docker-compose.yml

services:
  # Sources Generator - Generates sources.yml files from instances.yaml template
  sources-generator:
    image: alpine:3.22.0
    container_name: sources-generator
    working_dir: /app
    volumes:
      - ./instances.yml:/app/instances.yaml
      - ./config:/app/config
    command: >
      sh -c "
      mkdir -p /app/config/pgwatch-postgres /app/config/pgwatch-prometheus &&
      echo '# PGWatch Sources Configuration - PostgreSQL Instance' > /app/config/pgwatch-postgres/sources.yml &&
      sed 's/~sink_type~/postgresql/g' /app/instances.yaml >> /app/config/pgwatch-postgres/sources.yml &&
      echo '# PGWatch Sources Configuration - Prometheus Instance' > /app/config/pgwatch-prometheus/sources.yml &&
      echo '' >> /app/config/pgwatch-prometheus/sources.yml &&
      sed 's/~sink_type~/prometheus/g' /app/instances.yaml >> /app/config/pgwatch-prometheus/sources.yml &&
      echo 'Generated sources.yml files for both postgres and prometheus'
      "

  # Target Database - The PostgreSQL database being monitored
  target-db:
    image: postgres:15
    container_name: target-db
    environment:
      POSTGRES_DB: target_database
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    command:
      [
        "postgres",
        "-c",
        "shared_preload_libraries=pg_stat_statements",
        "-c",
        "pg_stat_statements.track=all",
      ]
    volumes:
      - target_db_data:/var/lib/postgresql/data
      - ./config/target-db/init.sql:/docker-entrypoint-initdb.d/init.sql

  # Postgres Sink - Storage for metrics in PostgreSQL format
  # Note: pg_hba.conf is configured to allow passwordless connections (trust)
  # for local connections within the Docker network. This simplifies pgwatch
  # and postgres-exporter connectivity without compromising security since
  # the database is not exposed externally.
  sink-postgres:
    image: postgres:15
    container_name: sink-postgres
    environment:
      POSTGRES_DB: postgres
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_HOST_AUTH_METHOD: trust
    volumes:
      - sink_postgres_data:/var/lib/postgresql/data
      - ./config/sink-postgres/00-configure-pg-hba.sh:/docker-entrypoint-initdb.d/00-configure-pg-hba.sh
      - ./config/sink-postgres/init.sql:/docker-entrypoint-initdb.d/init.sql

  # VictoriaMetrics Sink - Storage for metrics in Prometheus format
  sink-prometheus:
    image: victoriametrics/victoria-metrics:v1.105.0
    container_name: sink-prometheus
    ports:
      - "${BIND_HOST:-}59090:9090"
    volumes:
      - victoria_metrics_data:/victoria-metrics-data
      - ./config/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
    command:
      - "-storageDataPath=/victoria-metrics-data"
      - "-retentionPeriod=336h"
      - "-httpListenAddr=:9090"
      - "-promscrape.config=/etc/prometheus/prometheus.yml"
      - "-promscrape.config.strictParse=false"
      - "-promscrape.maxScrapeSize=128000000"

  # PGWatch Instance 1 - Monitoring service (Postgres sink)
  pgwatch-postgres:
    image: cybertecpostgresql/pgwatch:3
    container_name: pgwatch-postgres
    command:
      [
        "--sources=/etc/pgwatch/sources.yml",
        "--metrics=/etc/pgwatch/metrics.yml",
        "--sink=postgresql://pgwatch@sink-postgres:5432/measurements?sslmode=disable",
        "--web-addr=:8080",
      ]
    depends_on:
      - sources-generator
      - sink-postgres
    volumes:
      - ./config/pgwatch-postgres/sources.yml:/etc/pgwatch/sources.yml
      - ./config/pgwatch-postgres/metrics.yml:/etc/pgwatch/metrics.yml
    restart: unless-stopped

  # PGWatch Instance 2 - Monitoring service (Prometheus sink)
  pgwatch-prometheus:
    image: cybertecpostgresql/pgwatch:3
    container_name: pgwatch-prometheus
    command:
      [
        "--sources=/etc/pgwatch/sources.yml",
        "--metrics=/etc/pgwatch/metrics.yml",
        "--sink=prometheus://0.0.0.0:9091/pgwatch",
        "--web-addr=:8089",
      ]
    depends_on:
      - sources-generator
      - sink-prometheus
    volumes:
      - ./config/pgwatch-prometheus/sources.yml:/etc/pgwatch/sources.yml
      - ./config/pgwatch-prometheus/metrics.yml:/etc/pgwatch/metrics.yml
    restart: unless-stopped

  # Grafana with datasources - Visualization layer
  grafana:
    image: grafana/grafana:12.0.2
    container_name: grafana-with-datasources
    environment:
      GF_SECURITY_ADMIN_USER: monitor
      GF_SECURITY_ADMIN_PASSWORD: ${GF_SECURITY_ADMIN_PASSWORD:-demo}
      GF_INSTALL_PLUGINS: yesoreyeram-infinity-datasource
      # OAuth configuration (disabled by default, enabled via Ansible)
      GF_AUTH_GENERIC_OAUTH_ENABLED: ${GRAFANA_OAUTH_ENABLED:-false}
      GF_AUTH_GENERIC_OAUTH_NAME: ${GRAFANA_OAUTH_NAME:-PostgresAI}
      GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: ${GRAFANA_OAUTH_ALLOW_SIGN_UP:-true}
      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ${GRAFANA_OAUTH_CLIENT_ID:-}
      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ${GRAFANA_OAUTH_CLIENT_SECRET:-}
      GF_AUTH_GENERIC_OAUTH_SCOPES: ${GRAFANA_OAUTH_SCOPES:-openid email profile}
      GF_AUTH_GENERIC_OAUTH_AUTH_URL: ${GRAFANA_OAUTH_AUTH_URL:-}
      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: ${GRAFANA_OAUTH_TOKEN_URL:-}
      GF_AUTH_GENERIC_OAUTH_API_URL: ${GRAFANA_OAUTH_API_URL:-}
      # Optional: disable login form when OAuth is primary auth
      GF_AUTH_DISABLE_LOGIN_FORM: ${GRAFANA_DISABLE_LOGIN_FORM:-false}
      GF_SERVER_ROOT_URL: ${GF_SERVER_ROOT_URL:-}
    ports:
      - "${GRAFANA_BIND_HOST:-}3000:3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./config/grafana/provisioning:/etc/grafana/provisioning
      - ./config/grafana/dashboards:/var/lib/grafana/dashboards
      - ./config/grafana/provisioning/grafana.ini:/etc/grafana/grafana.ini
    depends_on:
      - sink-postgres
      - sink-prometheus
    restart: unless-stopped
  monitoring_flask_backend:
    image: postgresai/monitoring_flask_backend:latest
    container_name: flask-pgss-api
    environment:
      - FLASK_ENV=production
      - PROMETHEUS_URL=http://sink-prometheus:9090
    depends_on:
      - sink-prometheus
    restart: unless-stopped
  # PostgreSQL Reports Generator - Runs reports after 1 hour
  postgres-reports:
    image: postgresai/reporter:1.0.2
    container_name: postgres-reports
    working_dir: /app
    volumes:
      - ./reporter/postgres_reports.py:/app/postgres_reports.py
      - ./reporter/requirements.txt:/app/requirements.txt
      - ./.pgwatch-config:/app/.pgwatch-config
      - ./instances.yml:/app/instances.yml
    environment:
      - PROMETHEUS_URL=http://sink-prometheus:9090
    depends_on:
      - sink-prometheus
      - pgwatch-prometheus
    command: >
      sh -c "
      echo 'Installing Python dependencies...' &&
      pip install -r requirements.txt &&
      pip install pyyaml &&
      echo 'Waiting 30 minutes before generating reports...' &&
      sleep 1800 &&
      echo 'Starting PostgreSQL reports generation...' &&
      while true; do
        echo 'Extracting cluster and node name from instances.yml...' &&
        echo 'Generating PostgreSQL reports...' &&
        if [ -f /app/.pgwatch-config ] && grep -q '^api_key=' /app/.pgwatch-config; then
          API_KEY=$$(grep '^api_key=' /app/.pgwatch-config | cut -d'=' -f2-) &&
          python postgres_reports.py --prometheus-url http://sink-prometheus:9090 --output /app/all_reports_$$(date +%Y%m%d_%H%M%S).json --token $$API_KEY --project postgres-ai-monitoring
        else
          echo 'No API key configured, generating reports without upload...' &&
          python postgres_reports.py --prometheus-url http://sink-prometheus:9090 --output /app/all_reports_$$(date +%Y%m%d_%H%M%S).json --no-upload
        fi &&
        echo 'Reports generated. Sleeping for 24 hours...' &&
        sleep 86400
      done
      "

  # Self-monitoring components

  # cAdvisor - Container metrics
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.51.0
    container_name: cadvisor
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    command:
      - "--housekeeping_interval=30s"
      - "--docker_only=true"
      - "--disable_metrics=percpu,sched,tcp,udp,hugetlb,referenced_memory,cpu_topology,resctrl"
      - "--store_container_labels=false"

  # Node Exporter - System metrics
  node-exporter:
    image: prom/node-exporter:v1.8.2
    container_name: node-exporter
    command:
      - "--path.rootfs=/host"
      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
    volumes:
      - /:/host:ro,rslave
    restart: unless-stopped

  # Postgres Exporter - Metrics for sink-postgres database
  postgres-exporter:
    image: prometheuscommunity/postgres-exporter:v0.16.0
    container_name: postgres-exporter-sink
    environment:
      DATA_SOURCE_NAME: "postgresql://postgres:postgres@sink-postgres:5432/measurements?sslmode=disable"
    depends_on:
      - sink-postgres
    restart: unless-stopped

volumes:
  target_db_data:
  sink_postgres_data:
  victoria_metrics_data:
  grafana_data: