docker-compose.yml

services:
  postgres:
    image: postgres:18-alpine
    container_name: moneat-postgres
    environment:
      # ⚠️ DEVELOPMENT ONLY — change all passwords before deploying to production
      POSTGRES_DB: moneat
      POSTGRES_USER: moneat
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-moneat_dev_password}
      PGDATA: /var/lib/postgresql/data/pgdata
    ports:
      - "${POSTGRES_PORT:-5499}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./backend/src/main/resources/db/init.sql:/docker-entrypoint-initdb.d/init.sql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U moneat"]
      interval: 10s
      timeout: 5s
      retries: 5

  clickhouse:
    image: clickhouse/clickhouse-server:26.5-alpine
    container_name: moneat-clickhouse
    environment:
      CLICKHOUSE_DB: moneat
      CLICKHOUSE_USER: moneat
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-moneat_dev_password}
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
    ports:
      - "${CLICKHOUSE_HTTP_PORT:-8123}:8123"  # HTTP interface
      - "${CLICKHOUSE_NATIVE_PORT:-9000}:9000"  # Native interface
    volumes:
      - clickhouse_data:/var/lib/clickhouse
      - ./backend/src/main/resources/db/clickhouse_init.sql:/docker-entrypoint-initdb.d/clickhouse_init.sql
      - ./clickhouse-config/logging.xml:/etc/clickhouse-server/config.d/logging.xml
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "127.0.0.1:8123/ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:8-alpine
    container_name: moneat-redis
    ports:
      - "${REDIS_PORT:-6379}:6379"
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:-moneat_dev_password}
    volumes:
      - redis_data:/data
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-moneat_dev_password}
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a $$REDIS_PASSWORD --no-auth-warning ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  temporal-bootstrap:
    image: postgres:18-alpine
    container_name: moneat-temporal-bootstrap
    restart: "no"
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGPASSWORD: ${DATABASE_PASSWORD:-moneat_dev_password}
    command:
      - /bin/sh
      - -c
      - |
        psql -h postgres -U moneat -d postgres -v ON_ERROR_STOP=1 \
          -v temporal_user="${TEMPORAL_DB_USER:-temporal}" \
          -v temporal_password="${TEMPORAL_DB_PASSWORD:-temporal_dev_password}" <<'SQL'
        SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'temporal_user', :'temporal_password')
        WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :'temporal_user') \gexec
        SELECT format('ALTER ROLE %I WITH PASSWORD %L', :'temporal_user', :'temporal_password') \gexec
        SELECT format('CREATE DATABASE temporal OWNER %I', :'temporal_user')
        WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'temporal') \gexec
        SELECT format('CREATE DATABASE temporal_visibility OWNER %I', :'temporal_user')
        WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'temporal_visibility') \gexec
        SQL

  temporal:
    image: temporalio/auto-setup:1.27.4
    container_name: moneat-temporal
    restart: unless-stopped
    depends_on:
      temporal-bootstrap:
        condition: service_completed_successfully
    environment:
      DB: postgres12
      DB_PORT: 5432
      SKIP_DB_CREATE: "true"
      DEFAULT_NAMESPACE: ${TEMPORAL_NAMESPACE:-default}
      POSTGRES_USER: ${TEMPORAL_DB_USER:-temporal}
      POSTGRES_PWD: ${TEMPORAL_DB_PASSWORD:-temporal_dev_password}
      POSTGRES_SEEDS: postgres
      DBNAME: temporal
      VISIBILITY_DBNAME: temporal_visibility
    ports:
      - "${TEMPORAL_GRPC_PORT:-7233}:7233"
    healthcheck:
      test: ["CMD", "temporal", "operator", "cluster", "health", "--address", "temporal:7233"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 40s

  temporal-ui:
    image: temporalio/ui:2.34.0
    container_name: moneat-temporal-ui
    restart: unless-stopped
    depends_on:
      temporal:
        condition: service_healthy
    environment:
      TEMPORAL_ADDRESS: temporal:7233
    ports:
      - "${TEMPORAL_UI_PORT:-8233}:8080"

