docker-compose.yaml

services:
  postgres:
    image: postgres:18
    container_name: postgres-db
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-mlsec2}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mlsec2_pw}
      POSTGRES_DB: mlsec
    ports:
      - "5434:5432"
    volumes:
      - pgdata:/var/lib/postgresql
      - ./services/postgres/init:/docker-entrypoint-initdb.d
    networks:
      - backend_net

  # Test database 
  postgres-test:
    image: postgres:18
    container_name: test-postgres-db
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-mlsec2}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mlsec2_pw}
      POSTGRES_DB: mlsec_test
    ports:
      - "5433:5432"
    volumes:
      - pgdata_test:/var/lib/postgresql
      - ./services/postgres/init:/docker-entrypoint-initdb.d
    networks:
      - backend_net

  minio:
    image: minio/minio:latest
    container_name: mlsec-minio
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-mlsec2}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-mlsec2_pw}
    command: server /data --console-address ":9001"
    ports:
      - "9000:9000" # API
      - "9001:9001" # Console UI
    volumes:
      - miniodata:/data
    healthcheck:
      test: [ "CMD", "mc", "ready", "local" ]
      interval: 30s
      timeout: 20s
      retries: 3
    networks:
      - backend_net

  rabbitmq:
    image: rabbitmq:3-management
    container_name: rabbitmq
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_USER:-mlsec2}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:-mlsec2_pw}
    ports:
      - "5672:5672" # AMQP
      - "15672:15672" # Management UI
    volumes:
      - rabbitmqdata:/var/lib/rabbitmq
    networks:
      - backend_net

  redis:
    image: redis:7-alpine
    container_name: mlsec-redis
    command: redis-server --appendonly yes
    ports:
      - "6379:6379"
    volumes:
      - redisdata:/data
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - backend_net

  api:
    build:
      context: ./services/api
      dockerfile: Dockerfile
    container_name: mlsec-api
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-mlsec2}:${POSTGRES_PASSWORD:-mlsec2_pw}@postgres:5432/mlsec
      CELERY_BROKER_URL: amqp://${RABBITMQ_USER:-mlsec2}:${RABBITMQ_PASSWORD:-mlsec2_pw}@rabbitmq:5672//
      REDIS_URL: redis://redis:6379/0
      MINIO_ENDPOINT: minio:9000
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-mlsec2}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-mlsec2_pw}
      MINIO_SECURE: "false"
      ADMIN_ALLOWED_HOSTS: '["172.22.0.1"]' # Docker bridge gateway for localhost SSH tunnel access
      ADMIN_TRUSTED_PROXY_HOSTS: '["127.0.0.1", "::1", "172.16.0.0/12"]' # Trust nginx on any Docker bridge subnet
      ADMIN_ALLOWED_NETWORKS: '["172.16.0.0/12"]' # Allow Docker bridge gateway as effective client (localhost dev access)
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
    volumes:
      - ./config.yaml:/app/config.yaml:ro
    networks:
      - backend_net
    depends_on:
      - postgres
      - rabbitmq
      - redis
      - minio

  # Gateway to control traffic for student containers
  mlsec-gateway:
    build:
      context: ./services/gateway
      dockerfile: Dockerfile
    container_name: mlsec-gateway
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.ip_forward=1
    networks:
      - defense_net

  # Worker Container (Celery)
  worker:
    build:
      context: ./services/worker
      dockerfile: Dockerfile
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-mlsec2}:${POSTGRES_PASSWORD:-mlsec2_pw}@postgres:5432/mlsec
      CELERY_BROKER_URL: amqp://${RABBITMQ_USER:-mlsec2}:${RABBITMQ_PASSWORD:-mlsec2_pw}@rabbitmq:5672//
      CELERY_DEFAULT_QUEUE: mlsec
      REDIS_URL: redis://redis:6379/0
      MINIO_ENDPOINT: minio:9000
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-mlsec2}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-mlsec2_pw}
      MINIO_SECURE: "false"
      VIRUSTOTAL_API_KEY: ${VIRUSTOTAL_API_KEY:-}
      CELERY_CONCURRENCY: "${WORKER_CONCURRENCY:-1}" # Forces use of a single thread per Worker container
    user: "10001"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./config.yaml:/app/config.yaml:ro
      - worker_cache:/app/cache
    group_add:
      - "${DOCKER_GID:-999}" # Allows Worker container to interact with Docker Engine
    networks:
      - backend_net
      - defense_net
    depends_on:
      - postgres
      - rabbitmq
      - redis
      - minio

  # Frontend (Astro)
  frontend:
    build:
      context: ./services/frontend
      dockerfile: Dockerfile
    container_name: mlsec-frontend
    environment:
      PUBLIC_API_URL: ""
      API_INTERNAL_URL: http://api:8000
    volumes:
      - ./services/frontend:/app
      - /app/node_modules
    networks:
      - backend_net
    depends_on:
      - api

  nginx:
    image: nginx:alpine
    container_name: mlsec-nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./services/nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - certbot-conf:/etc/letsencrypt:ro
      - certbot-www:/var/www/certbot:ro
    networks:
      - backend_net
    depends_on:
      - api
      - frontend

  certbot:
    image: certbot/certbot
    container_name: mlsec-certbot
    volumes:
      - certbot-conf:/etc/letsencrypt
      - certbot-www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew --quiet; sleep 12h & wait $${!}; done'"

  # Adminer (Can remove in production if we dont need it)
  adminer:
    image: adminer:latest
    container_name: mlsec-adminer
    ports:
      - "8081:8080"
    networks:
      - backend_net
    depends_on:
      - postgres

networks:
  backend_net:
    name: backend_net
    driver: bridge
  defense_net:
    name: defense_net
    driver: bridge
volumes:
  pgdata:
  pgdata_test:
  rabbitmqdata:
  redisdata:
  miniodata:
  worker_cache:
  certbot-conf:
  certbot-www: