docker-compose.yml

version: "3.8"

# REDIS_PASSWORD must be set in the shell or a .env file before starting.
# Example: export REDIS_PASSWORD=supersecret && docker compose up -d

services:
  redis:
    image: redis:7-alpine
    ports:
      - "127.0.0.1:6379:6379"   # bind to loopback only — not exposed to LAN/internet
    command: >
      redis-server
      --maxmemory 256mb
      --maxmemory-policy allkeys-lru
      --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD env var is required}
    environment:
      - REDIS_PASSWORD=${REDIS_PASSWORD}
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  rate-limiter:
    build:
      context: .
      dockerfile: Dockerfile.server
    ports:
      - "50051:50051"
      - "9090:9090"
    environment:
      - REDIS_ADDR=redis:6379
      - REDIS_PASSWORD=${REDIS_PASSWORD}
      - GRPC_PORT=50051
      - METRICS_PORT=9090
      - RATE_LIMIT=100
      - TLS_CERT=/certs/server.crt
      - TLS_KEY=/certs/server.key
    volumes:
      - ./certs:/certs:ro
    depends_on:
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:9090/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  gateway:
    build:
      context: .
      dockerfile: Dockerfile.gateway
    ports:
      - "8081:8081"
    environment:
      - GRPC_ADDRS=rate-limiter:50051
      - HTTP_PORT=8081
      - UPSTREAM_URL=http://httpbin.org
      - METRICS_ADDR=http://rate-limiter:9090
      - TLS_CERT=/certs/server.crt
    volumes:
      - ./certs:/certs:ro
    depends_on:
      rate-limiter:
        condition: service_healthy   # wait until gRPC + metrics are ready

  prometheus:
    image: prom/prometheus:latest
    ports:
      - "9091:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
    depends_on:
      rate-limiter:
        condition: service_healthy

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}
    volumes:
      - ./grafana/provisioning:/etc/grafana/provisioning
    depends_on:
      - prometheus