docker-compose.yml

name: 'mint'

services:
  web:
    build:
      context: apps/web
      dockerfile: Dockerfile
    container_name: mint-web
    networks: [mint]
    ports:
      - '3000:3000'
    environment:
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost}
      NODE_ENV: production
    depends_on:
      - nginx
    restart: unless-stopped

  nginx:
    image: nginx:1.29-alpine
    container_name: mint-nginx
    networks: [mint]
    ports:
      - '80:80'
      # For SSL: also expose 443 and mount ./infra/nginx/certs:/etc/nginx/certs:ro
    volumes:
      - ./infra/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - auth
      - wallet
    restart: unless-stopped
    healthcheck:
      test: ['CMD', 'wget', '-qO-', 'http://127.0.0.1/health']
      interval: 10s
      timeout: 3s
      retries: 3

  kafka:
    image: confluentinc/cp-kafka:7.9.6
    container_name: mint-kafka
    hostname: kafka
    networks: [mint]
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_LISTENERS: PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,CONTROLLER:PLAINTEXT
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: 'true'
      CLUSTER_ID: 'eYjp31bQQTit57aK84wZcw'
    healthcheck:
      test:
        [
          'CMD',
          'kafka-topics',
          '--bootstrap-server',
          'localhost:9092',
          '--list',
        ]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s
    restart: unless-stopped

  kafka-init:
    image: confluentinc/cp-kafka:7.9.6
    container_name: mint-kafka-init
    networks: [mint]
    depends_on:
      kafka:
        condition: service_healthy
    command: >
      bash -c "
      kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists --topic auth.events --partitions 3 --replication-factor 1 &&
      kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists --topic kyc.events --partitions 3 --replication-factor 1 &&
      kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists --topic transaction.events --partitions 3 --replication-factor 1 &&
      kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists --topic wallet.events --partitions 3 --replication-factor 1 &&
      kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists --topic analytics.events --partitions 3 --replication-factor 1 &&
      kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists --topic social.events --partitions 3 --replication-factor 1 &&
      kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists --topic webhook.events --partitions 1 --replication-factor 1 &&
      kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists --topic admin.events --partitions 1 --replication-factor 1 &&
      kafka-topics --bootstrap-server kafka:9092 --create --if-not-exists --topic audit.events --partitions 1 --replication-factor 1 &&
      echo All topics created
      "
    restart: no

  postgres:
    image: postgres:18.3-alpine
    container_name: mint-postgres
    networks: [mint]
    environment:
      POSTGRES_USER: mint-dev
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./infra/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 3s
      retries: 10
    restart: unless-stopped

  redis:
    image: redis:8-alpine
    container_name: mint-redis
    networks: [mint]
    command: redis-server --appendonly yes
    volumes:
      - redis-data:/data
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped

  minio:
    # To switch to AWS S3: remove this service and set S3_ENDPOINT, S3_ACCESS_KEY,
    # S3_SECRET_KEY env vars on the kyc service.
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    container_name: mint-minio
    networks: [mint]
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    volumes:
      - minio-data:/data
    command: server /data --console-address ":9001"
    healthcheck:
      test: ['CMD', 'mc', 'ready', 'local']
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  minio-init:
    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
    container_name: mint-minio-init
    networks: [mint]
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      sh -c "
        mc alias set local http://minio:9000 minioadmin minioadmin &&
        mc mb --ignore-existing local/mint-kyc-docs &&
        mc anonymous set none local/mint-kyc-docs &&
        echo MinIO bucket ready
      "
    restart: no

  otel-collector:
    image: otel/opentelemetry-collector-contrib:latest
    container_name: mint-otel-collector
    networks: [mint]
    volumes:
      - ./infra/otel/otel-collector.yml:/etc/otel-collector.yml:ro
    command: ['--config=/etc/otel-collector.yml']
    depends_on:
      - tempo
    restart: unless-stopped

  tempo:
    image: grafana/tempo:2.4.1
    container_name: mint-tempo
    networks: [mint]
    volumes:
      - ./infra/tempo/tempo.yml:/etc/tempo.yml:ro
    command: ['-config.file=/etc/tempo.yml']
    restart: unless-stopped

  mailhog:
    image: mailhog/mailhog:v1.0.1
    container_name: mint-mailhog
    networks: [mint]
    ports:
      - '8025:8025' # Web UI
    restart: unless-stopped

  grafana:
    image: grafana/grafana:10.4.3
    container_name: mint-grafana
    networks: [mint]
    ports:
      - '4000:3000'
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-changeme}
    volumes:
      - ./infra/grafana/provisioning:/etc/grafana/provisioning:ro
    depends_on:
      - tempo
    restart: unless-stopped

  auth-migrate:
    build:
      context: .
      dockerfile: apps/auth/Dockerfile
      target: production
    container_name: mint-auth-migrate
    networks: [mint]
    environment:
      APP_PORT: '4001'
      APP_HOST: 0.0.0.0
      APP_RELOAD: 'false'
      KEYS_DIR: /app/apps/auth/keys
      FASTAUTH_SECRET: ${FASTAUTH_SECRET}
      DATABASE_URL: postgresql+asyncpg://mint_auth_user:mint_auth_pass@postgres:5432/mint_auth
      KAFKA_BROKERS: kafka:9092
    depends_on:
      postgres:
        condition: service_healthy
    command: ['uv', 'run', 'migrate']
    restart: no

  wallet-migrate:
    build:
      context: .
      dockerfile: apps/wallet/Dockerfile
      target: production
    container_name: mint-wallet-migrate
    networks: [mint]
    environment:
      APP_PORT: '4002'
      APP_HOST: 0.0.0.0
      APP_RELOAD: 'false'
      DATABASE_URL: postgresql+asyncpg://mint_wallet_user:mint_wallet_pass@postgres:5432/mint_wallet
      KAFKA_BROKERS: kafka:9092
    depends_on:
      postgres:
        condition: service_healthy
    command: ['uv', 'run', 'migrate']
    restart: no

  transactions-migrate:
    build:
      context: .
      dockerfile: apps/transactions/Dockerfile
      target: builder
    container_name: mint-transactions-migrate
    networks: [mint]
    environment:
      DATABASE_URL: postgresql://mint_txns_user:mint_txns_pass@postgres:5432/mint_txns
    depends_on:
      postgres:
        condition: service_healthy
    command: ['pnpm', 'migrate:transactions']
    restart: no

  fraud-migrate:
    build:
      context: .
      dockerfile: apps/fraud/Dockerfile
      target: builder
    container_name: mint-fraud-migrate
    networks: [mint]
    environment:
      DATABASE_URL: postgresql://mint_fraud_user:mint_fraud_pass@postgres:5432/mint_fraud
    depends_on:
      postgres:
        condition: service_healthy
    command: ['pnpm', 'migrate:fraud']
    restart: no

  kyc-migrate:
    build:
      context: .
      dockerfile: apps/kyc/Dockerfile
      target: builder
    container_name: mint-kyc-migrate
    networks: [mint]
    environment:
      DATABASE_URL: postgresql://mint_kyc_user:mint_kyc_pass@postgres:5432/mint_kyc
    depends_on:
      postgres:
        condition: service_healthy
    command: ['pnpm', 'migrate:kyc']
    restart: no

  analytics-migrate:
    build:
      context: .
      dockerfile: apps/analytics/Dockerfile
      target: builder
    container_name: mint-analytics-migrate
    networks: [mint]
    environment:
      DATABASE_URL: postgresql://mint_analytics_user:mint_analytics_pass@postgres:5432/mint_analytics
    depends_on:
      postgres:
        condition: service_healthy
    command: ['pnpm', 'migrate:analytics']
    restart: no

  notifications-migrate:
    build:
      context: .
      dockerfile: apps/notifications/Dockerfile
      target: builder
    container_name: mint-notifications-migrate
    networks: [mint]
    environment:
      DATABASE_URL: postgresql://mint_notifications_user:mint_notifications_pass@postgres:5432/mint_notifications
    depends_on:
      postgres:
        condition: service_healthy
    command: ['pnpm', 'migrate:notifications']
    restart: no

  social-migrate:
    build:
      context: .
      dockerfile: apps/social/Dockerfile
      target: builder
    container_name: mint-social-migrate
    networks: [mint]
    environment:
      DATABASE_URL: postgresql://mint_social_user:mint_social_pass@postgres:5432/mint_social
    depends_on:
      postgres:
        condition: service_healthy
    command: ['pnpm', 'migrate:social']
    restart: no

  webhook-migrate:
    build:
      context: .
      dockerfile: apps/webhook/Dockerfile
      target: builder
    container_name: mint-webhook-migrate
    networks: [mint]
    environment:
      DATABASE_URL: postgresql://mint_webhook_user:mint_webhook_pass@postgres:5432/mint_webhook
    depends_on:
      postgres:
        condition: service_healthy
    command: ['pnpm', 'migrate:webhook']
    restart: no

  audit-migrate:
    build:
      context: .
      dockerfile: apps/audit/Dockerfile
      target: builder
    container_name: mint-audit-migrate
    networks: [mint]
    environment:
      DATABASE_URL: postgresql://mint_audit_user:mint_audit_pass@postgres:5432/mint_audit
    depends_on:
      postgres:
        condition: service_healthy
    command: ['pnpm', 'run', 'migrate:audit']
    restart: no

  auth:
    build:
      context: .
      dockerfile: apps/auth/Dockerfile
      target: production
    container_name: mint-auth
    networks: [mint]
    environment:
      APP_PORT: '4001'
      APP_HOST: 0.0.0.0
      APP_RELOAD: 'false'
      KEYS_DIR: /app/apps/auth/keys
      FASTAUTH_SECRET: ${FASTAUTH_SECRET}
      DATABASE_URL: postgresql+asyncpg://mint_auth_user:mint_auth_pass@postgres:5432/mint_auth
      KAFKA_BROKERS: kafka:9092
      SMTP_HOST: mailhog
      SMTP_PORT: '1025'
      SMTP_FROM: Mint <noreply@mint.dev>
      OTEL_SERVICE_NAME: auth-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    volumes:
      - ./keys/private_key.pem:/app/apps/auth/keys/private_key.pem:ro
      - ./keys/public_key.pem:/app/apps/auth/keys/public_key.pem:ro
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
      auth-migrate:
        condition: service_completed_successfully
    restart: unless-stopped

  wallet:
    build:
      context: .
      dockerfile: apps/wallet/Dockerfile
      target: production
    container_name: mint-wallet
    networks: [mint]
    environment:
      APP_PORT: '4002'
      APP_HOST: 0.0.0.0
      APP_RELOAD: 'false'
      DATABASE_URL: postgresql+asyncpg://mint_wallet_user:mint_wallet_pass@postgres:5432/mint_wallet
      KAFKA_BROKERS: kafka:9092
      OTEL_SERVICE_NAME: wallet-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
      wallet-migrate:
        condition: service_completed_successfully
    restart: unless-stopped

  transactions:
    build:
      context: .
      dockerfile: apps/transactions/Dockerfile
      target: production
    container_name: mint-transactions
    networks: [mint]
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://mint_txns_user:mint_txns_pass@postgres:5432/mint_txns
      REDIS_URL: redis://redis:6379
      KAFKA_BROKERS: kafka:9092
      AUTH_JWKS_URL: http://auth:4001/.well-known/jwks.json
      JWT_ISSUER: ${JWT_ISSUER:-mint-auth}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-mint-services}
      WALLET_SERVICE_URL: wallet:50051
      FRAUD_SERVICE_URL: fraud:50052
      KYC_SERVICE_URL: kyc:50053
      OTEL_SERVICE_NAME: transactions-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
      transactions-migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
      wallet:
        condition: service_started
    restart: unless-stopped

  fraud:
    build:
      context: .
      dockerfile: apps/fraud/Dockerfile
      target: production
    container_name: mint-fraud
    networks: [mint]
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://mint_fraud_user:mint_fraud_pass@postgres:5432/mint_fraud
      REDIS_URL: redis://redis:6379
      KAFKA_BROKERS: kafka:9092
      AUTH_JWKS_URL: http://auth:4001/.well-known/jwks.json
      FRAUD_BLOCK_THRESHOLD: '100'
      FRAUD_REVIEW_THRESHOLD: '50'
      OTEL_SERVICE_NAME: fraud-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      fraud-migrate:
        condition: service_completed_successfully
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
    restart: unless-stopped

  kyc:
    build:
      context: .
      dockerfile: apps/kyc/Dockerfile
      target: production
    container_name: mint-kyc
    networks: [mint]
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://mint_kyc_user:mint_kyc_pass@postgres:5432/mint_kyc
      REDIS_URL: redis://redis:6379
      KAFKA_BROKERS: kafka:9092
      AUTH_JWKS_URL: http://auth:4001/.well-known/jwks.json
      JWT_ISSUER: ${JWT_ISSUER:-mint-auth}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-mint-services}
      KYC_WEBHOOK_SECRET: ${KYC_WEBHOOK_SECRET}
      S3_ENDPOINT: http://minio:9000
      S3_BUCKET: mint-kyc-docs
      S3_ACCESS_KEY: minioadmin
      S3_SECRET_KEY: minioadmin
      OTEL_SERVICE_NAME: kyc-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
      kyc-migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully
    restart: unless-stopped

  analytics:
    build:
      context: .
      dockerfile: apps/analytics/Dockerfile
      target: production
    container_name: mint-analytics
    networks: [mint]
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://mint_analytics_user:mint_analytics_pass@postgres:5432/mint_analytics
      REDIS_URL: redis://redis:6379
      KAFKA_BROKERS: kafka:9092
      AUTH_JWKS_URL: http://auth:4001/.well-known/jwks.json
      JWT_ISSUER: ${JWT_ISSUER:-mint-auth}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-mint-services}
      OTEL_SERVICE_NAME: analytics-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
      analytics-migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    restart: unless-stopped

  notifications:
    build:
      context: .
      dockerfile: apps/notifications/Dockerfile
      target: production
    container_name: mint-notifications
    networks: [mint]
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://mint_notifications_user:mint_notifications_pass@postgres:5432/mint_notifications
      REDIS_URL: redis://redis:6379
      KAFKA_BROKERS: kafka:9092
      AUTH_JWKS_URL: http://auth:4001/.well-known/jwks.json
      JWT_ISSUER: ${JWT_ISSUER:-mint-auth}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-mint-services}
      SMTP_HOST: mailhog
      SMTP_PORT: '1025'
      SMTP_FROM: Mint <noreply@mint.dev>
      OTEL_SERVICE_NAME: notifications-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
      notifications-migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    restart: unless-stopped

  social:
    build:
      context: .
      dockerfile: apps/social/Dockerfile
      target: production
    container_name: mint-social
    networks: [mint]
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://mint_social_user:mint_social_pass@postgres:5432/mint_social
      REDIS_URL: redis://redis:6379
      KAFKA_BROKERS: kafka:9092
      AUTH_JWKS_URL: http://auth:4001/.well-known/jwks.json
      JWT_ISSUER: ${JWT_ISSUER:-mint-auth}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-mint-services}
      OTEL_SERVICE_NAME: social-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
      social-migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    restart: unless-stopped

  webhook:
    build:
      context: .
      dockerfile: apps/webhook/Dockerfile
      target: production
    container_name: mint-webhook
    networks: [mint]
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://mint_webhook_user:mint_webhook_pass@postgres:5432/mint_webhook
      REDIS_URL: redis://redis:6379
      KAFKA_BROKERS: kafka:9092
      AUTH_JWKS_URL: http://auth:4001/.well-known/jwks.json
      JWT_ISSUER: ${JWT_ISSUER:-mint-auth}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-mint-services}
      OTEL_SERVICE_NAME: webhook-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
      webhook-migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    restart: unless-stopped

  admin:
    build:
      context: .
      dockerfile: apps/admin/Dockerfile
      target: production
    container_name: mint-admin
    networks: [mint]
    environment:
      NODE_ENV: production
      REDIS_URL: redis://redis:6379
      KAFKA_BROKERS: kafka:9092
      AUTH_JWKS_URL: http://auth:4001/.well-known/jwks.json
      JWT_ISSUER: ${JWT_ISSUER:-mint-auth}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-mint-services}
      WALLET_GRPC_URL: wallet:50051
      KYC_GRPC_URL: kyc:50053
      ADMIN_USER_IDS: ${ADMIN_USER_IDS}
      OTEL_SERVICE_NAME: admin-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      kafka:
        condition: service_healthy
      redis:
        condition: service_healthy
      wallet:
        condition: service_started
      kyc:
        condition: service_started
    restart: unless-stopped

  audit:
    build:
      context: .
      dockerfile: apps/audit/Dockerfile
      target: production
    container_name: mint-audit
    networks: [mint]
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://mint_audit_user:mint_audit_pass@postgres:5432/mint_audit
      REDIS_URL: redis://redis:6379
      KAFKA_BROKERS: kafka:9092
      AUTH_JWKS_URL: http://auth:4001/.well-known/jwks.json
      JWT_ISSUER: ${JWT_ISSUER:-mint-auth}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-mint-services}
      OTEL_SERVICE_NAME: audit-service
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_TRACES_EXPORTER: otlp
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      kafka-init:
        condition: service_completed_successfully
      audit-migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    restart: unless-stopped

volumes:
  postgres-data:
  redis-data:
  minio-data:

networks:
  mint:
    driver: bridge