data
    environment:
      - ETCD_DATA_DIR=/etcd-data
    ports:
      - "2379:2379"
    networks:
      - persys-cloud-net

# --- Volumes for persistent data ---
volumes:
  mongodb_data_container:
  mysql_data:
  redis_data:
  automation_postgres_data:
  prometheus_data:
  grafana_data:
  vault_data:
  etcd_data:

# --- Shared overlay network for all services ---
networks:
  persys-cloud-net:
    driver: bridge