docker-compose.yml

# ═══════════════════════════════════════════════════════════════════════════
#  🐳  DEV STACK — Python · JavaScript · Dart/Flutter
#  Reverse proxy : Traefik  →  accès par domaine *.local
#
#  Profils disponibles :
#    - db        : MySQL, PostgreSQL, MongoDB, Redis
#    - db_tools  : phpMyAdmin, pgAdmin, Mongo Express, Adminer
#    - devtools  : Portainer (Traefik démarre toujours par défaut)
#    - messaging : Mailpit, RabbitMQ, Soketi
#    - storage   : MinIO
#    - automation: n8n
#    - data      : JupyterLab
#
#  Démarrez toute la stack : docker compose up -d
#  Ou par profil : docker compose --profile db --profile db_tools up -d
#  Ou configurez COMPOSE_PROFILES dans votre fichier .env
# ═══════════════════════════════════════════════════════════════════════════

name: devstack

networks:
  devnet:
    driver: bridge

volumes:
  mysql_data:
  postgres_data:
  redis_data:
  mongo_data:
  minio_data:
  portainer_data:
  pgadmin_data:
  rabbitmq_data:
  n8n_data:
  jupyter_data:
  meilisearch_data:
  sonarqube_data:
  sonarqube_extensions:
  sonarqube_logs:
  neo4j_data:
  neo4j_logs:
  neo4j_import:
  neo4j_plugins:
  syncthing_config:

services:

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  REVERSE PROXY — Traefik (Toujours actif)                                ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  traefik:
    image: traefik:v3.7.1
    container_name: traefik
    command:
      - --api.dashboard=true
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=devstack_devnet
      - --entrypoints.web.address=:80
      - --log.level=WARN
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik-ui.rule=Host(`traefik.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.routers.traefik-ui.service=api@internal"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  BASES DE DONNÉES (Profil: db)                                           ║
# ╚══════════════════════════════════════════════════════════════════════════╝

  mysql:
    image: mysql:8.0
    container_name: mysql-server
    profiles: ["db"]
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-${GLOBAL_PASSWORD}}
      MYSQL_DATABASE: ${MYSQL_DATABASE:-${GLOBAL_DB_NAME:-devdb}}
      MYSQL_USER: ${MYSQL_USER:-${GLOBAL_USER:-devuser}}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-${GLOBAL_PASSWORD}}
    ports:
      - "3306:3306"
    volumes:
      - mysql_data:/var/lib/mysql
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
      - --default-authentication-plugin=mysql_native_password
    networks:
      - devnet
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p$$MYSQL_ROOT_PASSWORD"]
      interval: 10s
      timeout: 5s
      retries: 5

  postgres:
    image: ${POSTGRES_IMAGE:-postgres:17}
    container_name: postgres-server
    profiles: ["db"]
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-${GLOBAL_PASSWORD}}
      POSTGRES_USER: ${POSTGRES_USER:-${GLOBAL_USER:-devuser}}
      POSTGRES_DB: ${POSTGRES_DB:-${GLOBAL_DB_NAME:-devdb}}
      PGDATA: /var/lib/postgresql/data/pgdata
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./internal/postgres:/docker-entrypoint-initdb.d:ro
    networks:
      - devnet
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-${GLOBAL_USER:-devuser}} -d ${POSTGRES_DB:-${GLOBAL_DB_NAME:-devdb}}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis/redis-stack:7.4.0-v8
    container_name: redis-stack
    profiles: ["db"]
    environment:
      REDIS_ARGS: "--requirepass ${REDIS_PASSWORD:-${GLOBAL_PASSWORD}} --loglevel warning"
    ports:
      - "6379:6379"
      - "8001:8001"
    volumes:
      - redis_data:/data
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.redisinsight.rule=Host(`redis.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.redisinsight.loadbalancer.server.port=8001"
    restart: unless-stopped

    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-${GLOBAL_PASSWORD}}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s

  mongo:
    image: mongo:7
    container_name: mongo-server
    profiles: ["db"]
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_INITDB_ROOT_USERNAME:-${GLOBAL_USER:-devuser}}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD:-${GLOBAL_PASSWORD}}
      MONGO_INITDB_DATABASE: ${MONGO_INITDB_DATABASE:-${GLOBAL_DB_NAME:-devdb}}
    ports:
      - "27017:27017"
    volumes:
      - mongo_data:/data/db
    networks:
      - devnet
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "mongosh", "-u", "${MONGO_INITDB_ROOT_USERNAME:-${GLOBAL_USER:-devuser}}", "-p", "${MONGO_INITDB_ROOT_PASSWORD:-${GLOBAL_PASSWORD}}", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 5s
      retries: 5

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  ADMINISTRATION DES BDD (Profil: db_tools)                               ║
# ╚══════════════════════════════════════════════════════════════════════════╝

  # ⚠ DÉPENDANCE : nécessite le profil 'db' actif (postgres/mysql)
  # Lancer avec : docker compose --profile db --profile db_tools up -d
  phpmyadmin:
    image: phpmyadmin@sha256:85a2b4eb2da6ca24d8966b211f83906bf9c3cc57f53f1d4f729b4b85395d389d
    container_name: phpmyadmin
    profiles: ["db_tools"]
    environment:
      PMA_HOST: mysql
      PMA_PORT: 3306
      PMA_USER: ${PMA_USER:-root}
      PMA_PASSWORD: ${PMA_PASSWORD:-${GLOBAL_PASSWORD}}
      UPLOAD_LIMIT: 256M
      MEMORY_LIMIT: 512M
      MAX_EXECUTION_TIME: 300
    networks:
      - devnet
    depends_on:
      mysql:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.phpmyadmin.rule=Host(`phpmyadmin.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.phpmyadmin.loadbalancer.server.port=80"
    restart: unless-stopped

  # ⚠ DÉPENDANCE : nécessite le profil 'db' actif (postgres/mysql)
  # Lancer avec : docker compose --profile db --profile db_tools up -d
  pgadmin:
    image: dpage/pgadmin4@sha256:cefc4cc6b7d9d71a9e81e76fb9d7e14038ab5661b539a190eea1b63fa612589a
    container_name: pgadmin
    profiles: ["db_tools"]
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL:-dev@${DOMAIN_SUFFIX:-local}.dev}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD:-${GLOBAL_PASSWORD}}
      PGADMIN_CONFIG_SERVER_MODE: "False"
      PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: "False"
    volumes:
      - pgadmin_data:/var/lib/pgadmin
    networks:
      - devnet
    depends_on:
      postgres:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pgadmin.rule=Host(`pgadmin.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.pgadmin.loadbalancer.server.port=80"
    restart: unless-stopped

  # ⚠ Image dépréciée — envisager une alternative comme mongo-gui ou mongoku
  mongo-express:
    image: mongo-express:1.0.2
    container_name: mongo-express
    profiles: ["db_tools"]
    environment:
      ME_CONFIG_MONGODB_ADMINUSERNAME: ${MONGO_INITDB_ROOT_USERNAME:-${GLOBAL_USER:-devuser}}
      ME_CONFIG_MONGODB_ADMINPASSWORD: ${MONGO_INITDB_ROOT_PASSWORD:-${GLOBAL_PASSWORD}}
      ME_CONFIG_BASICAUTH_USERNAME: ${ME_CONFIG_BASICAUTH_USERNAME:-${GLOBAL_USER:-admin}}
      ME_CONFIG_BASICAUTH_PASSWORD: ${ME_CONFIG_BASICAUTH_PASSWORD:-${GLOBAL_PASSWORD}}
      ME_CONFIG_OPTIONS_EDITORTHEME: "dracula"
    command: >
      sh -c '
      ENC_PASS=$$(node -e "console.log(encodeURIComponent(process.env.ME_CONFIG_MONGODB_ADMINPASSWORD))");
      export ME_CONFIG_MONGODB_URL="mongodb://$${ME_CONFIG_MONGODB_ADMINUSERNAME}:$${ENC_PASS}@mongo:27017/?authSource=admin";
      exec /docker-entrypoint.sh mongo-express
      '
    networks:
      - devnet
    depends_on:
      mongo:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mongo-express.rule=Host(`mongo.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.mongo-express.loadbalancer.server.port=8081"
    restart: unless-stopped

  adminer:
    image: adminer@sha256:cc64d253db4f016cbcff2ff2f01e60ed07e74f38b4398f84d3c4fae4b5ce0e07
    container_name: adminer
    profiles: ["db_tools"]
    environment:
      ADMINER_DEFAULT_SERVER: mysql
      ADMINER_DESIGN: "dracula"
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.adminer.rule=Host(`adminer.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.adminer.loadbalancer.server.port=8080"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  MESSAGERIE & EVENTS (Profil: messaging)                                 ║
# ╚══════════════════════════════════════════════════════════════════════════╝

  mailpit:
    image: axllent/mailpit@sha256:0059ef81e492a7192af3816281eed6859eb078bd7bdc58b76757c13e10e53a7d
    container_name: mailpit
    profiles: ["messaging"]
    ports:
      - "1025:1025"
    environment:
      MP_SMTP_AUTH_ACCEPT_ANY: 1
      MP_SMTP_AUTH_ALLOW_INSECURE: 1
      MP_MAX_MESSAGES: 1000
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mailpit.rule=Host(`mail.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.mailpit.loadbalancer.server.port=8025"
    restart: unless-stopped

  rabbitmq:
    image: rabbitmq:4.1-management-alpine
    container_name: rabbitmq
    profiles: ["messaging"]
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-${GLOBAL_USER:-devuser}}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-${GLOBAL_PASSWORD}}
      RABBITMQ_DEFAULT_VHOST: ${RABBITMQ_DEFAULT_VHOST:-devhost}
    ports:
      - "5672:5672"
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rabbitmq.rule=Host(`rabbitmq.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.rabbitmq.loadbalancer.server.port=15672"
    restart: unless-stopped

  soketi:
    image: quay.io/soketi/soketi@sha256:fe7e68cdec157343b40cdbe604dd3ca2788d3fbf5624d3ab8f085b623d700ece
    container_name: soketi
    profiles: ["messaging"]
    environment:
      SOKETI_DEFAULT_APP_ID: ${SOKETI_DEFAULT_APP_ID:-devapp}
      SOKETI_DEFAULT_APP_KEY: ${SOKETI_DEFAULT_APP_KEY:-devkey}
      SOKETI_DEFAULT_APP_SECRET: ${SOKETI_DEFAULT_APP_SECRET:-${GLOBAL_PASSWORD}}
      SOKETI_DEBUG: "0"
    ports:
      - "6001:6001"
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.soketi.rule=Host(`soketi.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.soketi.loadbalancer.server.port=9601"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  STOCKAGE OBJET (Profil: storage)                                        ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    container_name: minio
    profiles: ["storage"]
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-${GLOBAL_USER:-devuser}}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-${GLOBAL_PASSWORD}}
    ports:
      - "9000:9000"
    volumes:
      - minio_data:/data
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.minio.rule=Host(`minio.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.minio.loadbalancer.server.port=9001"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 15s
      timeout: 5s
      retries: 5

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  GESTION DOCKER (Profil: devtools)                                       ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  portainer:
    image: portainer/portainer-ce@sha256:8d2f5c9fbc5b8490fb3a12efadbad74978e22991911e1db611d8a45871775112
    container_name: portainer
    profiles: ["devtools"]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=Host(`portainer.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  AUTOMATION (Profil: automation)                                         ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  # ⚠ DÉPENDANCE : nécessite le profil 'db' actif (postgres/mysql)
  # Lancer avec : docker compose --profile db --profile automation up -d
  n8n:
    image: n8nio/n8n@sha256:9f1f8e4c093c9924338bd168e3f813f746041d13b337753af0dbdd329e7b50f7
    container_name: n8n
    profiles: ["automation"]
    environment:
      N8N_SECURE_COOKIE: "false"
      N8N_BASIC_AUTH_ACTIVE: "true"
      N8N_BASIC_AUTH_USER: ${N8N_BASIC_AUTH_USER:-admin}
      N8N_BASIC_AUTH_PASSWORD: ${N8N_BASIC_AUTH_PASSWORD:-${GLOBAL_PASSWORD}}
      N8N_HOST: n8n.${DOMAIN_SUFFIX:-local}
      N8N_PROTOCOL: http
      WEBHOOK_URL: http://n8n.${DOMAIN_SUFFIX:-local}/
      GENERIC_TIMEZONE: ${TIMEZONE:-Africa/Porto-Novo}
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_PORT: 5432
      DB_POSTGRESDB_DATABASE: n8n
      DB_POSTGRESDB_USER: ${N8N_DB_POSTGRESDB_USER:-${GLOBAL_USER:-devuser}}
      DB_POSTGRESDB_PASSWORD: ${N8N_DB_POSTGRESDB_PASSWORD:-${GLOBAL_PASSWORD}}
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - devnet
    depends_on:
      postgres:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.n8n.rule=Host(`n8n.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  DATA SCIENCE / PYTHON (Profil: data)                                    ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  jupyter:
    image: quay.io/jupyter/datascience-notebook:2026-05-11
    container_name: jupyter
    profiles: ["data"]
    environment:
      JUPYTER_ENABLE_LAB: "yes"
      JUPYTER_TOKEN: ${JUPYTER_TOKEN:-${GLOBAL_PASSWORD}}
      GRANT_SUDO: "yes"
    volumes:
      - jupyter_data:/home/jovyan/work
      - ./notebooks:/home/jovyan/work/notebooks
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jupyter.rule=Host(`jupyter.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.jupyter.loadbalancer.server.port=8888"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  API TOOLS (Profil: api_tools)                                           ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  # ⚠ DÉPENDANCE : nécessite le profil 'db' actif (postgres/mysql)
  # Lancer avec : docker compose --profile db --profile api_tools up -d
  hoppscotch:
    image: hoppscotch/hoppscotch@sha256:ac8eeda2e9a8347816412e707ae504a5cc02dc5ea83e974b00100516831cfb9a
    container_name: hoppscotch
    profiles: ["api_tools"]
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-${GLOBAL_USER:-devuser}}:${POSTGRES_PASSWORD:-${GLOBAL_PASSWORD}}@postgres:5432/hoppscotch"
      DATA_ENCRYPTION_KEY: ${HOPPSCOTCH_ENCRYPTION_KEY}
      ENABLE_SUBPATH_BASED_ACCESS: "true"
      VITE_BASE_URL: "http://api-tester.${DOMAIN_SUFFIX:-local}"
      VITE_SHORTCODE_BASE_URL: "http://api-tester.${DOMAIN_SUFFIX:-local}"
      VITE_ADMIN_URL: "http://api-tester.${DOMAIN_SUFFIX:-local}/admin"
      VITE_BACKEND_GQL_URL: "http://api-tester.${DOMAIN_SUFFIX:-local}/backend/graphql"
      VITE_BACKEND_WS_URL: "ws://api-tester.${DOMAIN_SUFFIX:-local}/backend/graphql"
      VITE_BACKEND_API_URL: "http://api-tester.${DOMAIN_SUFFIX:-local}/backend/v1"
      WHITELISTED_ORIGINS: "http://localhost:3000,http://api-tester.${DOMAIN_SUFFIX:-local}"
      JWT_SECRET: ${HOPPSCOTCH_JWT_SECRET}
      SESSION_SECRET: ${HOPPSCOTCH_SESSION_SECRET}
      TOKEN_SALT_COMPLEXITY: "10"
      MAGIC_LINK_TOKEN_VALIDITY: "3"
      REFRESH_TOKEN_VALIDITY: "604800000"
      ACCESS_TOKEN_VALIDITY: "86400000"
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.hoppscotch.rule=Host(`api-tester.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.hoppscotch.loadbalancer.server.port=80"
    restart: unless-stopped

  swagger-editor:
    image: swaggerapi/swagger-editor@sha256:d7c26246093f36fea0c851b6b61cf61cbddae4c536147336361ff3b1f6e86a82
    container_name: swagger-editor
    profiles: ["api_tools"]
    environment:
      SWAGGER_FILE: /openapi/openapi.json
    volumes:
      - ./openapi:/openapi
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.swagger-editor.rule=Host(`swagger.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.swagger-editor.loadbalancer.server.port=80"
    restart: unless-stopped

  prism-mock:
    image: stoplight/prism:5
    container_name: prism-mock
    profiles: ["api_tools"]
    command: mock -h 0.0.0.0 -m false /openapi/openapi.json
    volumes:
      - ./openapi:/openapi
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.prism-mock.rule=Host(`mock-api.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.prism-mock.loadbalancer.server.port=4010"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  RECHERCHE (Profil: search)                                              ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  meilisearch:
    image: getmeili/meilisearch:v1.12
    container_name: meilisearch
    profiles: ["search"]
    environment:
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:-${GLOBAL_PASSWORD}}
    volumes:
      - meilisearch_data:/meili_data
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.meilisearch.rule=Host(`search.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.meilisearch.loadbalancer.server.port=7700"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  OBSERVABILITÉ (Profil: observability)                                   ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  dozzle:
    image: amir20/dozzle@sha256:345aa7fc8724d4086e93d1cafdb91d1e19ae6d6a7b1d652814dc30b3b03cbc82
    container_name: dozzle
    profiles: ["observability"]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dozzle.rule=Host(`logs.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.dozzle.loadbalancer.server.port=8080"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  QUALITÉ DE CODE (Profil: code_quality)                                  ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  # ⚠ DÉPENDANCE : nécessite le profil 'db' actif (postgres/mysql)
  # Lancer avec : docker compose --profile db --profile code_quality up -d
  sonarqube:
    image: sonarqube@sha256:35bedac3f40cda75969890da59b17d577770844fe6ef659206c678a8e00921c7
    container_name: sonarqube
    profiles: ["code_quality"]
    environment:
      SONAR_JDBC_URL: jdbc:postgresql://postgres:5432/sonar
      SONAR_JDBC_USERNAME: ${POSTGRES_USER:-${GLOBAL_USER:-devuser}}
      SONAR_JDBC_PASSWORD: ${POSTGRES_PASSWORD:-${GLOBAL_PASSWORD}}
    volumes:
      - sonarqube_data:/opt/sonarqube/data
      - sonarqube_extensions:/opt/sonarqube/extensions
      - sonarqube_logs:/opt/sonarqube/logs
    networks:
      - devnet
    depends_on:
      postgres:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.sonarqube.rule=Host(`sonar.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.sonarqube.loadbalancer.server.port=9000"
    restart: unless-stopped

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  OSINT & CYBERSÉCURITÉ (Profil: osint)                                   ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  # ⚠ DÉPENDANCE : nécessite le profil 'db' actif (postgres/redis)
  # Lancer avec : docker compose --profile db --profile osint up -d
  # ⚠ Attention : Neo4j est très gourmand en mémoire.
  neo4j:
    image: neo4j:5
    container_name: flowsint-neo4j
    profiles: ["osint"]
    restart: unless-stopped
    environment:
      - NEO4J_AUTH=${NEO4J_USERNAME:-neo4j}/${NEO4J_PASSWORD}
      - NEO4J_PLUGINS=["apoc"]
      - NEO4J_apoc_export_file_enabled=true
      - NEO4J_apoc_import_file_enabled=true
      - NEO4J_apoc_import_file_use__neo4j__config=true
    volumes:
      - neo4j_data:/data
      - neo4j_logs:/logs
      - neo4j_import:/var/lib/neo4j/import
      - neo4j_plugins:/plugins
    networks:
      - devnet
    healthcheck:
      test: cypher-shell -u ${NEO4J_USERNAME:-neo4j} -p ${NEO4J_PASSWORD} "RETURN 1"
      interval: 10s
      timeout: 5s
      retries: 10

  flowsint-api:
    image: ghcr.io/reconurge/flowsint-api:${FLOWSINT_VERSION:-latest}
    container_name: flowsint-api
    profiles: ["osint"]
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - DATABASE_URL=postgresql://${POSTGRES_USER:-${GLOBAL_USER:-devuser}}:${POSTGRES_PASSWORD:-${GLOBAL_PASSWORD}}@postgres:5432/flowsint
      - NEO4J_URI_BOLT=bolt://neo4j:7687
      - NEO4J_USERNAME=${NEO4J_USERNAME:-neo4j}
      - NEO4J_PASSWORD=${NEO4J_PASSWORD}
      - AUTH_SECRET=${FLOWSINT_AUTH_SECRET}
      - MASTER_VAULT_KEY_V1=${FLOWSINT_MASTER_VAULT_KEY}
      - REDIS_URL=redis://:${REDIS_PASSWORD:-${GLOBAL_PASSWORD}}@redis:6379/0
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      neo4j:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:5001/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      devnet:
        aliases:
          - api

  flowsint-celery:
    image: ghcr.io/reconurge/flowsint-api:${FLOWSINT_VERSION:-latest}
    container_name: flowsint-celery
    profiles: ["osint"]
    restart: unless-stopped
    command:
      [
        "celery",
        "-A",
        "flowsint_core.core.celery",
        "worker",
        "--loglevel=info",
        "--pool=threads",
        "--concurrency=10",
      ]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - DATABASE_URL=postgresql://${POSTGRES_USER:-${GLOBAL_USER:-devuser}}:${POSTGRES_PASSWORD:-${GLOBAL_PASSWORD}}@postgres:5432/flowsint
      - NEO4J_URI_BOLT=bolt://neo4j:7687
      - NEO4J_USERNAME=${NEO4J_USERNAME:-neo4j}
      - NEO4J_PASSWORD=${NEO4J_PASSWORD}
      - MASTER_VAULT_KEY_V1=${FLOWSINT_MASTER_VAULT_KEY}
      - REDIS_URL=redis://:${REDIS_PASSWORD:-${GLOBAL_PASSWORD}}@redis:6379/0
      - SKIP_MIGRATIONS=true
      - AUTH_SECRET=${FLOWSINT_AUTH_SECRET}
    healthcheck:
      test: ["CMD-SHELL", "celery -A flowsint_core.core.celery inspect ping -d celery@$$HOSTNAME || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      neo4j:
        condition: service_healthy
      flowsint-api:
        condition: service_healthy
    networks:
      - devnet

  flowsint-app:
    image: ghcr.io/reconurge/flowsint-app:${FLOWSINT_VERSION:-latest}
    container_name: flowsint-app
    profiles: ["osint"]
    restart: unless-stopped
    depends_on:
      flowsint-api:
        condition: service_healthy
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.flowsint.rule=Host(`flowsint.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.flowsint.loadbalancer.server.port=8080"

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  SYNCHRONISATION & VAULTS (Profil: sync)                                 ║
# ╚══════════════════════════════════════════════════════════════════════════╝
  syncthing:
    image: lscr.io/linuxserver/syncthing:latest
    container_name: syncthing
    profiles: ["sync"]
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TIMEZONE:-Africa/Porto-Novo}
    volumes:
      - syncthing_config:/config
      - ${SYNCTHING_SYNC_DIR:-~/Documents/Vaults_Clients}:/sync
      - ./internal/syncthing/custom-init.sh:/custom-cont-init.d/custom-init.sh:ro
    ports:
      - "8384:8384"
      - "22000:22000/tcp"
      - "22000:22000/udp"
      - "21027:21027/udp" # Local discovery
    networks:
      - devnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.syncthing.rule=Host(`syncthing.${DOMAIN_SUFFIX:-local}`)"
      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
    restart: unless-stopped