docker-compose.yml

# =============================================================================
# TicketFlow - local development stack (phase 1)
#
#   docker compose up -d          brings up Postgres, Mongo, Kafka, the topics,
#                                 the Flyway migrations and Kafka UI
#   docker compose down           stops everything, keeps the data
#   docker compose down -v        wipes the data (re-runs every init script)
#
# The application services (order/payment/notification) join this file in
# phase 2 - the infrastructure is deliberately runnable on its own first.
# =============================================================================
name: ticketflow

services:

  # ---------------------------------------------------------------------------
  # PostgreSQL - transactional store for Order Service and Payment Service.
  # One container, two databases, no shared schema.
  # ---------------------------------------------------------------------------
  postgres:
    image: postgres:16-alpine
    container_name: ticketflow-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-ticketflow}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ticketflow}
      POSTGRES_DB: postgres
    ports:
      # 5433 on the host: a native PostgreSQL install commonly already owns
      # 5432. Inside the ticketflow network the port is still 5432.
      - "${POSTGRES_PORT:-5433}:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./infra/postgres/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-ticketflow} -d postgres"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # Flyway - applies each service's migrations to its own database.
  # Two one-shot containers, because a service's schema is that service's
  # responsibility. In phase 2 the same migrations run from inside the Spring
  # Boot app; the files live in the service's resources exactly for that.
  # ---------------------------------------------------------------------------
  flyway-orders:
    image: flyway/flyway:10-alpine
    container_name: ticketflow-flyway-orders
    depends_on:
      postgres:
        condition: service_healthy
    command: >
      -url=jdbc:postgresql://postgres:5432/ticketflow_orders
      -user=${POSTGRES_USER:-ticketflow}
      -password=${POSTGRES_PASSWORD:-ticketflow}
      -locations=filesystem:/flyway/sql/migration,filesystem:/flyway/sql/seed
      -connectRetries=15
      -baselineOnMigrate=true
      migrate
    volumes:
      - ./services/order-service/src/main/resources/db/migration:/flyway/sql/migration:ro
      - ./services/order-service/src/main/resources/db/seed:/flyway/sql/seed:ro
    restart: "no"
    networks: [ticketflow]

  flyway-payments:
    image: flyway/flyway:10-alpine
    container_name: ticketflow-flyway-payments
    depends_on:
      postgres:
        condition: service_healthy
    command: >
      -url=jdbc:postgresql://postgres:5432/ticketflow_payments
      -user=${POSTGRES_USER:-ticketflow}
      -password=${POSTGRES_PASSWORD:-ticketflow}
      -locations=filesystem:/flyway/sql/migration
      -connectRetries=15
      -baselineOnMigrate=true
      migrate
    volumes:
      - ./services/payment-service/src/main/resources/db/migration:/flyway/sql/migration:ro
    restart: "no"
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # MongoDB - document store for Notification Service (tickets + history).
  # ---------------------------------------------------------------------------
  mongo:
    image: mongo:7
    container_name: ticketflow-mongo
    restart: unless-stopped
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USER:-root}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD:-root}
      MONGO_INITDB_DATABASE: ticketflow_notifications
    ports:
      - "${MONGO_PORT:-27017}:27017"
    volumes:
      - mongo-data:/data/db
      - ./infra/mongo/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # Kafka - single node in KRaft mode (no ZooKeeper).
  #
  # Two listeners on purpose:
  #   kafka:19092     -> for containers on the ticketflow network
  #   localhost:9092  -> for apps running on the Windows host (your IDE)
  # Getting this wrong is the classic "works in Docker, times out from the IDE".
  # ---------------------------------------------------------------------------
  kafka:
    image: apache/kafka:3.9.0
    container_name: ticketflow-kafka
    restart: unless-stopped
    ports:
      - "${KAFKA_EXTERNAL_PORT:-9092}:9092"
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
      KAFKA_LISTENERS: INTERNAL://:19092,CONTROLLER://:9093,EXTERNAL://:9092
      KAFKA_ADVERTISED_LISTENERS: INTERNAL://kafka:19092,EXTERNAL://localhost:9092
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: INTERNAL:PLAINTEXT,CONTROLLER:PLAINTEXT,EXTERNAL:PLAINTEXT
      KAFKA_INTER_BROKER_LISTENER_NAME: INTERNAL
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
      # A topic created by accident is a bug, not a feature.
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "false"
      KAFKA_LOG_RETENTION_HOURS: 168
      CLUSTER_ID: ticketflow-local-cluster
    volumes:
      - kafka-data:/tmp/kraft-combined-logs
    healthcheck:
      test: ["CMD-SHELL", "/opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:19092 --list || exit 1"]
      interval: 10s
      timeout: 10s
      retries: 15
      start_period: 20s
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # One-shot topic creation. Runs, prints the topic list, exits 0.
  # ---------------------------------------------------------------------------
  kafka-init:
    image: apache/kafka:3.9.0
    container_name: ticketflow-kafka-init
    depends_on:
      kafka:
        condition: service_healthy
    entrypoint: ["/bin/bash", "/scripts/create-topics.sh"]
    environment:
      KAFKA_BOOTSTRAP: kafka:19092
    volumes:
      - ./infra/kafka:/scripts:ro
    restart: "no"
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # Kafka UI - browse topics, messages and consumer lag at http://localhost:8085
  # Not required by anything; it is how you *see* the async flow working.
  # ---------------------------------------------------------------------------
  kafka-ui:
    image: ghcr.io/kafbat/kafka-ui:latest
    container_name: ticketflow-kafka-ui
    restart: unless-stopped
    depends_on:
      kafka:
        condition: service_healthy
    ports:
      - "${KAFKA_UI_PORT:-8085}:8080"
    environment:
      KAFKA_CLUSTERS_0_NAME: ticketflow-local
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka:19092
      DYNAMIC_CONFIG_ENABLED: "true"
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # Order Service. Behind the `apps` profile so `docker compose up -d` stays
  # infrastructure-only - the usual local loop is to run the service from the
  # IDE against these containers.
  #
  #   docker compose --profile apps up -d --build
  # ---------------------------------------------------------------------------
  order-service:
    profiles: [apps]
    build:
      context: .
      dockerfile: services/order-service/Dockerfile
    container_name: ticketflow-order-service
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
    environment:
      SPRING_PROFILES_ACTIVE: docker
      # O Prometheus deste compose raspa /actuator/prometheus, entao aqui a rota
      # fica aberta. Fora daqui ela e fechada por padrao: as metricas contam
      # volume de pedidos, receita aprovada e recusada, cada rota da API e a
      # versao da JVM - de graca para quem passar.
      TICKETFLOW_OBSERVABILITY_PUBLIC_METRICS: "${TICKETFLOW_OBSERVABILITY_PUBLIC_METRICS:-true}"
      POSTGRES_USER: ${POSTGRES_USER:-ticketflow}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ticketflow}
    ports:
      # 8081 on the host: 8080 is frequently already in use, and it is also the
      # port you get when running the service straight from the IDE.
      - "${ORDER_SERVICE_PORT:-8081}:8080"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8080/actuator/health"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 40s
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # The external payment provider, stubbed with Wiremock.
  #
  # Never a real gateway, not even locally. The stubs make the unhappy paths
  # reproducible: a charge above 2000 is declined, so ordering a Camarote ticket
  # (2400) demonstrates the refusal branch while Pista (650) demonstrates
  # approval - without editing a single file.
  #
  # Admin API at http://localhost:8090/__admin to inspect the requests received.
  # ---------------------------------------------------------------------------
  payment-gateway:
    profiles: [apps]
    # Construído a partir do mesmo Dockerfile que a hospedagem usa, em vez da
    # imagem crua. Duas definições do mesmo contêiner divergem — e a que diverge
    # em silêncio é sempre a que não roda na sua máquina.
    build:
      context: .
      dockerfile: infra/wiremock/Dockerfile
    container_name: ticketflow-payment-gateway
    restart: unless-stopped
    environment:
      # Aqui a API de administração fica aberta: inspecionar o que o Payment
      # Service enviou, com header de idempotência e tudo, é metade da utilidade
      # deste contêiner em desenvolvimento. Publicado, o padrão do script é o
      # contrário — trancado sem precisar de configuração.
      GATEWAY_ADMIN_OPEN: "true"
    ports:
      - "${PAYMENT_GATEWAY_PORT:-8090}:8080"
    volumes:
      # As regras continuam vindo do disco no desenvolvimento, por cima das que a
      # imagem trouxe: editar um arquivo e recarregar vale mais do que
      # reconstruir a imagem a cada ajuste de stub.
      - ./infra/wiremock/mappings:/home/wiremock/mappings:ro
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # Payment Service. A worker: it exposes no business API, only actuator.
  # ---------------------------------------------------------------------------
  payment-service:
    profiles: [apps]
    build:
      context: .
      dockerfile: services/payment-service/Dockerfile
    container_name: ticketflow-payment-service
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      payment-gateway:
        condition: service_started
    environment:
      SPRING_PROFILES_ACTIVE: docker
      # O Prometheus deste compose raspa /actuator/prometheus, entao aqui a rota
      # fica aberta. Fora daqui ela e fechada por padrao: as metricas contam
      # volume de pedidos, receita aprovada e recusada, cada rota da API e a
      # versao da JVM - de graca para quem passar.
      TICKETFLOW_OBSERVABILITY_PUBLIC_METRICS: "${TICKETFLOW_OBSERVABILITY_PUBLIC_METRICS:-true}"
      POSTGRES_USER: ${POSTGRES_USER:-ticketflow}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ticketflow}
      # Quem cobra. O padrão continua sendo o gateway simulado: quem clona o
      # repositório precisa conseguir rodar o sistema inteiro sem ter conta em
      # provedor nenhum, e é isso que o `:-http` garante.
      #
      # Com `stripe` no .env, o mesmo compose passa a cobrar no provedor de
      # verdade — em modo de teste. As três variáveis abaixo não têm padrão de
      # propósito: se o provedor for `stripe` e a chave faltar, o serviço se
      # recusa a subir. Subir e só falhar na primeira cobrança seria pior.
      TICKETFLOW_GATEWAY_PROVIDER: ${TICKETFLOW_GATEWAY_PROVIDER:-http}
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      # Confirma o cartão na hora com um meio de pagamento fictício do Stripe.
      # Sem ele o ciclo só fecha quando o webhook chega, e o Stripe não alcança
      # localhost sem o `stripe listen` da CLI.
      STRIPE_TEST_CARD: ${STRIPE_TEST_CARD:-}
    ports:
      - "${PAYMENT_SERVICE_PORT:-8082}:8082"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8082/actuator/health"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 40s
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # Notification Service. Consumes both topics - ORDER_CREATED to know what was
  # bought, the payment result to know whether to print it - and publishes
  # nothing, so it needs no outbox.
  # ---------------------------------------------------------------------------
  notification-service:
    profiles: [apps]
    build:
      context: .
      dockerfile: services/notification-service/Dockerfile
    container_name: ticketflow-notification-service
    restart: unless-stopped
    depends_on:
      mongo:
        condition: service_healthy
      kafka:
        condition: service_healthy
    environment:
      SPRING_PROFILES_ACTIVE: docker
      # O Prometheus deste compose raspa /actuator/prometheus, entao aqui a rota
      # fica aberta. Fora daqui ela e fechada por padrao: as metricas contam
      # volume de pedidos, receita aprovada e recusada, cada rota da API e a
      # versao da JVM - de graca para quem passar.
      TICKETFLOW_OBSERVABILITY_PUBLIC_METRICS: "${TICKETFLOW_OBSERVABILITY_PUBLIC_METRICS:-true}"
      # Só arquiva no S3 se o LocalStack estiver de pé (perfil `aws`).
      TICKETFLOW_ARCHIVE_ENABLED: ${TICKETFLOW_ARCHIVE_ENABLED:-false}
    ports:
      - "${NOTIFICATION_SERVICE_PORT:-8083}:8083"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8083/actuator/health"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 40s
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # LocalStack faz o papel da AWS. Aqui so o S3, para arquivar o ingresso
  # emitido - escrito uma vez, lido raramente, e precisa sobreviver a um restore
  # do banco feito antes do ingresso existir.
  #
  # Perfil proprio: o Notification Service roda perfeitamente sem nada disso.
  # ---------------------------------------------------------------------------
  localstack:
    profiles: [aws]
    image: localstack/localstack:4.0
    container_name: ticketflow-localstack
    restart: unless-stopped
    environment:
      SERVICES: s3
      DEBUG: "0"
    ports:
      - "${LOCALSTACK_PORT:-4566}:4566"
    volumes:
      - ./infra/localstack/init:/etc/localstack/init/ready.d:ro
      - localstack-data:/var/lib/localstack
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:4566/_localstack/health"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s
    networks: [ticketflow]

  # ---------------------------------------------------------------------------
  # Observabilidade. Perfil proprio: nem sempre se quer subir tudo, e a stack de
  # metricas nao e requisito para rodar o sistema.
  #
  #   docker compose --profile apps --profile observability up -d
  # ---------------------------------------------------------------------------
  prometheus:
    profiles: [observability]
    image: prom/prometheus:v3.1.0
    container_name: ticketflow-prometheus
    restart: unless-stopped
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.retention.time=24h
      - --web.enable-lifecycle
    ports:
      # 9091 no host: a 9090 costuma ja estar ocupada por outro Prometheus.
      # Dentro da rede o Grafana continua falando com prometheus:9090.
      - "${PROMETHEUS_PORT:-9091}:9090"
    volumes:
      - ./infra/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    networks: [ticketflow]

  grafana:
    profiles: [observability]
    image: grafana/grafana:11.5.1
    container_name: ticketflow-grafana
    restart: unless-stopped
    depends_on:
      - prometheus
    environment:
      # Ambiente local: login anonimo como admin evita uma tela de senha entre
      # voce e o dashboard. Nunca faca isso em nada exposto.
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Admin
      GF_AUTH_DISABLE_LOGIN_FORM: "true"
      GF_USERS_DEFAULT_THEME: light
    ports:
      # 3002 no host: 3000 e 3001 costumam estar ocupadas por outro Grafana ou por
      # um dev server de frontend. Dentro do container e sempre 3000.
      - "${GRAFANA_PORT:-3002}:3000"
    volumes:
      # Datasource e dashboard provisionados: sobe pronto, sem clicar em nada.
      - ./infra/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./infra/grafana/dashboards:/etc/grafana/dashboards:ro
      - grafana-data:/var/lib/grafana
    networks: [ticketflow]

volumes:
  postgres-data:
  mongo-data:
  kafka-data:
  prometheus-data:
  grafana-data:
  localstack-data:

networks:
  ticketflow:
    name: ticketflow
    driver: bridge