docker-compose.yaml

services:
  s3:
    image: ${VERSITY_S3GW_IMAGE:-docker.io/versity/versitygw:latest}
    entrypoint: ["/bin/sh", "-ec"]
    environment:
      VGW_CORS_ALLOW_ORIGIN: ${VGW_CORS_ALLOW_ORIGIN:-https://localhost:9443}
      VGW_WEBUI_GATEWAYS: https://localhost:${S3_PORT:-8443}
    command:
      - |
        if [ "${S3_WEBUI_ENABLED:-true}" = "true" ]; then
          exec versitygw \
            --access "${S3_ACCESS_KEY}" \
            --secret "${S3_SECRET_KEY}" \
            --iam-dir /data/vers \
            --webui 0.0.0.0:7443 \
            --webui-cert /certs/s3.crt \
            --webui-key /certs/s3.key \
            --cert /certs/s3.crt \
            --key /certs/s3.key \
            --port 0.0.0.0:7070 \
            posix --versioning-dir /data/vers /data/gw
        else
          exec versitygw \
            --access "${S3_ACCESS_KEY}" \
            --secret "${S3_SECRET_KEY}" \
            --iam-dir /data/vers \
            --cert /certs/s3.crt \
            --key /certs/s3.key \
            --port 0.0.0.0:7070 \
            posix --versioning-dir /data/vers /data/gw
        fi
    container_name: s3
    restart: unless-stopped
    volumes:
      - ./certs/s3:/certs:ro
      - ./data/vers:/data/vers
      - ./data/gw:/data/gw
      - ./certs/_master/ca.crt:/certs/ca.crt:ro
    ports:
      - "127.0.0.1:${S3_PORT}:7070"
      - "127.0.0.1:${S3_WEBUI_PORT:-9443}:7443"
    networks:
      sfc:
        ipv4_address: ${S3_IP}

  influxdb:
    container_name: influxdb3-core
    image: sfc/influxdb:${INFLUXDB3_VERSION}
    build:
      context: influxdb
      dockerfile: Dockerfile
      args:
        INFLUXDB3_BUILD_VERSION: ${INFLUXDB3_BUILD_VERSION}
    ports:
      - "${INFLUXDB_PORT}:8181"
      # Port 8182 (admin token recovery) is NOT exposed externally for security
      # It's only accessible within the Docker network for internal token generation
    environment:
      # Removed S3-related environment variables since we're using local file storage
      TLS_KEY: /home/influxdb3/certs/influxdb.key
      TLS_CERT: /home/influxdb3/certs/influxdb.crt
      TLS_MIN_VERSION: tls-1.3
      INFLUXDB3_TLS_CA: /home/influxdb3/certs/ca.crt
      TLS_CA: /home/influxdb3/certs/ca.crt
      NODE_ID: ${INFLUXDB_NODE_ID}
      INFLUXDB3_ADMIN_TOKEN: ${INFLUXDB_ADMIN_TOKEN}
      TOKEN_FILE: /influxdb_tokens/sfc.token
      # Disable anonymous usage analytics (InfluxDB3 specific)
      INFLUXDB3_TELEMETRY_DISABLE_UPLOAD: ${INFLUXDB3_TELEMETRY_DISABLE_UPLOAD}
    volumes:
      - ./data/influxdb:/var/lib/influxdb3
      - ./certs/influxdb:/home/influxdb3/certs:ro
      - ./data/influxdb_tokens:/influxdb_tokens
      - ./certs/_master/ca.crt:/home/influxdb3/certs/ca.crt:ro
    # Removed S3 dependency since we're using local file storage
    entrypoint: ["/home/influx/influxdb3-entrypoint.sh"]
    command: []
    networks:
      sfc:
        ipv4_address: ${INFLUXDB_IP}

  sfc:
    image: sfc/sfc:latest
    build:
      context: ./sfc
      dockerfile: Dockerfile
      args:
        PYTHON_VERSION: ${PYTHON_VERSION}
        PYTHON_DIGEST: ${PYTHON_DIGEST}
        APSCHEDULER_VERSION: ${APSCHEDULER_VERSION:-3.11.3}
        AIOHTTP_VERSION: ${AIOHTTP_VERSION:-3.14.3}
    container_name: sfc
    command: ["--no-instrumenting"]
    environment:
      INFLUX_HOST: influxdb
      INFLUX_PORT: ${INFLUXDB_PORT}
      INFLUX_DB: ${INFLUXDB_DB}
      INFLUXDB3_AUTH_TOKEN_FILE: /influxdb_tokens/sfc.token
      INFLUXDB3_TLS_CA: /home/sfcuser/sfc_certs/ca.crt
      CA_CHAIN: /home/sfcuser/sfc_certs/sf_ca.crt,/home/sfcuser/sfc_certs/influxdb_ca.crt
      TZ: UTC
      INT_HI_FREQ: ${SFC_HI_FREQ}
      INT_MED_FREQ: ${SFC_MED_FREQ}
      INT_LO_FREQ: ${SFC_LO_FREQ}
      INT_EXPERIMENTAL_FREQ: ${SFC_EXPERIMENTAL_FREQ}
      SF_MVIP: ${SF_MVIP}
      SF_USERNAME: ${SF_USERNAME}
      SF_PASSWORD: ${SF_PASSWORD}
      SF_VERIFY_SSL: ${SF_VERIFY_SSL:-true}
      # SF_VERIFY_SSL: false
    depends_on:
      - influxdb
    volumes:
      - ./certs/sfc:/home/sfcuser/sfc_certs:ro
      - ./data/influxdb_tokens:/influxdb_tokens:ro
      - ./certs/_master/ca.crt:/home/sfcuser/sfc_certs/ca.crt:ro
    networks:
      sfc:
        ipv4_address: ${SFC_IP}

  utils:
    image: sfc/utils:latest
    build:
      context: ./utils-container
    container_name: utils
    restart: "no"
    environment:
      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
      AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
      S3_ENDPOINT: https://s3:7070
      BUCKET: ${S3_BUCKET}
      CRED_DIR: /home/influx
      # InfluxDB3 Environment Variables
      INFLUXDB3_HOST_URL: https://${INFLUX_HOST:-influxdb}:${INFLUX_PORT:-8181}
      INFLUXDB3_TLS_CA: /home/influx/ca.crt
      INFLUXDB3_AUTH_TOKEN_FILE: /home/influx/sfc.token
    networks:
      sfc:
        ipv4_address: ${UTILS_IP}
    volumes:
      - ./certs/_master/ca.crt:/home/influx/ca.crt:ro
      - ./certs/influxdb/influxdb.crt:/home/influx/influxdb.crt:ro
      - ./certs/s3/s3.crt:/home/influxdb/s3.crt:ro
      - ./data/influxdb_tokens/sfc.token:/home/influx/sfc.token:ro
      - ./data/vers:/s3_data
    # No depends_on - utils should be independent for troubleshooting
    command: ["tail","-f","/dev/null"]

  grafana:
    image: grafana/grafana:${GRAFANA_VERSION}
    container_name: grafana
    restart: unless-stopped
    ports:
      - "${GRAFANA_PORT}:3000"
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
      # HTTPS Configuration
      GF_SERVER_PROTOCOL: https
      GF_SERVER_CERT_FILE: /etc/grafana/certs/grafana.crt
      GF_SERVER_CERT_KEY: /etc/grafana/certs/grafana.key
      # Trust custom CA for InfluxDB connections
      GF_SERVER_ROOT_URL: https://localhost:${GRAFANA_PORT}
      # Workaround for Grafana 12.1 custom CA bug
      GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION: "false"
      GF_DATABASE_SSL_MODE: "disable"
      GF_PLUGIN_ENABLE_ALPHA: "true"
    volumes:
      - ./certs/_master/ca.crt:/usr/local/share/ca-certificates/ca.crt:ro
      - ./certs/grafana:/etc/grafana/certs:ro
      - grafana-storage:/var/lib/grafana
    depends_on:
      - influxdb
    networks:
      sfc:
        ipv4_address: ${GRAFANA_IP}

  explorer:
    image: sfc/influxdb3-explorer:${INFLUXDB3_EXPLORER_VERSION}
    build:
      context: .
      dockerfile: explorer/Dockerfile
      args:
        INFLUXDB3_EXPLORER_VERSION: ${INFLUXDB3_EXPLORER_VERSION}
    container_name: influxdb3-explorer
    restart: unless-stopped
    ports:
      - "${EXPLORER_PORT}:443"
      # - "8080:80" # For non-TLS access (not recommended)
    environment:
      SSL_CERT_PATH: /etc/nginx/ssl/cert.pem
      SSL_KEY_PATH: /etc/nginx/ssl/key.pem
      DATABASE_URL: /db/sqlite.db
      NODE_ENV: production
    command:
      - "--mode=admin"
    volumes:
      - ./data/explorer/db:/db:rw
      - ./data/explorer/config:/app-root/config:ro
      # InfluxDB Explorer's TLS certificates (expects cert.pem and key.pem)
      - ./certs/explorer:/etc/nginx/ssl:ro
      - ./certs/explorer/ca.crt:/usr/local/share/ca-certificates/ca.crt:ro
    depends_on:
      - influxdb
    networks:
      sfc:
        ipv4_address: ${EXPLORER_IP}

volumes:
  grafana-storage:

networks:
  sfc:
    ipam:
      config:
        - subnet: ${SFC_SUBNET}