docker-compose.yml

version: '3.8'

services:
  traefik:
    image: traefik:v2.11
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
    ports:
      - "8090:80"
      - "8091:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - netagent

  postgres:
    image: pgvector/pgvector:pg16
    environment:
      POSTGRES_DB: netagent
      POSTGRES_USER: netagent
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-netagent_dev}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    networks:
      - netagent
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U netagent"]
      interval: 5s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data
    ports:
      - "6379:6379"
    networks:
      - netagent
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5

  frontend:
    build:
      context: .
      dockerfile: services/frontend/Dockerfile
    environment:
      - API_URL=http://api:8001
      - PYTHONUNBUFFERED=1
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=PathPrefix(`/`)"
      - "traefik.http.routers.frontend.priority=1"
      - "traefik.http.services.frontend.loadbalancer.server.port=8000"
    volumes:
      - ./static:/app/static:ro
      - ./services/frontend/app/templates:/app/templates:ro
    networks:
      - netagent
    depends_on:
      - api

  api:
    build:
      context: .
      dockerfile: services/api/Dockerfile
    environment:
      - DATABASE_URL=postgresql://netagent:${POSTGRES_PASSWORD:-netagent_dev}@postgres:5432/netagent
      - REDIS_URL=redis://redis:6379/0
      - APIGEE_CLIENT_ID=${APIGEE_CLIENT_ID}
      - APIGEE_CLIENT_SECRET=${APIGEE_CLIENT_SECRET}
      - APIGEE_TOKEN_URL=${APIGEE_TOKEN_URL}
      - GEMINI_API_URL=${GEMINI_API_URL}
      - GEMINI_EMBEDDING_API_URL=${GEMINI_EMBEDDING_API_URL}
      - GEMINI_USER_EMAIL=${GEMINI_USER_EMAIL}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - EMBEDDING_SERVER_URL=http://embedding:8002
      - SMTP_SERVER=${SMTP_SERVER:-localhost}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_FROM=${SMTP_FROM:-netagent@localhost}
      - DEV_MODE=${DEV_MODE:-false}
      # AWS Bedrock (for Anthropic Claude models)
      - AWS_BEDROCK_API_KEY=${AWS_BEDROCK_API_KEY:-}
      - AWS_BEDROCK_REGION=${AWS_BEDROCK_REGION:-us-west-2}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
      # Network tools (NSO, A10, EagleView)
      - NSO_BASE_URL=${NSO_BASE_URL:-https://nso.gi-nw.viasat.io}
      - NSO_USER=${NSO_USER:-cm-admin}
      - NSO_PASS=${NSO_PASS:-}
      - A10_USER=${A10_USER:-cm-admin}
      - A10_PASS=${A10_PASS:-}
      - EV_JWT_URL=${EV_JWT_URL:-https://jwt-ipv4.us-or.viasat.io/v1/token?stripe=dsc-prod&name=eagleview}
      - EV_JWT_BASIC=${EV_JWT_BASIC:-}
      - EV_BASE_URL=${EV_BASE_URL:-https://eagleview.dsc-prod.viasat.io}
      - VERIFY_SSL=${VERIFY_SSL:-false}
      - PYTHONUNBUFFERED=1
    volumes:
      - ./shared:/app/shared:ro
      - ./services/api/app/routes:/app/routes:ro
      - ./services/api/app/services:/app/services:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=PathPrefix(`/api/`) || Path(`/api`)"
      - "traefik.http.routers.api.priority=10"
      - "traefik.http.services.api.loadbalancer.server.port=8001"
    networks:
      - netagent
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      embedding:
        condition: service_healthy

  worker:
    build:
      context: .
      dockerfile: services/worker/Dockerfile
    command: celery -A celery_app worker --loglevel=info
    environment:
      - DATABASE_URL=postgresql://netagent:${POSTGRES_PASSWORD:-netagent_dev}@postgres:5432/netagent
      - REDIS_URL=redis://redis:6379/0
      - APIGEE_CLIENT_ID=${APIGEE_CLIENT_ID}
      - APIGEE_CLIENT_SECRET=${APIGEE_CLIENT_SECRET}
      - APIGEE_TOKEN_URL=${APIGEE_TOKEN_URL}
      - GEMINI_API_URL=${GEMINI_API_URL}
      - GEMINI_EMBEDDING_API_URL=${GEMINI_EMBEDDING_API_URL}
      - GEMINI_USER_EMAIL=${GEMINI_USER_EMAIL}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - EMBEDDING_SERVER_URL=http://embedding:8002
      - CONFLUENCE_BASE_URL=${CONFLUENCE_BASE_URL}
      - CONFLUENCE_USERNAME=${CONFLUENCE_USERNAME}
      - CONFLUENCE_API_TOKEN=${CONFLUENCE_API_TOKEN}
      - SMTP_SERVER=${SMTP_SERVER}
      - SMTP_PORT=${SMTP_PORT:-25}
      - SMTP_FROM=${EMAIL_FROM_ADDRESS:-netagent@localhost}
      # AWS Bedrock (for Anthropic Claude models)
      - AWS_BEDROCK_API_KEY=${AWS_BEDROCK_API_KEY:-}
      - AWS_BEDROCK_REGION=${AWS_BEDROCK_REGION:-us-west-2}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
      # Network tools (NSO, A10, EagleView)
      - NSO_BASE_URL=${NSO_BASE_URL:-https://nso.gi-nw.viasat.io}
      - NSO_USER=${NSO_USER:-cm-admin}
      - NSO_PASS=${NSO_PASS:-}
      - A10_USER=${A10_USER:-cm-admin}
      - A10_PASS=${A10_PASS:-}
      - EV_JWT_URL=${EV_JWT_URL:-https://jwt-ipv4.us-or.viasat.io/v1/token?stripe=dsc-prod&name=eagleview}
      - EV_JWT_BASIC=${EV_JWT_BASIC:-}
      - EV_BASE_URL=${EV_BASE_URL:-https://eagleview.dsc-prod.viasat.io}
      - VERIFY_SSL=${VERIFY_SSL:-false}
      - PYTHONUNBUFFERED=1
    volumes:
      - ./shared:/app/shared:ro
    networks:
      - netagent
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      embedding:
        condition: service_healthy

  celery-beat:
    build:
      context: .
      dockerfile: services/worker/Dockerfile
    command: celery -A celery_app beat --loglevel=info
    environment:
      - DATABASE_URL=postgresql://netagent:${POSTGRES_PASSWORD:-netagent_dev}@postgres:5432/netagent
      - REDIS_URL=redis://redis:6379/0
      - PYTHONUNBUFFERED=1
    networks:
      - netagent
    depends_on:
      - worker

  slack-bot:
    build:
      context: .
      dockerfile: services/slack_bot/Dockerfile
    environment:
      - DATABASE_URL=postgresql://netagent:${POSTGRES_PASSWORD:-netagent_dev}@postgres:5432/netagent
      - SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN}
      - SLACK_APP_TOKEN=${SLACK_APP_TOKEN}
      - API_URL=http://api:8001
      - PYTHONUNBUFFERED=1
    networks:
      - netagent
    depends_on:
      - api

  embedding:
    build:
      context: .
      dockerfile: services/embedding/Dockerfile
    environment:
      - MODEL_NAME=all-MiniLM-L6-v2
      - PAD_DIMENSIONS=768
      - PYTHONUNBUFFERED=1
    networks:
      - netagent
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8002/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  alert-listener:
    build:
      context: .
      dockerfile: services/alert_listener/Dockerfile
    ports:
      - "514:5514/udp"    # Syslog UDP (host 514 -> container 5514)
      - "162:1162/udp"    # SNMP Traps (host 162 -> container 1162)
    environment:
      - API_URL=http://api:8001
      - SYSLOG_PORT=5514
      - SNMP_PORT=1162
      - PYTHONUNBUFFERED=1
    networks:
      - netagent
    depends_on:
      - api

networks:
  netagent:
    driver: bridge

volumes:
  postgres_data:
  redis_data: