docker-compose.yml

# Resource limits are configured for a 4 vCPU / 8 GiB RAM host.
# Total allocation: ~5.1 vCPUs, ~7.6 GiB RAM (with headroom for host OS).
# CPU overcommitment is intentional - containers rarely hit limits simultaneously.
#
# pgwatch-prometheus gets higher CPU (1.5) to handle pg_stat_statements load,
# which was observed spiking to 150%+ under heavy query workloads.

services:
  # Config Initializer - Copies static configs from image to volume
  config-init:
    image: ${PGAI_REGISTRY:-postgresai}/postgres-ai-configs:${PGAI_TAG:?PGAI_TAG is required}
    container_name: postgres-ai-config-init
    volumes:
      - postgres_ai_configs:/target
    environment:
      - TARGET_DIR=/target

  # Sources Generator - Generates sources.yml files from instances.yaml template
  sources-generator:
    image: bash:5.2
    container_name: sources-generator
    working_dir: /app
    volumes:
      - ./instances.yml:/app/instances.yaml:ro
      - postgres_ai_configs:/postgres_ai_configs
    depends_on:
      config-init:
        condition: service_completed_successfully
    command:
      ["bash", "/postgres_ai_configs/scripts/generate-pgwatch-sources.sh"]

  # Target Database - The PostgreSQL database being monitored (demo only)
  target-db:
    image: postgres:15
    container_name: target-db
    cpus: 0.2
    mem_limit: 768m
    environment:
      POSTGRES_DB: target_database
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    entrypoint:
      [
        "bash",
        "/postgres_ai_configs/scripts/postgres-entrypoint.sh",
        "target-db",
        "-c",
        "shared_preload_libraries=pg_stat_statements",
        "-c",
        "pg_stat_statements.track=all",
      ]
    volumes:
      - target_db_data:/var/lib/postgresql/data
      - postgres_ai_configs:/postgres_ai_configs:ro
    depends_on:
      config-init:
        condition: service_completed_successfully

  # Postgres Sink - Storage for metrics in PostgreSQL format
  # Note: pg_hba.conf is configured to allow passwordless connections (trust)
  # for local connections within the Docker network. This simplifies pgwatch
  # and postgres-exporter connectivity without compromising security since
  # the database is not exposed externally.
  sink-postgres:
    image: postgres:15
    container_name: sink-postgres
    cpus: 0.4
    mem_limit: 1024m
    environment:
      POSTGRES_DB: postgres
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_HOST_AUTH_METHOD: trust
    entrypoint:
      [
        "bash",
        "/postgres_ai_configs/scripts/postgres-entrypoint.sh",
        "sink-postgres",
      ]
    volumes:
      - sink_postgres_data:/var/lib/postgresql/data
      - postgres_ai_configs:/postgres_ai_configs:ro
    depends_on:
      config-init:
        condition: service_completed_successfully
    restart: unless-stopped

  # VictoriaMetrics Sink - Storage for metrics in Prometheus format
  sink-prometheus:
    image: victoriametrics/victoria-metrics:v1.105.0
    container_name: sink-prometheus
    cpus: 0.75
    mem_limit: 1536m
    ports:
      - "${BIND_HOST:-}59090:9090"
    volumes:
      - victoria_metrics_data:/victoria-metrics-data
      - postgres_ai_configs:/postgres_ai_configs:ro
    environment:
      - VM_AUTH_USERNAME=${VM_AUTH_USERNAME:-}
      - VM_AUTH_PASSWORD=${VM_AUTH_PASSWORD:-}
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        AUTH_ARGS=""
        if [ -n "$$VM_AUTH_USERNAME" ] && [ -n "$$VM_AUTH_PASSWORD" ]; then
          AUTH_ARGS="-httpAuth.username=$$VM_AUTH_USERNAME -httpAuth.password=$$VM_AUTH_PASSWORD"
        fi
        exec /victoria-metrics-prod -storageDataPath=/victoria-metrics-data -retentionPeriod=336h -httpListenAddr=:9090 -promscrape.config=/postgres_ai_configs/prometheus/prometheus.yml -promscrape.config.strictParse=false -promscrape.maxScrapeSize=128000000 $$AUTH_ARGS
    depends_on:
      config-init:
        condition: service_completed_successfully
    restart: unless-stopped

  # PGWatch Instance 1 - Monitoring service (Postgres sink)
  pgwatch-postgres:
    image: cybertecpostgresql/pgwatch:3
    container_name: pgwatch-postgres
    cpus: 0.35
    mem_limit: 512m
    command:
      [
        "--sources=/postgres_ai_configs/pgwatch/sources.yml",
        "--metrics=/postgres_ai_configs/pgwatch/metrics.yml",
        "--sink=postgresql://pgwatch@sink-postgres:5432/measurements?sslmode=disable",
        "--web-addr=:8080",
        "--log-level=error",
      ]
    depends_on:
      sources-generator:
        condition: service_completed_successfully
      sink-postgres:
        condition: service_started
    volumes:
      - postgres_ai_configs:/postgres_ai_configs:ro
    restart: unless-stopped

  # PGWatch Instance 2 - Monitoring service (Prometheus sink)
  pgwatch-prometheus:
    image: cybertecpostgresql/pgwatch:3
    container_name: pgwatch-prometheus
    cpus: 1.5
    mem_limit: 1024m
    command:
      [
        "--sources=/postgres_ai_configs/pgwatch-prometheus/sources.yml",
        "--metrics=/postgres_ai_configs/pgwatch-prometheus/metrics.yml",
        "--sink=prometheus://0.0.0.0:9091/pgwatch",
        "--web-addr=:8089",
        "--log-level=error",
      ]
    depends_on:
      sources-generator:
        condition: service_completed_successfully
      sink-prometheus:
        condition: service_started
    volumes:
      - postgres_ai_configs:/postgres_ai_configs:ro
    restart: unless-stopped

  # Grafana with datasources - Visualization layer
  grafana:
    image: grafana/grafana:12.0.2
    container_name: grafana-with-datasources
    cpus: 0.5
    mem_limit: 512m
    environment:
      GF_SECURITY_ADMIN_USER: monitor
      GF_SECURITY_ADMIN_PASSWORD: ${GF_SECURITY_ADMIN_PASSWORD:-demo}
      GF_INSTALL_PLUGINS: yesoreyeram-infinity-datasource
      GF_PATHS_PROVISIONING: /postgres_ai_configs/grafana/provisioning
      GF_PATHS_CONFIG: /postgres_ai_configs/grafana/provisioning/grafana.ini
      GF_FEATURE_TOGGLES_ENABLE: grafanaconThemes
      # OAuth configuration (disabled by default, enabled via Ansible)
      GF_AUTH_GENERIC_OAUTH_ENABLED: ${GRAFANA_OAUTH_ENABLED:-false}
      GF_AUTH_GENERIC_OAUTH_NAME: ${GRAFANA_OAUTH_NAME:-PostgresAI}
      GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: ${GRAFANA_OAUTH_ALLOW_SIGN_UP:-true}
      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ${GRAFANA_OAUTH_CLIENT_ID:-}
      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ${GRAFANA_OAUTH_CLIENT_SECRET:-}
      GF_AUTH_GENERIC_OAUTH_SCOPES: ${GRAFANA_OAUTH_SCOPES:-openid email profile}
      GF_AUTH_GENERIC_OAUTH_AUTH_URL: ${GRAFANA_OAUTH_AUTH_URL:-}
      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: ${GRAFANA_OAUTH_TOKEN_URL:-}
      GF_AUTH_GENERIC_OAUTH_API_URL: ${GRAFANA_OAUTH_API_URL:-}
      # Optional: disable login form when OAuth is primary auth
      GF_AUTH_DISABLE_LOGIN_FORM: ${GRAFANA_DISABLE_LOGIN_FORM:-false}
      GF_SERVER_ROOT_URL: ${GF_SERVER_ROOT_URL:-}
      VM_AUTH_USERNAME: ${VM_AUTH_USERNAME:-}
      VM_AUTH_PASSWORD: ${VM_AUTH_PASSWORD:-}
    ports:
      - "${GRAFANA_BIND_HOST:-}3000:3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - postgres_ai_configs:/postgres_ai_configs:ro
    depends_on:
      config-init:
        condition: service_completed_successfully
      sink-postgres:
        condition: service_started
      sink-prometheus:
        condition: service_started
    restart: unless-stopped
  monitoring_flask_backend:
    image: ${PGAI_REGISTRY:-postgresai}/monitoring-flask-backend:${PGAI_TAG:?PGAI_TAG is required}
    container_name: flask-pgss-api
    cpus: 0.1
    mem_limit: 192m
    environment:
      - FLASK_ENV=production
      - PROMETHEUS_URL=http://sink-prometheus:9090
      - POSTGRES_SINK_URL=postgresql://pgwatch@sink-postgres:5432/measurements
      - VM_AUTH_USERNAME=${VM_AUTH_USERNAME:-}
      - VM_AUTH_PASSWORD=${VM_AUTH_PASSWORD:-}
      # Optional overrides:
      # - ENABLE_AMP=true (enable Amazon Managed Prometheus support)
      # - AWS_REGION=us-east-1 (AWS region for Amazon Managed Prometheus)
    depends_on:
      - sink-prometheus
      - sink-postgres
    restart: unless-stopped

  # PostgreSQL Reports Generator - Runs reports after 30 minutes
  postgres-reports:
    image: ${PGAI_REGISTRY:-postgresai}/reporter:${PGAI_TAG:?PGAI_TAG is required}
    container_name: postgres-reports
    cpus: 1.0
    mem_limit: 1792m
    working_dir: /app
    volumes:
      - ./.pgwatch-config:/app/.pgwatch-config:ro
      - postgres_ai_configs:/postgres_ai_configs:ro
    environment:
      - PROMETHEUS_URL=http://sink-prometheus:9090
      - VM_AUTH_USERNAME=${VM_AUTH_USERNAME:-}
      - VM_AUTH_PASSWORD=${VM_AUTH_PASSWORD:-}
      # Optional overrides:
      # - REPORTER_INITIAL_DELAY_SECONDS=1800
      # - REPORTER_INTERVAL_SECONDS=86400
      # - REPORTER_OUTPUT_TEMPLATE=/app/all_reports_%Y%m%d_%H%M%S.json
      # - REPORTER_API_URL=https://postgres.ai/api/general
      # - REPORTER_PROJECT_NAME=postgres-ai-monitoring
      # - REPORTER_PGWATCH_CONFIG_PATH=/app/.pgwatch-config
      # - ENABLE_AMP=true (enable Amazon Managed Prometheus support)
      # - AWS_REGION=us-east-1 (AWS region for Amazon Managed Prometheus)
    depends_on:
      config-init:
        condition: service_completed_successfully
      sink-prometheus:
        condition: service_started
      pgwatch-prometheus:
        condition: service_started
    command: ["bash", "/postgres_ai_configs/scripts/postgres-reports.sh"]

  # Self-monitoring components (may have reduced functionality on macOS)

  # cAdvisor - Container metrics (self-monitoring)
  self-cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.51.0
    container_name: self-cadvisor
    cpus: 0.15
    mem_limit: 192m
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    command:
      - "--housekeeping_interval=30s"
      - "--docker_only=true"
      - "--disable_metrics=percpu,sched,tcp,udp,hugetlb,referenced_memory,cpu_topology,resctrl"
      - "--store_container_labels=false"

  # Node Exporter - System metrics (self-monitoring)
  self-node-exporter:
    image: prom/node-exporter:v1.8.2
    container_name: self-node-exporter
    cpus: 0.05
    mem_limit: 96m
    command:
      - "--path.rootfs=/host"
      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
    volumes:
      - /:/host:ro,rslave
    restart: unless-stopped

  # Postgres Exporter - Metrics for sink-postgres (self-monitoring)
  self-postgres-exporter:
    image: prometheuscommunity/postgres-exporter:v0.16.0
    container_name: self-postgres-exporter
    cpus: 0.1
    mem_limit: 128m
    environment:
      DATA_SOURCE_NAME: "postgresql://postgres:postgres@sink-postgres:5432/measurements?sslmode=disable"
    depends_on:
      - sink-postgres
    restart: unless-stopped

volumes:
  postgres_ai_configs:
  target_db_data:
  sink_postgres_data:
  victoria_metrics_data:
  grafana_data: