docker-compose.yml

# ══════════════════════════════════════════════════════════════
# ITL ControlPlane — Full Stack
#
#   keycloak          :8080       (Identity & Access Management)
#   api-gateway       :9050→8080  → core-provider     :8000
#                                  → identity-provider :8001
#                                  ↓
#                               postgres :5432
#                               neo4j    :7687
#
# Usage:
#   docker compose up -d                     # full stack
#   docker compose up -d --build             # rebuild all
#   docker compose logs -f api-gateway       # follow API logs
#   docker compose logs -f identity-provider # follow Identity logs
#   docker compose logs -f keycloak          # follow Keycloak logs
#   docker compose down -v                   # tear down + volumes
#
# Docker Socket (auto-detected via .env):
#   Windows: DOCKER_SOCKET=//var/run/docker.sock
#   Linux:   DOCKER_SOCKET=/var/run/docker.sock (default)
#
# Keycloak Setup:
#   1. Access: http://localhost:8080
#   2. Login: admin / admin
#   3. Create client 'itl-identity-service' with service account enabled
#   4. Set KEYCLOAK_CLIENT_SECRET in .env file
#   5. See: ITL.ControlPlane.ResourceProvider.Identity/config/KEYCLOAK_SETUP.md
# ══════════════════════════════════════════════════════════════

services:
  # ── PostgreSQL (primary data store) ────────────────────────
  # Create additional database for Keycloak
  postgres:
    image: postgres:16-alpine
    container_name: itl-postgres
    environment:
      POSTGRES_DB: controlplane
      POSTGRES_USER: controlplane
      POSTGRES_PASSWORD: devpassword
      POSTGRES_MULTIPLE_DATABASES: keycloak
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./init-multiple-dbs.sh:/docker-entrypoint-initdb.d/init-multiple-dbs.sh:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U controlplane -d controlplane"]
      interval: 5s
      timeout: 3s
      retries: 10
    restart: unless-stopped
    networks:
      - itl-network

  # ── Neo4j (graph database for resource metadata) ───────────
  neo4j:
    image: neo4j:5-community
    container_name: itl-neo4j
    environment:
      NEO4J_AUTH: neo4j/devpassword
      NEO4J_PLUGINS: '[]'
      NEO4J_server_memory_heap_initial__size: 256m
      NEO4J_server_memory_heap_max__size: 512m
    ports:
      - "7474:7474"     # HTTP / Browser UI
      - "7687:7687"     # Bolt protocol
    volumes:
      - neo4jdata:/data
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:7474 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s
    restart: unless-stopped
    networks:
      - itl-network

  # ── Keycloak (Identity & Access Management) ────────────────
  # Admin UI at http://localhost:8080
  # Password from keycloak/.env (auto-generated on first docker compose up)
  # Retrieve with: cat keycloak/.env or docker compose exec keycloak env | grep PASSWORD
  keycloak:
    image: quay.io/keycloak/keycloak:23.0
    container_name: itl-keycloak
    command:
      - start-dev
      - --http-port=8080
      - --hostname-strict=false
      - --hostname-strict-https=false
      - --proxy=edge
    env_file:
      - ./keycloak/.env
    environment:
      # ── Admin credentials (from keycloak/.env) ──
      KEYCLOAK_ADMIN: admin
      # ── Database (PostgreSQL for production-like setup) ──
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: controlplane
      KC_DB_PASSWORD: devpassword
      # ── Health and metrics ──
      KC_HEALTH_ENABLED: true
      KC_METRICS_ENABLED: true
      # ── Logging ──
      KC_LOG_LEVEL: INFO
    ports:
      - "8080:8080"     # HTTP (dev mode)
      - "8443:8443"     # HTTPS (if configured)
    volumes:
      - keycloak_data:/opt/keycloak/data
    depends_on:
      postgres:
        condition: service_healthy
      keycloak-init:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 && echo -e 'GET /health/ready HTTP/1.1\\r\\nhost: 127.0.0.1\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q '200 OK'"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 60s
    restart: unless-stopped
    networks:
      - itl-network

  # ── Keycloak Init (generates password for keycloak-setup) ────────
  # Creates Keycloak admin password and writes to keycloak/.env
  keycloak-init:
    image: alpine:latest
    container_name: itl-keycloak-init
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        set -e
        echo "Generating Keycloak admin password..."
        PASSWORD=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 24)
        
        echo "============================================="
        echo "KEYCLOAK ADMIN PASSWORD GENERATED"
        echo "============================================="
        echo "  Password: $$PASSWORD"
        echo "============================================="
        
        mkdir -p /env-output
        echo "KEYCLOAK_ADMIN_PASSWORD=$$PASSWORD" > /env-output/.env
        echo "KEYCLOAK_ADMIN=admin" >> /env-output/.env
    volumes:
      - ./keycloak:/env-output
    restart: on-failure
    networks:
      - itl-network

  # ── Keycloak Setup (runs once after Keycloak is ready) ─────
  # Creates service client, test realm, and users
  # Credentials saved to: docker exec itl-keycloak cat /opt/keycloak/data/.credentials
  keycloak-setup:
    image: curlimages/curl:latest
    container_name: itl-keycloak-setup
    entrypoint: ["/bin/sh", "/scripts/setup.sh"]
    env_file:
      - ./keycloak/.env
    environment:
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
      TEST_REALM_NAME: ${TEST_REALM_NAME:-itl-demo}
      TEST_USER_PASSWORD: ${TEST_USER_PASSWORD:-password123}
      SERVICE_CLIENT_ID: ${SERVICE_CLIENT_ID:-itl-identity-service}
      ENV_FILE: /stack/.env
    volumes:
      - keycloak_data:/data
      - ./keycloak/setup.sh:/scripts/setup.sh:ro
      - .:/stack:rw
    depends_on:
      keycloak:
        condition: service_healthy
    networks:
      - itl-network

  # ── Core Provider (ITL.Core resource provider) ─────────────
  core-provider:
    build:
      context: ../
      dockerfile: ITL.ControlPlane.ResourceProvider.Core/core-provider/Dockerfile
    container_name: itl-core-provider
    ports:
      - "8000:8000"
    volumes:
      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
    group_add:
      - "0"
    environment:
      - PYTHONUNBUFFERED=1
      - LOG_LEVEL=INFO
      - PROVIDER_HOST=0.0.0.0
      - PROVIDER_PORT=8000
      - PROVIDER_BASE_URL=http://core-provider:8000
      # ── Persistent storage ──
      - STORAGE_BACKEND=postgresql
      - DATABASE_HOST=postgres
      - DATABASE_PORT=5432
      - DATABASE_NAME=controlplane
      - DATABASE_USER=controlplane
      - DATABASE_PASSWORD=devpassword
      # ── Neo4j graph sync (Option B) ──
      - NEO4J_URI=bolt://neo4j:7687
      - NEO4J_USERNAME=neo4j
      - NEO4J_PASSWORD=devpassword
      # ── RabbitMQ audit events (Optional) ──
      - RABBITMQ_URL=amqp://guest:guest@rabbitmq:5672/
      - AUDIT_RABBITMQ_ENABLED=true
      - AUDIT_EXCHANGE=audit.events
      # ── API Gateway registration ──
      - CONTROLPLANE_API_URL=http://api-gateway:8080
    depends_on:
      postgres:
        condition: service_healthy
      neo4j:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    networks:
      - itl-network

  # ── Identity Provider (ITL.Identity resource provider) ─────
  identity-provider:
    build:
      context: ../
      dockerfile: ITL.ControlPlane.ResourceProvider.Identity/Dockerfile
    container_name: itl-identity-provider
    env_file:
      - ./.env
    ports:
      - "8001:8000"
    environment:
      - PYTHONUNBUFFERED=1
      - LOG_LEVEL=INFO
      - PROVIDER_HOST=0.0.0.0
      - PROVIDER_PORT=8000
      - PROVIDER_BASE_URL=http://identity-provider:8000
      # ── Persistent storage ──
      - DATABASE_HOST=postgres
      - DATABASE_PORT=5432
      - DATABASE_NAME=controlplane
      - DATABASE_USER=controlplane
      - DATABASE_PASSWORD=devpassword
      # ── Neo4j graph sync ──
      - NEO4J_URI=bolt://neo4j:7687
      - NEO4J_USERNAME=neo4j
      - NEO4J_PASSWORD=devpassword
      # ── Keycloak identity backend ──
      - IDENTITY_PROVIDER=keycloak
      # Use local Keycloak for testing (default), or override with .env
      - KEYCLOAK_URL=${KEYCLOAK_URL:-http://keycloak:8080}
      - KEYCLOAK_REALM=${KEYCLOAK_REALM:-master}
      - KEYCLOAK_CLIENT_ID=itl-identity-service
      - KEYCLOAK_CLIENT_SECRET=${KEYCLOAK_CLIENT_SECRET:-your-client-secret}
      # Optional: Use admin credentials instead (not recommended)
      # - KEYCLOAK_USERNAME=admin
      # - KEYCLOAK_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD:-admin}
      # ── API Gateway registration ──
      - CONTROLPLANE_API_URL=http://api-gateway:8080
      - GATEWAY_REGISTRATION_ENABLED=true
    depends_on:
      postgres:
        condition: service_healthy
      neo4j:
        condition: service_healthy
      keycloak:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    restart: unless-stopped
    networks:
      - itl-network

  # ── API Gateway (ITL ControlPlane API) ─────────────────────
  api-gateway:
    build:
      context: ../
      dockerfile: ITL.ControlPlane.Api/Dockerfile
    container_name: itl-api-gateway
    ports:
      - "9050:8080"
    environment:
      - PYTHONUNBUFFERED=1
      - LOG_LEVEL=INFO
      # ── Graph database ──
      - GRAPH_DB_ENABLED=true
      - GRAPH_DB_TYPE=neo4j
      - NEO4J_URI=bolt://neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=devpassword
      # ── PostgreSQL (provider registry) ──
      - PROVIDER_DB_HOST=postgres
      - PROVIDER_DB_PORT=5432
      - PROVIDER_DB_NAME=controlplane
      - PROVIDER_DB_USER=controlplane
      - PROVIDER_DB_PASSWORD=devpassword
    depends_on:
      postgres:
        condition: service_healthy
      neo4j:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    networks:
      - itl-network

  # ── Redis (session storage) ────────────────────────────────
  redis:
    image: redis:7-alpine
    container_name: itl-redis
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    command: redis-server --appendonly yes
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10
    restart: unless-stopped
    networks:
      - itl-network

  # ── RabbitMQ (message broker for audit events) ─────────────
  # Management UI at http://localhost:15672 (guest/guest)
  rabbitmq:
    image: rabbitmq:3-management-alpine
    container_name: itl-rabbitmq
    environment:
      RABBITMQ_DEFAULT_USER: guest
      RABBITMQ_DEFAULT_PASS: guest
      RABBITMQ_DEFAULT_VHOST: /
    ports:
      - "5672:5672"      # AMQP protocol
      - "15672:15672"    # Management UI
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq
    healthcheck:
      test: ["CMD-SHELL", "rabbitmq-diagnostics -q ping"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s
    restart: unless-stopped
    networks:
      - itl-network

  # ── CloudBeaver (web-based database manager) ────────────────
  # Browse PostgreSQL at http://localhost:8978
  cloudbeaver:
    image: dbeaver/cloudbeaver:latest
    container_name: itl-cloudbeaver
    ports:
      - "8978:8978"
    volumes:
      - cloudbeaver_data:/opt/cloudbeaver/workspace
      # Config file mount disabled - configure via web UI after first start
      # - ./cloudbeaver/initial-data-sources.conf:/opt/cloudbeaver/conf/initial-data-sources.conf:ro
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - itl-network

  # ── Dashboard (Control Plane Web UI) ────────────────────────
  # Access at http://localhost:9051
  dashboard:
    build:
      context: ../ITL.ControlPlane.Dashboard
      dockerfile: Dockerfile
    container_name: itl-dashboard
    ports:
      - "9051:8090"
    volumes:
      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
    environment:
      - API_GATEWAY_URL=http://api-gateway:8080
      - PORT=8090
      # ── Keycloak OIDC Authentication ──
      - KEYCLOAK_SERVER_URL=https://sts.itlusions.com
      - KEYCLOAK_REALM=itlusions
      - KEYCLOAK_CLIENT_ID=itl-dashboard
      - KEYCLOAK_CLIENT_SECRET=6o96pMaldWjuT35iW23A13NJA2BYMvau
      - KEYCLOAK_REDIRECT_URI=http://localhost:9051/oidc/callback
      - SESSION_SECRET_KEY=change-me-in-production-use-32-chars
      # ── Redis Session Storage ──
      - REDIS_URL=redis://redis:6379/0
      # Use local Keycloak for testing (default), or override with .env
      #- KEYCLOAK_SERVER_URL=${KEYCLOAK_URL:-http://keycloak:8080}
    depends_on:
      api-gateway:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8090/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    networks:
      - itl-network

  # ── Audit Event Consumer (SIEM/Analytics forwarder) ─────────
  # Consumes from RabbitMQ, forwards to Elasticsearch/Splunk/etc.
  # Usage: docker compose --profile siem up audit-consumer
  audit-consumer:
    profiles:
      - siem
    build:
      context: D:\repos\ITL.ControlPlane.SDK
      dockerfile: Dockerfile.audit-consumer
    container_name: itl-audit-consumer
    environment:
      - RABBITMQ_URL=amqp://guest:guest@rabbitmq:5672/
      - AUDIT_EXCHANGE=audit.events
      - CONSUMER_QUEUE=audit-siem-consumer
      # ── Elasticsearch (enable for ELK stack) ──
      - ELASTICSEARCH_ENABLED=false
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_INDEX=audit-events
      # ── Splunk (enable for Splunk) ──
      - SPLUNK_ENABLED=false
      # - SPLUNK_HEC_URL=https://splunk:8088
      # - SPLUNK_TOKEN=your-hec-token
      # ── Webhook (custom integrations) ──
      - WEBHOOK_ENABLED=false
      # - WEBHOOK_URL=https://your-webhook-endpoint
      # ── Slack alerts (for important events) ──
      - SLACK_ENABLED=false
      # - SLACK_WEBHOOK_URL=https://hooks.slack.com/...
      # - SLACK_FILTER_ACTIONS=DELETE,DISABLE
    depends_on:
      rabbitmq:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - itl-network

  # ── Pre-compiled binary version (optional) ─────────────────
  # Usage: docker compose --profile compiled up core-provider-compiled
  core-provider-compiled:
    profiles:
      - compiled
    build:
      context: ./core-provider
      dockerfile: Dockerfile.compiled
    container_name: itl-core-provider-compiled
    ports:
      - "8000:8000"
    environment:
      - LOG_LEVEL=INFO
      - STORAGE_BACKEND=postgresql
      - DATABASE_HOST=postgres
      - DATABASE_PORT=5432
      - DATABASE_NAME=controlplane
      - DATABASE_USER=controlplane
      - DATABASE_PASSWORD=devpassword
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 5s
    restart: unless-stopped
    networks:
      - itl-network

volumes:
  pgdata:
    driver: local
  keycloak_data:
    driver: local
  neo4jdata:
    driver: local
  cloudbeaver_data:
    driver: local
  rabbitmq_data:
    driver: local
  redis_data:
    driver: local

networks:
  itl-network:
    driver: bridge