  backend:
    image: ghcr.io/moneat-io/moneat-backend:latest
    container_name: moneat-backend
    restart: unless-stopped
    ports:
      - "${BACKEND_PORT:-8080}:8080"
    environment:
      DATABASE_URL: jdbc:postgresql://postgres:5432/moneat
      DATABASE_USER: moneat
      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-moneat_dev_password}
      CLICKHOUSE_URL: http://clickhouse:8123
      CLICKHOUSE_USER: moneat
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-moneat_dev_password}
      REDIS_URL: redis://:${REDIS_PASSWORD:-moneat_dev_password}@redis:6379
      JWT_SECRET: ${JWT_SECRET:-dev-jwt-secret-change-in-production}
      DATA_SOURCE_ENCRYPTION_KEY: ${DATA_SOURCE_ENCRYPTION_KEY:-}
      TEMPORAL_TARGET: ${TEMPORAL_TARGET:-temporal:7233}
      TEMPORAL_NAMESPACE: ${TEMPORAL_NAMESPACE:-default}
      WORKFLOWS_CONNECTION_KEK: ${WORKFLOWS_CONNECTION_KEK:-}
      WORKFLOWS_SIGNING_KEY: ${WORKFLOWS_SIGNING_KEY:-}
      WORKFLOWS_TEMPORAL_PAYLOAD_KEY: ${WORKFLOWS_TEMPORAL_PAYLOAD_KEY:-}
      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:3000}
      BACKEND_URL: ${BACKEND_URL:-http://localhost:8080}
      STRIPE_ENABLED: "false"
      SELF_HOSTED: "true"
      # Set MONEAT_LICENSE_KEY to enable enterprise features (SSO, On-Call)
      MONEAT_LICENSE_KEY: ${MONEAT_LICENSE_KEY:-}
    volumes:
      - backend_storage:/app/storage
    depends_on:
      postgres:
        condition: service_healthy
      clickhouse:
        condition: service_healthy
      redis:
        condition: service_healthy
      temporal:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/health"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  frontend:
    image: ghcr.io/moneat-io/moneat-dashboard:latest
    container_name: moneat-frontend
    restart: unless-stopped
    ports:
      - "${FRONTEND_PORT:-3000}:80"
    environment:
      VITE_BACKEND_URL: ${BACKEND_URL:-http://localhost:8080}
      VITE_MONEAT_VERSION: ${MONEAT_VERSION:-}
    depends_on:
      backend:
        condition: service_healthy

  # Datadog Agent integration (optional):
  #   docker compose --profile datadog up -d
  #   Set DD_API_KEY in .env or .env.enterprise to configure.
  datadog-agent:
    profiles: [datadog]
    image: datadog/agent:${DATADOG_AGENT_TAG:-7}
    container_name: moneat-datadog-agent
    restart: unless-stopped
    depends_on:
      backend:
        condition: service_healthy
    environment:
      # Core
      DD_API_KEY: ${DD_API_KEY:-}
      DD_DD_URL: ${DD_DD_URL:-https://api.moneat.io/dd}
      DD_ENV: ${DD_ENV:-production}
      DD_HOSTNAME: ${DD_HOSTNAME:-moneat-host}
      # APM
      DD_APM_ENABLED: "true"
      DD_APM_NON_LOCAL_TRAFFIC: "true"
      # Continuous Profiling
      DD_APM_CONFIG_PROFILING_DD_URL: ${DD_APM_CONFIG_PROFILING_DD_URL:-https://api.moneat.io/api/v2/profile?api_key=${DD_API_KEY:-}}
      # Live Processes
      DD_PROCESS_AGENT_ENABLED: "true"
      # Log Collection
      DD_LOGS_ENABLED: "true"
      DD_LOGS_CONFIG_LOGS_DD_URL: ${DD_LOGS_DD_URL:-api.moneat.io:443}
      DD_LOGS_CONFIG_LOGS_NO_SSL: "false"
      DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL: "true"
      # Dynamic Instrumentation (Probes / Debugger)
      DD_DYNAMIC_INSTRUMENTATION_ENABLED: "true"
      # Network Performance Monitoring
      DD_SYSTEM_PROBE_ENABLED: "true"
      DD_SYSTEM_PROBE_NETWORK_ENABLED: "true"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc/:/host/proc/:ro
      - /sys/fs/cgroup/:/host/sys/fs/cgroup:ro
      - /sys/kernel/debug:/sys/kernel/debug:ro
    ports:
      - "8126:8126"   # APM traces
      - "8125:8125"   # DogStatsD metrics
    cap_add:
      - SYS_ADMIN
      - SYS_RESOURCE
      - SYS_PTRACE
      - NET_ADMIN
      - NET_BROADCAST
    security_opt:
      - apparmor:unconfined

volumes:
  postgres_data:
  clickhouse_data:
  redis_data:
  backend_storage: