docker-compose.yml

version: '3.8'

services:
  # Tailscale Sidecar for Magic DNS
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale
    hostname: devstack
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false
      - TS_ACCEPT_DNS=true
      - TS_HOSTNAME=devstack
      - TS_EXTRA_ARGS=--advertise-tags=tag:devstack
      - TS_ENABLE_HEALTH_CHECK=true
      - TS_LOCAL_ADDR_PORT=:9002
    volumes:
      - tailscale_state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    restart: unless-stopped
    network_mode: host
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9002/healthz"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Cloudflare Tunnel
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN}
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}
    restart: unless-stopped
    depends_on:
      - tailscale

  # Ollama - LLM Server
  ollama:
    image: ollama/ollama:latest
    container_name: ollama
    hostname: ollama
    environment:
      - OLLAMA_HOST=0.0.0.0
    volumes:
      - ollama_data:/root/.ollama
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ollama.rule=Host(`llm.bbj4u.xyz`)"
      - "traefik.http.services.ollama.loadbalancer.server.port=11434"

  # OpenWebUI - Web Interface for Ollama
  openwebui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: openwebui
    hostname: chat
    volumes:
      - openwebui_data:/app/backend/data
    ports:
      - "8081:8080"
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 4G
        reservations:
          cpus: '0.5'
          memory: 2G
    environment:
      - OLLAMA_API_BASE_URL=http://ollama:11434/api
      - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY:-password123}
      # Supabase Database Configuration
      - DATABASE_URL=postgresql://${SUPABASE_DB_USER}:${SUPABASE_DB_PASSWORD}@${SUPABASE_HOST}:${SUPABASE_PORT}/${SUPABASE_DB_NAME}
      - SUPABASE_URL=${SUPABASE_URL}
      - SUPABASE_ANON_KEY=${SUPABASE_ANON_KEY}
    depends_on:
      - ollama
      - tailscale
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.chat.rule=Host(`chat.bbj4u.xyz`)"
      - "traefik.http.services.chat.loadbalancer.server.port=8080"

  # VS Code Server
  code-server:
    image: codercom/code-server:latest
    container_name: code-server
    hostname: code
    ports:
      - "8443:8080"
    environment:
      - PASSWORD=${VSCODE_PASSWORD:-password123}
      - SUDO_PASSWORD=${VSCODE_PASSWORD:-password123}
    volumes:
      - code_data:/home/coder
      - /var/run/docker.sock:/var/run/docker.sock
      - ./:/home/coder/workspace
    user: "0:0"
    restart: unless-stopped
    depends_on:
      - tailscale
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.code.rule=Host(`code.bbj4u.xyz`)"
      - "traefik.http.services.code.loadbalancer.server.port=8080"

  # n8n - Workflow Automation
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    hostname: n8n
    ports:
      - "8082:5678"
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 6G
        reservations:
          cpus: '0.5'
          memory: 4G
    environment:
      - N8N_HOST=n8n.bbj4u.xyz
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - N8N_USER_MANAGEMENT_DISABLED=true
      - NODE_ENV=production
      - WEBHOOK_URL=https://n8n.bbj4u.xyz/
      - N8N_BASIC_AUTH_USER=${N8N_BASIC_AUTH_USER:-jblast}
      - N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD:-password123}
      # Supabase Database Configuration for n8n
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=${SUPABASE_HOST}
      - DB_POSTGRESDB_PORT=${SUPABASE_PORT}
      - DB_POSTGRESDB_DATABASE=${SUPABASE_DB_NAME}
      - DB_POSTGRESDB_USER=${SUPABASE_DB_USER}
      - DB_POSTGRESDB_PASSWORD=${SUPABASE_DB_PASSWORD}
    volumes:
      - n8n_data:/home/node/.n8n
    restart: unless-stopped
    depends_on:
      - tailscale
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.n8n.rule=Host(`n8n.bbj4u.xyz`)"
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"

  # Minio - S3-compatible Object Storage
  minio:
    image: minio/minio:latest
    container_name: minio
    hostname: s3
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio_data:/data
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-jblast}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD:-password123}
    command: server --console-address ":9001" /data
    restart: unless-stopped
    depends_on:
      - tailscale
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.s3-api.rule=Host(`s3.bbj4u.xyz`)"
      - "traefik.http.services.s3-api.loadbalancer.server.port=9000"
      - "traefik.http.routers.s3-console.rule=Host(`s3-console.bbj4u.xyz`)"
      - "traefik.http.services.s3-console.loadbalancer.server.port=9001"

  # Supabase Backup Service
  supabase-backup:
    image: postgres:15-alpine
    container_name: supabase-backup
    hostname: backup
    environment:
      - PGHOST=${SUPABASE_HOST}
      - PGPORT=${SUPABASE_PORT}
      - PGDATABASE=${SUPABASE_DB_NAME}
      - PGUSER=${SUPABASE_DB_USER}
      - PGPASSWORD=${SUPABASE_DB_PASSWORD}
      - BACKUP_SCHEDULE=0 2 * * *  # Daily at 2 AM
    volumes:
      - supabase_backups:/backups
      - ./backup-scripts:/scripts
    command: >
      sh -c '
        echo "0 2 * * * pg_dump -h $$PGHOST -p $$PGPORT -U $$PGUSER -d $$PGDATABASE > /backups/backup_$$(date +%Y%m%d_%H%M%S).sql" | crontab - &&
        crond -f
      '
    restart: unless-stopped
    depends_on:
      - tailscale

  # Adminer - Database Management
  adminer:
    image: adminer:latest
    container_name: adminer
    hostname: db
    ports:
      - "8083:8080"
    restart: unless-stopped
    depends_on:
      - tailscale
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.db.rule=Host(`db.bbj4u.xyz`)"
      - "traefik.http.services.db.loadbalancer.server.port=8080"

  # Redis for Caching
  redis:
    image: redis:alpine
    container_name: redis
    hostname: redis
    command: redis-server --save 20 1 --loglevel warning
    volumes:
      - redis_data:/data
    restart: unless-stopped
    depends_on:
      - tailscale

  # MongoDB for Content Storage
  mongodb:
    image: mongo:latest
    container_name: mongodb
    hostname: mongodb
    environment:
      MONGO_INITDB_ROOT_USERNAME: root
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD:-password123}
    volumes:
      - mongodb_data:/data/db
    restart: unless-stopped
    depends_on:
      - tailscale

  # RabbitMQ for Message Queue
  rabbitmq:
    image: rabbitmq:3-management
    container_name: rabbitmq
    hostname: rabbitmq
    ports:
      - "5672:5672"
      - "15672:15672"
    environment:
      - RABBITMQ_DEFAULT_USER=admin
      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_PASSWORD:-password123}
    restart: unless-stopped
    depends_on:
      - tailscale
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rabbitmq.rule=Host(`queue.bbj4u.xyz`)"
      - "traefik.http.services.rabbitmq.loadbalancer.server.port=15672"

  # Grafana for monitoring
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    hostname: monitor
    ports:
      - "3000:3000"
    volumes:
      - grafana_data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-password123}
      - GF_SERVER_ROOT_URL=https://monitor.bbj4u.xyz
      # Supabase Database Configuration for Grafana
      - GF_DATABASE_TYPE=postgres
      - GF_DATABASE_HOST=${SUPABASE_HOST}:${SUPABASE_PORT}
      - GF_DATABASE_NAME=${SUPABASE_DB_NAME}
      - GF_DATABASE_USER=${SUPABASE_DB_USER}
      - GF_DATABASE_PASSWORD=${SUPABASE_DB_PASSWORD}
    restart: unless-stopped
    depends_on:
      - tailscale
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.monitor.rule=Host(`monitor.bbj4u.xyz`)"
      - "traefik.http.services.monitor.loadbalancer.server.port=3000"

  # Prometheus for metrics collection
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    hostname: metrics
    ports:
      - "9090:9090"
    volumes:
      - prometheus_data:/prometheus
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
    restart: unless-stopped
    depends_on:
      - tailscale
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.metrics.rule=Host(`metrics.bbj4u.xyz`)"
      - "traefik.http.services.metrics.loadbalancer.server.port=9090"

  # Portainer - Docker Management
  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    hostname: docker
    ports:
      - "9443:9443"
      - "8000:8000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    restart: unless-stopped
    depends_on:
      - tailscale
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.docker.rule=Host(`docker.bbj4u.xyz`)"
      - "traefik.http.services.docker.loadbalancer.server.port=9443"

volumes:
  ollama_data:
  openwebui_data:
  code_data:
  n8n_data:
  minio_data:
  supabase_backups:
  redis_data:
  mongodb_data:
  grafana_data:
  prometheus_data:
  portainer_data:
  tailscale_state: