compose.yaml

# Local dev stack: grex, two otelcol agents, an otelcol gateway, and Dex.
# The otelcol images are distroless (no shell), so they cannot carry exec
# healthchecks; deploy/compose/smoke.sh covers them via log assertions.
services:
  gen-certs:
    image: alpine/openssl:3.5.7
    entrypoint: ["/bin/sh", "/gen-certs.sh"]
    volumes:
      - ./deploy/compose/gen-certs.sh:/gen-certs.sh:ro
      - ./deploy/compose/certs:/certs

  grex:
    build:
      context: .
      dockerfile: Dockerfile
    command: ["-config", "/etc/grex/config.yaml"]
    ports:
      - "127.0.0.1:8080:8080"
      - "127.0.0.1:9090:9090"
      - "127.0.0.1:4320:4320"
    volumes:
      - ./deploy/compose/grex.yaml:/etc/grex/config.yaml:ro
      - ./deploy/compose/certs:/certs:ro
    depends_on:
      gen-certs:
        condition: service_completed_successfully
      river-migrate:
        condition: service_completed_successfully
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "wget", "-qO-", "--no-check-certificate", "https://127.0.0.1:9090/healthz"]
      interval: 5s
      timeout: 3s
      retries: 12

  grex-2:
    # Second grex replica, purely to exercise Envoy's least-connections
    # balancing locally (see envoy service below and
    # docs/spec/design.md's Load balancing section). Same image/config as
    # grex; nothing shared between the two beyond the config file and certs,
    # matching 1.0's in-memory-per-process fleet state.
    build:
      context: .
      dockerfile: Dockerfile
    command: ["-config", "/etc/grex/config.yaml"]
    ports:
      - "127.0.0.1:8081:8080"
      - "127.0.0.1:9092:9090"
      - "127.0.0.1:4321:4320"
    volumes:
      - ./deploy/compose/grex.yaml:/etc/grex/config.yaml:ro
      - ./deploy/compose/certs:/certs:ro
    depends_on:
      gen-certs:
        condition: service_completed_successfully
      river-migrate:
        condition: service_completed_successfully
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "wget", "-qO-", "--no-check-certificate", "https://127.0.0.1:9090/healthz"]
      interval: 5s
      timeout: 3s
      retries: 12

  grex-browser:
    # Plain-HTTP instance for casual local browsing (see
    # deploy/compose/grex-browser.yaml) — not part of the Envoy/gateway HA
    # topology, no agents connect to it, exists only so the UI/riverui are
    # reachable in a browser without installing an mTLS client cert.
    build:
      context: .
      dockerfile: Dockerfile
    command: ["-config", "/etc/grex/config.yaml"]
    ports:
      - "127.0.0.1:8082:8080"
      - "127.0.0.1:9095:9090"
      - "127.0.0.1:4322:4320"
    volumes:
      - ./deploy/compose/grex-browser.yaml:/etc/grex/config.yaml:ro
      - ./deploy/compose/certs:/certs:ro
    depends_on:
      gen-certs:
        condition: service_completed_successfully
      river-migrate:
        condition: service_completed_successfully
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "wget", "-qO-", "--no-check-certificate", "https://127.0.0.1:9090/healthz"]
      interval: 5s
      timeout: 3s
      retries: 12

  envoy:
    # Inner load-balancing tier: least-connections across grex/grex-2.
    # opamp-gateway dials this instead of a single grex instance directly.
    # --concurrency 1: Envoy's per-worker-thread connection accounting means
    # near-simultaneous connections handled by different threads can each
    # see "0 active" and pick the same host, coincidence, not a bug in the
    # LB policy. Single-threaded is fine at this connection volume; a real
    # multi-connection-per-second deployment would want more threads and
    # would not see this race at any meaningful frequency (see
    # docs/admin/high-availability.md).
    image: envoyproxy/envoy:v1.33.0
    command: ["-c", "/etc/envoy/envoy.yaml", "--concurrency", "1"]
    volumes:
      - ./deploy/compose/envoy.yaml:/etc/envoy/envoy.yaml:ro
      - ./deploy/compose/envoy-healthcheck.sh:/envoy-healthcheck.sh:ro
    ports:
      - "127.0.0.1:9901:9901"
    depends_on:
      grex:
        condition: service_healthy
      grex-2:
        condition: service_healthy
    healthcheck:
      # Not just "is the admin port up" — see envoy-healthcheck.sh: waits
      # for both grex backends to be discovered and health-checked, so
      # opamp-gateway (which depends on envoy being healthy) never opens
      # its upstream connections while Envoy still only knows about one.
      test: ["CMD", "bash", "/envoy-healthcheck.sh"]
      interval: 2s
      timeout: 3s
      retries: 12

  prometheus:
    image: prom/prometheus:v3.13.1
    ports:
      - "127.0.0.1:9091:9090"
    volumes:
      - ./deploy/compose/prometheus.yaml:/etc/prometheus/prometheus.yml:ro
      - ./deploy/compose/certs:/certs:ro
    depends_on:
      grex:
        condition: service_healthy
      grex-2:
        condition: service_healthy
      envoy:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9090/-/healthy"]
      interval: 5s
      timeout: 3s
      retries: 12

  postgres:
    # Dev-only infra for the durable state and future job dispatch backend
    # (see internal/persistence, docs/spec/design.md's Post-1.0 roadmap).
    # Both grex and grex-2 read/write this via deploy/compose/grex.yaml's
    # database: block — persistence, the read API's cross-replica DB
    # fallback, and the soft-delete purge job are all active in this stack.
    image: postgres:17.2-alpine
    environment:
      POSTGRES_USER: grex
      POSTGRES_PASSWORD: grex-dev-password
      POSTGRES_DB: grex
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U grex -d grex"]
      interval: 5s
      timeout: 3s
      retries: 12

  postgres-exporter:
    image: quay.io/prometheuscommunity/postgres-exporter:v0.17.1
    environment:
      DATA_SOURCE_NAME: "postgresql://grex:grex-dev-password@postgres:5432/grex?sslmode=disable"
    ports:
      - "127.0.0.1:9187:9187"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9187/metrics"]
      interval: 5s
      timeout: 3s
      retries: 12

  river-migrate:
    # One-shot: runs River's own migrator (see cmd/river-migrate) to create
    # River's tables (river_job, river_leader, etc) in the dev database.
    # Independent of the migrate service below, which owns grex's own
    # tables; see docs/spec/design.md's migration-tooling decision.
    build:
      context: .
      dockerfile: Dockerfile
      target: river-migrate
    environment:
      DATABASE_URL: "postgres://grex:grex-dev-password@postgres:5432/grex?sslmode=disable"
    depends_on:
      postgres:
        condition: service_healthy

  migrate:
    # One-shot: runs golang-migrate against grex's own tables
    # (internal/persistence/migrations): agent state, role_mapping,
    # agent_connections, jobs/job_targets. Nothing reads/writes the latter
    # three yet — schema only, see docs/spec/design.md.
    image: migrate/migrate:v4.19.1
    volumes:
      - ./internal/persistence/migrations:/migrations:ro
    command:
      - -path=/migrations
      - -database=postgres://grex:grex-dev-password@postgres:5432/grex?sslmode=disable
      - up
    depends_on:
      postgres:
        condition: service_healthy

  dex:
    image: dexidp/dex:v2.45.1
    command: ["dex", "serve", "/etc/dex/config.yaml"]
    ports:
      - "127.0.0.1:5556:5556"
    volumes:
      - ./deploy/compose/dex.yaml:/etc/dex/config.yaml:ro
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:5556/dex/healthz"]
      interval: 5s
      timeout: 3s
      retries: 12

  opamp-gateway:
    # Built from source against a grex fork branch: opampgateway v1.10.0
    # never wires its upstream TLS settings into the websocket dialer, so
    # the stock observIQ image cannot do mTLS to grex. See
    # deploy/compose/opamp-gateway-build/manifest.yaml.
    build: deploy/compose/opamp-gateway-build
    command: ["--config", "/etc/otelcol/config.yaml"]
    volumes:
      - ./deploy/compose/opamp-gateway.yaml:/etc/otelcol/config.yaml:ro
      - ./deploy/compose/certs:/certs:ro
    depends_on:
      envoy:
        condition: service_healthy

  otelcol-agent-1:
    image: otel/opentelemetry-collector-contrib:0.157.0
    command: ["--config", "/etc/otelcol/config.yaml"]
    environment:
      AGENT_NAME: agent-1
    volumes:
      - ./deploy/compose/otelcol-agent.yaml:/etc/otelcol/config.yaml:ro
      - ./deploy/compose/certs:/certs:ro
    depends_on:
      - opamp-gateway

  otelcol-agent-2:
    # OpAMP Supervisor-managed, unlike agent-1's bare opamp extension: the
    # two intentionally exercise both client-side models grex supports. See
    # docs/spec/design.md's Local development section.
    build: deploy/compose/opamp-supervisor-build
    volumes:
      - ./deploy/compose/supervisor.yaml:/etc/otelcol/supervisor.yaml:ro
      - ./deploy/compose/otelcol-agent-2.yaml:/etc/otelcol/agent-2.yaml:ro
      - ./deploy/compose/certs:/certs:ro
      - opamp-supervisor-data:/var/lib/otelcol/supervisor-data
    depends_on:
      - opamp-gateway

  otelcol-gateway:
    image: otel/opentelemetry-collector-contrib:0.157.0
    command: ["--config", "/etc/otelcol/config.yaml"]
    volumes:
      - ./deploy/compose/otelcol-gateway.yaml:/etc/otelcol/config.yaml:ro
      - ./deploy/compose/certs:/certs:ro
    depends_on:
      - opamp-gateway

volumes:
  postgres-data:
  opamp-supervisor-data: