docker-compose.yml

# Helios — canonical local topology.
# Single source of truth. Variants expressed as Compose profiles (core, observability, load, chaos).
# Default `docker compose up` enables core + observability via .env.
#
# Boot order is enforced by depends_on + condition: service_healthy / service_completed_successfully.
# There is no wait-for-it.sh anywhere; if a dependency is unhealthy, dependents do not start.
#
# Reference: design/infra/compose_design.md

name: helios

networks:
  helios-net:
    name: helios-net
    driver: bridge
    ipam:
      config:
        - subnet: 10.42.0.0/24

volumes:
  kafka-data:
  cassandra-data:
  clickhouse-data:
  redis-data:
  minio-data:
  prom-data:
  grafana-data:
  loki-data:

# ---------------------------------------------------------------------------
# Reusable fragments
# ---------------------------------------------------------------------------

x-otel-env: &otel-env
  OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-collector:4317"
  OTEL_EXPORTER_OTLP_PROTOCOL: "grpc"
  OTEL_METRIC_EXPORT_INTERVAL: "15000"
  OTEL_LOGS_EXPORTER: "none"
  OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=local,service.namespace=helios"

# ---------------------------------------------------------------------------
# Services
# ---------------------------------------------------------------------------
services:

  # ----- Kafka (KRaft, single-broker local) -----
  kafka:
    image: confluentinc/cp-kafka:7.6.1
    profiles: ["core"]
    container_name: helios-kafka
    hostname: kafka
    networks: [helios-net]
    ports:
      - "19092:19092"
    environment:
      CLUSTER_ID: "MkU3OEVBNTcwNTJENDM2Qk"
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: "broker,controller"
      KAFKA_CONTROLLER_QUORUM_VOTERS: "1@kafka:9093"
      KAFKA_LISTENERS: "INTERNAL://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093,EXTERNAL://0.0.0.0:19092"
      KAFKA_ADVERTISED_LISTENERS: "INTERNAL://kafka:9092,EXTERNAL://localhost:19092"
      KAFKA_INTER_BROKER_LISTENER_NAME: "INTERNAL"
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: "INTERNAL:PLAINTEXT,CONTROLLER:PLAINTEXT,EXTERNAL:PLAINTEXT"
      KAFKA_CONTROLLER_LISTENER_NAMES: "CONTROLLER"
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "false"
      KAFKA_LOG_RETENTION_HOURS: 168
      KAFKA_DEFAULT_REPLICATION_FACTOR: 1
      KAFKA_MIN_INSYNC_REPLICAS: 1
      KAFKA_NUM_PARTITIONS: 12
      KAFKA_JMX_PORT: 9101
      KAFKA_LOG_DIRS: "/var/lib/kafka/data"
    volumes:
      - kafka-data:/var/lib/kafka/data
    healthcheck:
      test: ["CMD-SHELL", "kafka-topics --bootstrap-server localhost:9092 --list >/dev/null 2>&1"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 25s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 2g

  # ----- Schema Registry -----
  schema-registry:
    image: confluentinc/cp-schema-registry:7.6.1
    profiles: ["core"]
    container_name: helios-schema-registry
    hostname: schema-registry
    networks: [helios-net]
    depends_on:
      kafka:
        condition: service_healthy
    ports:
      - "8085:8085"
    environment:
      SCHEMA_REGISTRY_HOST_NAME: schema-registry
      SCHEMA_REGISTRY_LISTENERS: "http://0.0.0.0:8085"
      SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS: "PLAINTEXT://kafka:9092"
      SCHEMA_REGISTRY_KAFKASTORE_TOPIC: "_schemas"
      SCHEMA_REGISTRY_SCHEMA_COMPATIBILITY_LEVEL: "backward"
      SCHEMA_REGISTRY_MASTER_ELIGIBILITY: "true"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8085/subjects >/dev/null"]
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 15s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512m

  # ----- Cassandra -----
  cassandra:
    image: cassandra:4.1
    profiles: ["core"]
    container_name: helios-cassandra
    hostname: cassandra
    networks: [helios-net]
    ports:
      - "9042:9042"
    environment:
      CASSANDRA_CLUSTER_NAME: "helios"
      CASSANDRA_DC: "dc1"
      CASSANDRA_RACK: "rack1"
      CASSANDRA_ENDPOINT_SNITCH: "GossipingPropertyFileSnitch"
      HEAP_NEWSIZE: "256M"
      MAX_HEAP_SIZE: "1G"
      JVM_EXTRA_OPTS: "-Dcassandra.skip_wait_for_gossip_to_settle=0"
    volumes:
      - cassandra-data:/var/lib/cassandra
    healthcheck:
      test: ["CMD-SHELL", "cqlsh -e 'describe keyspaces' >/dev/null 2>&1"]
      interval: 10s
      timeout: 10s
      retries: 30
      start_period: 60s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 2g

  # ----- ClickHouse -----
  clickhouse:
    image: clickhouse/clickhouse-server:24.3
    profiles: ["core"]
    container_name: helios-clickhouse
    hostname: clickhouse
    networks: [helios-net]
    ports:
      - "8123:8123"
      - "9000:9000"
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    environment:
      CLICKHOUSE_DB: "helios"
      CLICKHOUSE_USER: "helios"
      CLICKHOUSE_PASSWORD: "helios"
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
    volumes:
      - clickhouse-data:/var/lib/clickhouse
    healthcheck:
      test: ["CMD-SHELL", "clickhouse-client --user helios --password helios --query 'SELECT 1' >/dev/null 2>&1"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 20s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 2g

  # ----- Redis -----
  redis:
    image: redis:7.4-alpine
    profiles: ["core"]
    container_name: helios-redis
    hostname: redis
    networks: [helios-net]
    ports:
      - "6379:6379"
    command: ["redis-server", "--appendonly", "yes", "--appendfsync", "everysec", "--maxmemory", "200mb", "--maxmemory-policy", "allkeys-lru"]
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 3s
      timeout: 2s
      retries: 20
      start_period: 5s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256m

  # ----- MinIO (S3-compatible, used by Flink for checkpoints) -----
  minio:
    image: minio/minio:RELEASE.2024-09-22T00-33-43Z
    profiles: ["core"]
    container_name: helios-minio
    hostname: minio
    networks: [helios-net]
    ports:
      - "9100:9000"   # S3 API host-side (9000 is taken by ClickHouse native)
      - "9101:9001"   # Console
    environment:
      MINIO_ROOT_USER: helios
      MINIO_ROOT_PASSWORD: heliosheliios
    command: ["server", "/data", "--console-address", ":9001"]
    volumes:
      - minio-data:/data
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:9000/minio/health/ready >/dev/null"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512m

  # ----- MinIO bucket init (oneshot) -----
  minio-init:
    image: minio/mc:RELEASE.2024-09-16T17-43-14Z
    profiles: ["core"]
    container_name: helios-minio-init
    networks: [helios-net]
    depends_on:
      minio:
        condition: service_healthy
    restart: "no"
    entrypoint: >
      /bin/sh -c "
      until mc alias set local http://minio:9000 helios heliosheliios; do sleep 1; done;
      mc mb --ignore-existing local/helios-checkpoints;
      mc mb --ignore-existing local/helios-savepoints;
      echo 'minio buckets ready';
      "

  # ----- Bootstrap (one-shot init for topics + DDL + schemas) -----
  bootstrap:
    image: helios/bootstrap:dev
    profiles: ["core"]
    container_name: helios-bootstrap
    networks: [helios-net]
    restart: "no"
    depends_on:
      kafka:
        condition: service_healthy
      schema-registry:
        condition: service_healthy
      cassandra:
        condition: service_healthy
      clickhouse:
        condition: service_healthy
    environment:
      KAFKA_BOOTSTRAP: "kafka:9092"
      SCHEMA_REGISTRY: "http://schema-registry:8085"
      CASSANDRA_HOST: "cassandra"
      CLICKHOUSE_URL: "http://clickhouse:8123"
      CLICKHOUSE_USER: "helios"
      CLICKHOUSE_PASSWORD: "helios"
      CLICKHOUSE_DB: "helios"
    volumes:
      - ./schemas/cassandra:/init/cql:ro
      - ./schemas/clickhouse:/init/clickhouse:ro
      - ./schemas/schema-registry/subjects:/init/schemas:ro

  # ----- Flink JobManager -----
  flink-jobmanager:
    image: flink:1.19-java17
    profiles: ["core"]
    container_name: helios-flink-jm
    hostname: flink-jobmanager
    networks: [helios-net]
    ports:
      - "8082:8081"   # Flink UI on host :8082 (conflicts with ingestion :8081 otherwise)
    command: jobmanager
    depends_on:
      kafka:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully
    environment:
      <<: *otel-env
      OTEL_SERVICE_NAME: flink-jobmanager
      ENABLE_BUILT_IN_PLUGINS: "flink-s3-fs-hadoop-1.19.3.jar"
      FLINK_PROPERTIES: |
        jobmanager.rpc.address: flink-jobmanager
        jobmanager.memory.process.size: 768m
        state.backend: rocksdb
        state.backend.incremental: true
        state.checkpoints.dir: s3://helios-checkpoints/checkpoints
        state.savepoints.dir: s3://helios-savepoints/savepoints
        s3.endpoint: http://minio:9000
        s3.access-key: helios
        s3.secret-key: heliosheliios
        s3.path.style.access: true
        execution.checkpointing.interval: 30s
        execution.checkpointing.mode: EXACTLY_ONCE
        execution.checkpointing.min-pause: 5s
        execution.checkpointing.timeout: 600s
        rest.flamegraph.enabled: true
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8081/overview >/dev/null"]
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 15s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1g

  # ----- Flink job submitter (oneshot) -----
  flink-job-submitter:
    image: helios/flink-submitter:${HELIOS_VERSION:-dev}
    profiles: ["core"]
    container_name: helios-flink-submitter
    networks: [helios-net]
    restart: "no"
    build:
      context: .
      dockerfile: infra/docker/flink-submitter/Dockerfile
    depends_on:
      flink-jobmanager:
        condition: service_healthy
      flink-taskmanager:
        condition: service_healthy
      bootstrap:
        condition: service_completed_successfully
    environment:
      FLINK_REST_URL: "http://flink-jobmanager:8081"
      JOB_NAME: "helios-enrichment"
      JAR_PATH: "/jobs/enrichment-job.jar"

  # ----- Flink TaskManager -----
  flink-taskmanager:
    image: flink:1.19-java17
    profiles: ["core"]
    container_name: helios-flink-tm
    hostname: flink-taskmanager
    networks: [helios-net]
    command: taskmanager
    depends_on:
      flink-jobmanager:
        condition: service_healthy
    environment:
      <<: *otel-env
      OTEL_SERVICE_NAME: flink-taskmanager
      ENABLE_BUILT_IN_PLUGINS: "flink-s3-fs-hadoop-1.19.3.jar"
      FLINK_PROPERTIES: |
        jobmanager.rpc.address: flink-jobmanager
        taskmanager.numberOfTaskSlots: 8
        taskmanager.memory.process.size: 1280m
        state.backend: rocksdb
        state.checkpoints.dir: s3://helios-checkpoints/checkpoints
        s3.endpoint: http://minio:9000
        s3.access-key: helios
        s3.secret-key: heliosheliios
        s3.path.style.access: true
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://flink-jobmanager:8081/taskmanagers >/dev/null"]
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 15s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 1500m

  # ----- gateway-service -----
  gateway-service:
    image: helios/gateway-service:${HELIOS_VERSION:-dev}
    profiles: ["core"]
    container_name: helios-gateway
    hostname: gateway-service
    networks: [helios-net]
    build:
      context: .
      dockerfile: infra/docker/per-service/Dockerfile.gateway
    depends_on:
      ingestion-service:
        condition: service_healthy
      redis:
        condition: service_healthy
    ports:
      - "8080:8080"
    environment:
      <<: *otel-env
      OTEL_SERVICE_NAME: gateway-service
      SPRING_PROFILES_ACTIVE: compose
      HELIOS_ENV: local
      INGESTION_GRPC_TARGET: "dns:///ingestion-service:9090"
      INGESTION_DEADLINE_MS: "2000"
      REDIS_URL: "redis://redis:6379"
      JWT_ISSUER: "${JWT_ISSUER:-helios-local}"
      JWT_HS256_SECRET: "${JWT_HS256_SECRET:-helios-local-dev-secret-change-me-32-bytes-minimum}"
      JWT_JWKS_URL: "${JWT_JWKS_URL:-}"
      RATELIMIT_FAIL_OPEN: "${RATELIMIT_FAIL_OPEN:-true}"
      RATELIMIT_DEFAULT_RPS: "${RATELIMIT_DEFAULT_RPS:-1000}"
      RATELIMIT_DEFAULT_BURST: "${RATELIMIT_DEFAULT_BURST:-2000}"
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 768m

  # ----- ingestion-service -----
  ingestion-service:
    image: helios/ingestion-service:${HELIOS_VERSION:-dev}
    profiles: ["core"]
    container_name: helios-ingestion
    hostname: ingestion-service
    networks: [helios-net]
    build:
      context: .
      dockerfile: infra/docker/per-service/Dockerfile.ingestion
    depends_on:
      kafka:
        condition: service_healthy
      schema-registry:
        condition: service_healthy
      redis:
        condition: service_healthy
      bootstrap:
        condition: service_completed_successfully
    ports:
      - "8081:8081"
      - "9190:9090"
    environment:
      <<: *otel-env
      OTEL_SERVICE_NAME: ingestion-service
      SPRING_PROFILES_ACTIVE: compose
      HELIOS_ENV: local
      KAFKA_BOOTSTRAP_SERVERS: "kafka:9092"
      SCHEMA_REGISTRY_URL: "http://schema-registry:8085"
      SCHEMA_CACHE_TTL_SEC: "${SCHEMA_CACHE_TTL_SEC:-600}"
      REDIS_URL: "redis://redis:6379"
      IDEMPOTENCY_TTL_SEC: "${IDEMPOTENCY_TTL_SEC:-86400}"
      IDEMPOTENCY_FAIL_OPEN: "${IDEMPOTENCY_FAIL_OPEN:-false}"
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 768m

  # ----- storage-service -----
  storage-service:
    image: helios/storage-service:${HELIOS_VERSION:-dev}
    profiles: ["core"]
    container_name: helios-storage
    hostname: storage-service
    networks: [helios-net]
    build:
      context: .
      dockerfile: infra/docker/per-service/Dockerfile.storage
    depends_on:
      kafka:
        condition: service_healthy
      cassandra:
        condition: service_healthy
      bootstrap:
        condition: service_completed_successfully
    ports:
      - "8084:8084"
    environment:
      <<: *otel-env
      OTEL_SERVICE_NAME: storage-service
      SPRING_PROFILES_ACTIVE: compose
      HELIOS_ENV: local
      KAFKA_BOOTSTRAP_SERVERS: "kafka:9092"
      CASSANDRA_CONTACT_POINTS: "cassandra:9042"
      CASSANDRA_LOCAL_DC: "dc1"
      CASSANDRA_KEYSPACE: "helios"
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 768m

  # ----- analytics-service -----
  analytics-service:
    image: helios/analytics-service:${HELIOS_VERSION:-dev}
    profiles: ["core"]
    container_name: helios-analytics
    hostname: analytics-service
    networks: [helios-net]
    build:
      context: .
      dockerfile: infra/docker/per-service/Dockerfile.analytics
    depends_on:
      kafka:
        condition: service_healthy
      clickhouse:
        condition: service_healthy
      redis:
        condition: service_healthy
      bootstrap:
        condition: service_completed_successfully
    ports:
      - "8083:8083"
    environment:
      <<: *otel-env
      OTEL_SERVICE_NAME: analytics-service
      SPRING_PROFILES_ACTIVE: compose
      HELIOS_ENV: local
      KAFKA_BOOTSTRAP_SERVERS: "kafka:9092"
      CLICKHOUSE_URL: "http://clickhouse:8123"
      CLICKHOUSE_USER: "helios"
      CLICKHOUSE_PASSWORD: "helios"
      CLICKHOUSE_DB: "helios"
      REDIS_URL: "redis://redis:6379"
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 768m

  # ----- notification-service -----
  notification-service:
    image: helios/notification-service:${HELIOS_VERSION:-dev}
    profiles: ["core"]
    container_name: helios-notification
    hostname: notification-service
    networks: [helios-net]
    build:
      context: .
      dockerfile: infra/docker/per-service/Dockerfile.notification
    depends_on:
      kafka:
        condition: service_healthy
      redis:
        condition: service_healthy
      bootstrap:
        condition: service_completed_successfully
    ports:
      - "8086:8086"
    environment:
      <<: *otel-env
      OTEL_SERVICE_NAME: notification-service
      SPRING_PROFILES_ACTIVE: compose
      HELIOS_ENV: local
      KAFKA_BOOTSTRAP_SERVERS: "kafka:9092"
      REDIS_URL: "redis://redis:6379"
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512m

  # =========================================================================
  # Observability stack (profile: observability — enabled by default via .env)
  # =========================================================================

  # ----- OpenTelemetry Collector -----
  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.108.0
    profiles: ["observability"]
    container_name: helios-otel-collector
    hostname: otel-collector
    networks: [helios-net]
    command: ["--config=/etc/otel-collector/config.yml"]
    volumes:
      - ./infra/otel-collector/otel-collector-config.yml:/etc/otel-collector/config.yml:ro
    ports:
      - "4317:4317"   # OTLP gRPC
      - "4318:4318"   # OTLP HTTP
      - "8888:8888"   # Collector internal metrics
      - "8889:8889"   # Prometheus exporter (scraped by prometheus)
    healthcheck:
      test: ["CMD", "/otelcol-contrib", "--help"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 384m

