docker-compose.yml

services:
  nginx-service:
    container_name: llars_nginx_service
    build:
      context: .
      dockerfile: docker/nginx/Dockerfile-nginx
    ports:
      - "${NGINX_EXTERNAL_PORT:-55080}:80"
    depends_on:
      backend-flask-service:
        condition: service_healthy
      frontend-vue-service:
        condition: service_healthy
      matomo-service:
        condition: service_started
      yjs-service:
        condition: service_healthy
    environment:
      - TZ=Europe/Berlin
      - PROJECT_STATE=${PROJECT_STATE:-development}
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1/health || exit 1"]
      start_period: 10s
      interval: 10s
      timeout: 5s
      retries: 6

  matomo-service:
    container_name: llars_matomo_service
    image: public.ecr.aws/docker/library/matomo:5
    expose:
      - "80"
    volumes:
      - matomo_data:/var/www/html
    environment:
      - TZ=Europe/Berlin
      - MATOMO_DATABASE_HOST=matomo-db-service
      - MATOMO_DATABASE_ADAPTER=PDO\MYSQL
      - MATOMO_DATABASE_TABLES_PREFIX=${MATOMO_DATABASE_TABLES_PREFIX:-matomo_}
      - MATOMO_DATABASE_USERNAME=${MATOMO_MYSQL_USER:-matomo}
      - MATOMO_DATABASE_PASSWORD=${MATOMO_MYSQL_PASSWORD:-matomo_password_change_me}
      - MATOMO_DATABASE_DBNAME=${MATOMO_MYSQL_DATABASE:-matomo}
    depends_on:
      matomo-init:
        condition: service_completed_successfully
      matomo-db-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "php -r '$$fp=@fsockopen(\"127.0.0.1\",80,$$errno,$$errstr,2); if(!$$fp) exit(1); fclose($$fp);'"]
      start_period: 30s
      interval: 15s
      timeout: 5s
      retries: 10

  matomo-archiver:
    container_name: llars_matomo_archiver
    image: public.ecr.aws/docker/library/matomo:5
    env_file:
      - .env
    volumes:
      - matomo_data:/var/www/html
    environment:
      - TZ=Europe/Berlin
    entrypoint:
      - /bin/bash
      - -lc
      - |
        set -euo pipefail
        PROJECT_STATE="$${PROJECT_STATE:-development}"
        PROJECT_HOST="$${PROJECT_HOST:-localhost}"
        NGINX_EXTERNAL_PORT="$${NGINX_EXTERNAL_PORT:-80}"
        BASE_URL="$${PROJECT_URL:-}"
        if [ -z "$${BASE_URL}" ]; then
          if [ "$${PROJECT_STATE}" = "production" ]; then
            BASE_URL="https://$${PROJECT_HOST}"
          else
            BASE_URL="http://$${PROJECT_HOST}:$${NGINX_EXTERNAL_PORT}"
          fi
        fi
        MATOMO_ARCHIVE_URL="$${MATOMO_ARCHIVE_URL:-$${BASE_URL}/analytics/}"
        while true; do
          echo "[matomo-archiver] Running core:archive..."
          chown -R www-data:www-data /var/www/html/tmp /var/www/html/config || true
          su -s /bin/bash www-data -c "php /var/www/html/console core:archive --url=\"$$MATOMO_ARCHIVE_URL\"" || true
          echo "[matomo-archiver] Sleeping 1h..."
          sleep 3600
        done
    depends_on:
      matomo-init:
        condition: service_completed_successfully
    restart: unless-stopped

  matomo-init:
    container_name: llars_matomo_init
    image: public.ecr.aws/docker/library/matomo:5
    env_file:
      - .env
    environment:
      - TZ=Europe/Berlin
      - PROJECT_STATE=${PROJECT_STATE:-development}
      - PROJECT_HOST=${PROJECT_HOST:-localhost}
      - PROJECT_URL=${PROJECT_URL:-http://localhost:55080}
      - NGINX_EXTERNAL_PORT=${NGINX_EXTERNAL_PORT:-55080}
      - MATOMO_DATABASE_HOST=matomo-db-service
      - MATOMO_DATABASE_ADAPTER=PDO\MYSQL
      - MATOMO_DATABASE_TABLES_PREFIX=${MATOMO_DATABASE_TABLES_PREFIX:-matomo_}
      - MATOMO_DATABASE_USERNAME=${MATOMO_MYSQL_USER:-matomo}
      - MATOMO_DATABASE_PASSWORD=${MATOMO_MYSQL_PASSWORD:-matomo_password_change_me}
      - MATOMO_DATABASE_DBNAME=${MATOMO_MYSQL_DATABASE:-matomo}
      - MATOMO_SUPERUSER_LOGIN=${MATOMO_SUPERUSER_LOGIN:-admin}
      - MATOMO_SUPERUSER_PASSWORD=${MATOMO_SUPERUSER_PASSWORD:-admin123}
      - MATOMO_SUPERUSER_EMAIL=${MATOMO_SUPERUSER_EMAIL:-admin@example.com}
      - MATOMO_SITE_NAME=${MATOMO_SITE_NAME:-LLARS}
      # Matomo SSO (Authentik OIDC via RebelOIDC)
      - MATOMO_OIDC_ENABLED=${MATOMO_OIDC_ENABLED:-true}
      - MATOMO_OIDC_FORCE_CONFIG=${MATOMO_OIDC_FORCE_CONFIG:-false}
      - AUTHENTIK_PUBLIC_URL=${AUTHENTIK_PUBLIC_URL:-}
      - AUTHENTIK_INTERNAL_URL=${AUTHENTIK_INTERNAL_URL:-http://authentik-server:9000}
      - AUTHENTIK_MATOMO_APP_SLUG=${AUTHENTIK_MATOMO_APP_SLUG:-llars-matomo}
      - AUTHENTIK_MATOMO_CLIENT_ID=${AUTHENTIK_MATOMO_CLIENT_ID:-llars-matomo}
      - AUTHENTIK_MATOMO_CLIENT_SECRET=${AUTHENTIK_MATOMO_CLIENT_SECRET:-llars-matomo-secret-change-in-production}
    volumes:
      - matomo_data:/var/www/html
      - ./docker/matomo/init-matomo.sh:/init-matomo.sh:ro
      - ./docker/matomo/install-matomo.php:/install-matomo.php:ro
      - ./docker/matomo/configure-rebeloidc.php:/configure-rebeloidc.php:ro
    entrypoint: ["/entrypoint.sh"]
    command: ["/bin/bash", "/init-matomo.sh"]
    depends_on:
      matomo-db-service:
        condition: service_healthy
    restart: "no"

  backend-flask-service:
    container_name: llars_flask_service
    build:
      context: .
      dockerfile: docker/flask/Dockerfile-flask
    expose:
      - "8081"
    # Mount application code for hot-reloading in development
    volumes:
      - ./app:/app
      # MkDocs documentation for RAG chatbot
      - ./docs:/app/docs:ro
      # Offline Anonymize Ressourcen (großes NER-Modell bleibt in docs/, wird hier nur gemountet)
      - ./docs/docs/projekte/anonymize/models/ner-german-large:/app/models/anonymize/ner-german-large:ro
      - ./docs/docs/projekte/anonymize/database:/app/data/anonymize:ro
      - rag_storage:/app/storage
      - rag_docs:/app/rag_docs
      # OnCoCo model is now included in app/models/oncoco (part of ./app mount)
      # Docker monitor (admin): needs access to Docker Engine
      - /var/run/docker.sock:/var/run/docker.sock
    group_add:
      - "${DOCKER_SOCK_GID:-0}"
    env_file:
      - .env
    environment:
      - TZ=Europe/Berlin
      - PROJECT_STATE=${PROJECT_STATE:-development}
      - FLASK_ENV=${FLASK_ENV:-development}
      - FLASK_APP=main
      # MariaDB (defaults are for development; override via .env for production)
      - MYSQL_DATABASE=${MYSQL_DATABASE:-database_llars}
      - MYSQL_USER=${MYSQL_USER:-dev_user}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-dev_password_change_me}
      # Disable Chroma telemetry (avoids noisy posthog signature errors and external telemetry calls)
      - ANONYMIZED_TELEMETRY=False
      # CORS origins derived from PROJECT_URL
      - ALLOWED_ORIGINS=${PROJECT_URL:-http://localhost:55080},http://127.0.0.1,http://127.0.0.1:${NGINX_EXTERNAL_PORT:-55080},http://localhost,http://localhost:${NGINX_EXTERNAL_PORT:-55080}
      # OnCoCo model path
      - ONCOCO_MODEL_PATH=/app/models/oncoco
      # Disable ChromaDB telemetry (prevents log spam)
      - ANONYMIZED_TELEMETRY=False
      # Authentik Admin API Token (for user management)
      - AUTHENTIK_API_TOKEN=${AUTHENTIK_API_TOKEN:-}
      # Redis for server-authoritative sessions (Wizard Sessions, etc.)
      - REDIS_HOST=${REDIS_HOST:-llars-redis}
      - REDIS_PORT=${REDIS_PORT:-6379}
      - REDIS_DB=${REDIS_DB:-0}
      - LLARS_SKIP_STARTUP_TASKS=${LLARS_SKIP_STARTUP_TASKS:-}
    depends_on:
      db-maria-service:
        condition: service_healthy
      llars-redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      start_period: 1800s   # 30 Minuten maximale Startzeit
      interval: 10s         # Häufige Checks
      timeout: 10s
      retries: 180         # Viele Retries (entspricht 30min bei 10s Interval)

  frontend-vue-service:
    container_name: llars_frontend_service
    build:
      context: .
      dockerfile: docker/vue/Dockerfile-vue
    expose:
      - "5173"
    # Mount frontend code for hot-reloading in development
    volumes:
      - ./llars-frontend:/vue
    environment:
      - TZ=Europe/Berlin
      # Note: Don't set NODE_ENV here - it breaks npm install for build
      # All URLs derived from PROJECT_URL (includes protocol)
      # Use VITE_API_BASE_URL if set (even if empty for relative URLs), else PROJECT_URL
      - VITE_API_BASE_URL=${VITE_API_BASE_URL-${PROJECT_URL:-http://localhost:55080}}
      - VITE_PROJECT_STATE=${PROJECT_STATE:-development}
      - VITE_MKDOCS_URL=${PROJECT_URL:-http://localhost:55080}/mkdocs
      - VITE_KEYCLOAK_URL=${PROJECT_URL:-http://localhost:55080}/authentik
      - VITE_KEYCLOAK_REALM=llars   # legacy variable; Authentik uses apps, not realms
      - VITE_KEYCLOAK_CLIENT_ID=${AUTHENTIK_FRONTEND_CLIENT_ID:-llars-frontend}
      # When false (default), Socket.IO sticks to polling to avoid WebSocket errors with Werkzeug/threading
      - VITE_SOCKETIO_ENABLE_WEBSOCKET=${VITE_SOCKETIO_ENABLE_WEBSOCKET:-false}
    develop:
      watch:
        - action: sync
          path: ./llars-frontend/src
          target: /vue/src
          ignore:
            - node_modules/
    depends_on:
      backend-supervisor-service:
        condition: service_started
    healthcheck:
      test: [ "CMD", "/usr/local/bin/healthcheck.sh" ]
      start_period: 60s  # Build takes ~30s, give it time
      interval: 10s
      timeout: 10s
      retries: 6

  backend-supervisor-service:
    container_name: llars_supervisor_service
    build:
      context: .
      dockerfile: docker/supervisor/Dockerfile-supervisor
    command: [ "/supervisor/start_supervisor.sh" ]
    env_file:
      - .env
    environment:
      - TZ=Europe/Berlin
    depends_on:
      - backend-flask-service
      - db-maria-service
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import pathlib,sys; found=False\nfor p in pathlib.Path('/proc').iterdir():\n    if not p.name.isdigit():\n        continue\n    try:\n        if b'supervisor.py' in (p/'cmdline').read_bytes():\n            found=True\n            break\n    except Exception:\n        pass\nsys.exit(0 if found else 1)\""]
      start_period: 10s
      interval: 15s
      timeout: 5s
      retries: 10

  db-maria-service:
    container_name: llars_db_service
    build:
      context: .
      dockerfile: docker/db/Dockerfile-mariadb
    env_file:
      - .env
    ports:
      - "${DB_EXTERNAL_PORT:-55306}:3306"
    volumes:
      - llarsdb:/var/lib/mysql
    environment:
      - TZ=Europe/Berlin
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:-dev_root_password_change_me}
      - MYSQL_DATABASE=${MYSQL_DATABASE:-database_llars}
      - MYSQL_USER=${MYSQL_USER:-dev_user}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-dev_password_change_me}
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      start_period: 20s
      interval: 5s
      timeout: 5s
      retries: 5

  matomo-db-service:
    container_name: llars_matomo_db_service
    build:
      context: .
      dockerfile: docker/db/Dockerfile-mariadb
    env_file:
      - .env
    expose:
      - "3306"
    volumes:
      - matomodb:/var/lib/mysql
    environment:
      - TZ=Europe/Berlin
      - MYSQL_ROOT_PASSWORD=${MATOMO_MYSQL_ROOT_PASSWORD:-matomo_root_password_change_me}
      - MYSQL_DATABASE=${MATOMO_MYSQL_DATABASE:-matomo}
      - MYSQL_USER=${MATOMO_MYSQL_USER:-matomo}
      - MYSQL_PASSWORD=${MATOMO_MYSQL_PASSWORD:-matomo_password_change_me}
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      start_period: 20s
      interval: 5s
      timeout: 5s
      retries: 5

  yjs-service:
    container_name: llars_yjs_service
    build:
      context: .
      dockerfile: docker/yjs-server/Dockerfile-yjs
    environment:
      - TZ=Europe/Berlin
      - NODE_ENV=${PROJECT_STATE:-development}
      # Derived from PROJECT_URL
      - BASE_URL=${PROJECT_URL:-http://localhost:55080}
      - PORT=8082
      - MYSQL_HOST=db-maria-service
      - MYSQL_PORT=3306
      - MYSQL_USER=${MYSQL_USER:-dev_user}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-dev_password_change_me}
      - MYSQL_DATABASE=${MYSQL_DATABASE:-database_llars}
      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL:-http://authentik-server:9000/application/o/llars-backend/}
    develop:
      watch:
        - action: sync
          path: ./yjs-server
          target: /yjs-server
          ignore:
            - node_modules/
    depends_on:
      - db-maria-service
      - authentik-server
    healthcheck:
      test: ["CMD-SHELL", "node -e \"require('net').connect(8082,'127.0.0.1').on('connect',()=>process.exit(0)).on('error',()=>process.exit(1))\""]
      start_period: 10s
      interval: 10s
      timeout: 5s
      retries: 10

  mkdocs-service:
    container_name: llars_mkdocs_service
    build:
      context: .
      dockerfile: docker/mkdocs/Dockerfile-mkdocs
    expose:
      - "8000"
    ports:
      - "${MKDOCS_EXTERNAL_PORT:-55800}:8000"
    volumes:
      - ./docs:/docs
    environment:
      - TZ=Europe/Berlin
      - PROJECT_STATE=${PROJECT_STATE:-development}
      - MKDOCS_BIND_ADDR=0.0.0.0:8000
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      start_period: 10s
      interval: 30s
      timeout: 5s
      retries: 3

  authentik-server:
    container_name: llars_authentik_server
    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2025.2.4}
    command: server
    environment:
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY:-dev-authentik-secret-key-change-me-please-64-chars-minimum-xxxxxxxx}
      - AUTHENTIK_POSTGRESql__HOST=authentik-db
      - AUTHENTIK_POSTGRESql__USER=${AUTHENTIK_DB_USER:-authentik_dev}
      - AUTHENTIK_POSTGRESql__NAME=${AUTHENTIK_DB_NAME:-authentik_dev}
      - AUTHENTIK_POSTGRESql__PASSWORD=${AUTHENTIK_DB_PASSWORD:-dev_authentik_db_password}
      - AUTHENTIK_REDIS__HOST=authentik-redis
      - AUTHENTIK_LISTEN__PORT=9000
      - AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS=0.0.0.0/0,::/0
      - AUTHENTIK_ERROR_REPORTING__ENABLED=false
      - AUTHENTIK_BOOTSTRAP_EMAIL=${AUTHENTIK_BOOTSTRAP_EMAIL:-admin@example.com}
      - AUTHENTIK_BOOTSTRAP_PASSWORD=${AUTHENTIK_BOOTSTRAP_PASSWORD:-admin123}
    ports:
      - "${AUTHENTIK_EXTERNAL_PORT:-55095}:9000"
    depends_on:
      authentik-db:
        condition: service_healthy
      authentik-redis:
        condition: service_started
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:9000/-/health/live/')\" || exit 1"]
      start_period: 60s
      interval: 15s
      timeout: 10s
      retries: 10
    volumes:
      - authentik_media:/media

  authentik-worker:
    container_name: llars_authentik_worker
    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2025.2.4}
    command: worker
    environment:
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY:-dev-authentik-secret-key-change-me-please-64-chars-minimum-xxxxxxxx}
      - AUTHENTIK_POSTGRESql__HOST=authentik-db
      - AUTHENTIK_POSTGRESql__USER=${AUTHENTIK_DB_USER:-authentik_dev}
      - AUTHENTIK_POSTGRESql__NAME=${AUTHENTIK_DB_NAME:-authentik_dev}
      - AUTHENTIK_POSTGRESql__PASSWORD=${AUTHENTIK_DB_PASSWORD:-dev_authentik_db_password}
      - AUTHENTIK_REDIS__HOST=authentik-redis
      - AUTHENTIK_LISTEN__PORT=9000
    depends_on:
      authentik-db:
        condition: service_healthy
      authentik-redis:
        condition: service_started
    volumes:
      - authentik_media:/media

  authentik-db:
    container_name: llars_authentik_db
    image: public.ecr.aws/docker/library/postgres:16-alpine
    environment:
      - POSTGRES_DB=${AUTHENTIK_DB_NAME:-authentik_dev}
      - POSTGRES_USER=${AUTHENTIK_DB_USER:-authentik_dev}
      - POSTGRES_PASSWORD=${AUTHENTIK_DB_PASSWORD:-dev_authentik_db_password}
    volumes:
      - authentikdb:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${AUTHENTIK_DB_USER:-authentik_dev}"]
      start_period: 10s
      interval: 5s
      timeout: 5s
      retries: 5

  authentik-redis:
    container_name: llars_authentik_redis
    image: public.ecr.aws/docker/library/redis:7-alpine
    command: ["redis-server", "--save", "", "--appendonly", "no"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  # LLARS Redis - Server-autoritative Session Storage (Wizard Sessions, etc.)
  llars-redis:
    container_name: llars_redis
    image: public.ecr.aws/docker/library/redis:7-alpine
    command: ["redis-server", "--save", "60", "1", "--appendonly", "yes"]
    volumes:
      - llars_redis_data:/data
    environment:
      - TZ=Europe/Berlin
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped

  authentik-init:
    container_name: llars_authentik_init
    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2025.2.4}
    environment:
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY:-dev-authentik-secret-key-change-me-please-64-chars-minimum-xxxxxxxx}
      - AUTHENTIK_POSTGRESql__HOST=authentik-db
      - AUTHENTIK_POSTGRESql__USER=${AUTHENTIK_DB_USER:-authentik_dev}
      - AUTHENTIK_POSTGRESql__NAME=${AUTHENTIK_DB_NAME:-authentik_dev}
      - AUTHENTIK_POSTGRESql__PASSWORD=${AUTHENTIK_DB_PASSWORD:-dev_authentik_db_password}
      - AUTHENTIK_REDIS__HOST=authentik-redis
      - AUTHENTIK_BOOTSTRAP_EMAIL=${AUTHENTIK_BOOTSTRAP_EMAIL:-admin@example.com}
      - AUTHENTIK_BOOTSTRAP_PASSWORD=${AUTHENTIK_BOOTSTRAP_PASSWORD:-admin123}
      - LLARS_ADMIN_PASSWORD=${LLARS_ADMIN_PASSWORD:-admin123}
      - AUTHENTIK_BACKEND_CLIENT_ID=${AUTHENTIK_BACKEND_CLIENT_ID:-llars-backend}
      - AUTHENTIK_BACKEND_CLIENT_SECRET=${AUTHENTIK_BACKEND_CLIENT_SECRET:-llars-backend-secret-change-in-production}
      - AUTHENTIK_MATOMO_CLIENT_ID=${AUTHENTIK_MATOMO_CLIENT_ID:-llars-matomo}
      - AUTHENTIK_MATOMO_CLIENT_SECRET=${AUTHENTIK_MATOMO_CLIENT_SECRET:-llars-matomo-secret-change-in-production}
      - AUTHENTIK_MATOMO_APP_SLUG=${AUTHENTIK_MATOMO_APP_SLUG:-llars-matomo}
      - PROJECT_HOST=${PROJECT_HOST:-localhost}
      - PROJECT_URL=${PROJECT_URL:-http://localhost:55080}
      - NGINX_EXTERNAL_PORT=${NGINX_EXTERNAL_PORT:-55080}
      - PROJECT_STATE=${PROJECT_STATE:-development}
      - AUTHENTIK_API_TOKEN=${AUTHENTIK_API_TOKEN:-}
    volumes:
      - ./docker/authentik/init-authentik.sh:/init-authentik.sh:ro
    working_dir: /
    entrypoint: ["/bin/bash", "/init-authentik.sh"]
    depends_on:
      authentik-server:
        condition: service_healthy
      authentik-db:
        condition: service_healthy
    restart: "no"


volumes:
  llarsdb:
    name: llars_llarsdb
  rag_storage:
    name: llars_rag_storage
  rag_docs:
    name: llars_rag_docs
  authentikdb:
    name: llars_authentikdb
  authentik_media:
    name: llars_authentik_media
  matomo_data:
    name: llars_matomo_data
  matomodb:
    name: llars_matomodb
  llars_redis_data:
    name: llars_redis_data