  # ----- Prometheus -----
  prometheus:
    image: prom/prometheus:v2.54.1
    profiles: ["observability"]
    container_name: helios-prometheus
    hostname: prometheus
    networks: [helios-net]
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=72h"
      - "--web.enable-lifecycle"
      - "--web.console.libraries=/etc/prometheus/console_libraries"
      - "--web.console.templates=/etc/prometheus/consoles"
    volumes:
      - ./infra/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./infra/prometheus/rules:/etc/prometheus/rules:ro
      - prom-data:/prometheus
    ports:
      - "9090:9090"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O- http://localhost:9090/-/ready >/dev/null || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512m

  # ----- Loki -----
  loki:
    image: grafana/loki:3.2.0
    profiles: ["observability"]
    container_name: helios-loki
    hostname: loki
    networks: [helios-net]
    command: ["-config.file=/etc/loki/loki-config.yml"]
    volumes:
      - ./infra/loki/loki-config.yml:/etc/loki/loki-config.yml:ro
      - loki-data:/loki
    ports:
      - "3100:3100"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O- http://localhost:3100/ready >/dev/null || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512m

  # ----- Promtail -----
  promtail:
    image: grafana/promtail:3.2.0
    profiles: ["observability"]
    container_name: helios-promtail
    hostname: promtail
    networks: [helios-net]
    depends_on:
      loki:
        condition: service_healthy
    command: ["-config.file=/etc/promtail/promtail-config.yml"]
    volumes:
      - ./infra/promtail/promtail-config.yml:/etc/promtail/promtail-config.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 256m

  # ----- Jaeger -----
  jaeger:
    image: jaegertracing/all-in-one:1.60
    profiles: ["observability"]
    container_name: helios-jaeger
    hostname: jaeger
    networks: [helios-net]
    environment:
      COLLECTOR_OTLP_ENABLED: "true"
      QUERY_BASE_PATH: "/"
    ports:
      - "16686:16686"   # UI
      - "14250:14250"   # gRPC collector
      - "14269:14269"   # health
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O- http://localhost:14269/ >/dev/null || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512m

  # ----- Grafana -----
  grafana:
    image: grafana/grafana:11.2.0
    profiles: ["observability"]
    container_name: helios-grafana
    hostname: grafana
    networks: [helios-net]
    depends_on:
      prometheus:
        condition: service_healthy
      loki:
        condition: service_healthy
      jaeger:
        condition: service_healthy
    environment:
      GF_SECURITY_ADMIN_USER: "${GRAFANA_ADMIN_USER:-admin}"
      GF_SECURITY_ADMIN_PASSWORD: "${GRAFANA_ADMIN_PASSWORD:-helios}"
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: "Viewer"
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_FEATURE_TOGGLES_ENABLE: "traceqlEditor"
    volumes:
      - ./infra/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./infra/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - grafana-data:/var/lib/grafana
    ports:
      - "3000:3000"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:3000/api/health >/dev/null"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 15s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 384m

  # =========================================================================
  # Load (profile: load — opt-in)
  # =========================================================================

  k6:
    image: grafana/k6:0.53.0
    profiles: ["load"]
    container_name: helios-k6
    hostname: k6
    networks: [helios-net]
    depends_on:
      gateway-service:
        condition: service_healthy
    volumes:
      - ./benchmarks/k6:/scripts:ro
    environment:
      <<: *otel-env
      GATEWAY_URL: "http://gateway-service:8080"
      K6_OUT: "experimental-prometheus-rw=http://prometheus:9090/api/v1/write"
    command: ["run", "/scripts/ingest_steady.js"]

  # =========================================================================
  # Chaos (profile: chaos — opt-in)
  # =========================================================================

  toxiproxy:
    image: ghcr.io/shopify/toxiproxy:2.9.0
    profiles: ["chaos"]
    container_name: helios-toxiproxy
    hostname: toxiproxy
    networks: [helios-net]
    ports:
      - "8474:8474"

  pumba:
    image: gaiaadm/pumba:0.11.1
    profiles: ["chaos"]
    container_name: helios-pumba
    networks: [helios-net]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    entrypoint: ["/bin/sh", "-c", "echo 'pumba container ready. invoke chaos experiments via benchmarks/chaos/*.sh'"]