docker-compose.yaml

networks:
  internal_network:
    internal: true
  external_network:
    driver: bridge

services:
  # CB-Tumblebug
  cb-tumblebug:
    image: cloudbaristaorg/cb-tumblebug:0.12.9
    container_name: cb-tumblebug
    build:
      context: .
      dockerfile: Dockerfile
    networks:
      - internal_network
      - external_network
    ports:
      - 1323:1323
    depends_on:
      cb-tumblebug-etcd:
        condition: service_started
      cb-spider:
        condition: service_started
      cb-tumblebug-postgres:
        condition: service_healthy
      mc-terrarium:
        condition: service_healthy
    volumes:
      - ./conf/:/app/conf/
      - ./assets/:/app/assets/
      - ./container-volume/cb-tumblebug-container/meta_db/:/app/meta_db/
      - ./container-volume/cb-tumblebug-container/log/:/app/log/
    environment:
      # - TB_ROOT_PATH=/app
      # # Enable TB_SELF_ENDPOINT to specify an endpoint for CB-TB API (default: localhost:1323)
      # # Use public IP if you want to access the API Dashboard from outside of localhost
      # - TB_SELF_ENDPOINT=xxx.xxx.xxx.xxx:1323
      - TB_SPIDER_REST_URL=http://cb-spider:1024/spider
      - TB_ETCD_ENDPOINTS=http://cb-tumblebug-etcd:2379
      - TB_TERRARIUM_REST_URL=http://mc-terrarium:8055/terrarium
      - TB_IAM_MANAGER_REST_URL=http://mc-iam-manager:5000
      # - TB_ETCD_AUTH_ENABLED=false
      # - TB_ETCD_USERNAME=default
      # - TB_ETCD_PASSWORD=default
      - TB_POSTGRES_ENDPOINT=cb-tumblebug-postgres:5432
      - TB_POSTGRES_DATABASE=tumblebug
      - TB_POSTGRES_USER=tumblebug
      - TB_POSTGRES_PASSWORD=tumblebug
      - TB_TERRARIUM_API_USERNAME=${TERRARIUM_API_USERNAME:?Please set TERRARIUM_API_USERNAME}
      - TB_TERRARIUM_API_PASSWORD=${TERRARIUM_API_PASSWORD:?Please set TERRARIUM_API_PASSWORD}
      # - TB_ALLOW_ORIGINS=*
      # - TB_AUTH_ENABLED=true
      # - TB_AUTH_MODE=jwt
      - TB_API_USERNAME=${TB_API_USERNAME:?Please set TB_API_USERNAME}
      - TB_API_PASSWORD=${TB_API_PASSWORD:?Please set TB_API_PASSWORD}
      # - TB_AUTOCONTROL_DURATION_MS=10000
      # - TB_DEFAULT_NAMESPACE=default
      # - TB_DEFAULT_CREDENTIALHOLDER=admin
      # - TB_LOGFILE_PATH=/app/log/tumblebug.log
      # - TB_LOGFILE_MAXSIZE=1000
      # - TB_LOGFILE_MAXBACKUPS=3
      # - TB_LOGFILE_MAXAGE=30
      # - TB_LOGFILE_COMPRESS=false
      # - TB_LOGLEVEL=debug
      # - TB_LOGWRITER=both
      # - TB_NODE_ENV=development
      - VAULT_ADDR=http://openbao:8200
      - VAULT_TOKEN=${VAULT_TOKEN:-}
    healthcheck: # for CB-Tumblebug
      test: ["CMD", "curl", "-f", "http://localhost:1323/tumblebug/readyz"]
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 10s

  # CB-Tumblebug ETCD
  # This is used for storing CB-Tumblebug metadata.
  cb-tumblebug-etcd:
    image: gcr.io/etcd-development/etcd:v3.5.21
    container_name: cb-tumblebug-etcd
    networks:
      - internal_network
    ports:
      - 2379:2379
      - 2380:2380
    volumes:
      - ./container-volume/etcd/data:/etcd-data
    entrypoint: /usr/local/bin/etcd
    command:
      - --name
      - s1
      - --data-dir
      - /etcd-data
      - --listen-client-urls
      - http://0.0.0.0:2379
      - --advertise-client-urls
      - http://0.0.0.0:2379
      - --listen-peer-urls
      - http://0.0.0.0:2380
      - --initial-advertise-peer-urls
      - http://0.0.0.0:2380
      - --initial-cluster
      - s1=http://0.0.0.0:2380
      - --initial-cluster-token
      - tkn
      - --initial-cluster-state
      - new
      - --log-level
      - info
      - --logger
      - zap
      - --log-outputs
      - stderr
      - --auth-token
      - simple
    healthcheck: # for etcd
      test: ["CMD", "/usr/local/bin/etcd", "--version"]
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 10s

  # CB-Tumblebug PostgreSQL
  # This is used for storing CB-Tumblebug Spec and Image.
  cb-tumblebug-postgres:
    image: postgres:16-alpine
    container_name: cb-tumblebug-postgres
    restart: always
    networks:
      - internal_network
      # Enable external network for outbound access (not ideal for security)
      # In production, comment this out to disable external access
      - external_network
    ports:
      - 5432:5432
    volumes:
      - ./container-volume/cb-tumblebug-container/meta_db/postgres:/var/lib/postgresql/data
    command: postgres -c max_connections=500
    environment:
      - POSTGRES_USER=tumblebug
      - POSTGRES_PASSWORD=tumblebug
      - POSTGRES_DB=tumblebug
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U tumblebug"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  # CB-Spider
  cb-spider:
    image: cloudbaristaorg/cb-spider:0.12.17
    container_name: cb-spider
    # build:
    #   context: ../cb-spider
    #   dockerfile: Dockerfile
    networks:
      - internal_network
      - external_network # for outbound access (not ideal for security)
    # Uncomment below if you want to access CB-Spider for remote
    # ports:
    #   - 1024:1024
    volumes:
      - ./container-volume/cb-spider-container/meta_db/:/root/go/src/github.com/cloud-barista/cb-spider/meta_db/
      - ./container-volume/cb-spider-container/log/:/root/go/src/github.com/cloud-barista/cb-spider/log/
      # Note: cb-spider 0.12.8+ Docker image excludes cloud-driver-libs/ (static mode optimization).
      # This directory is maintained in assets/spider/ and must be updated when upgrading cb-spider.
      - ./assets/spider/:/root/go/src/github.com/cloud-barista/cb-spider/cloud-driver-libs/
    environment:
      - PLUGIN_SW=OFF
      - SERVER_ADDRESS=0.0.0.0:1024
      - SPIDER_USERNAME=${SPIDER_USERNAME:?Please set SPIDER_USERNAME}
      - SPIDER_PASSWORD=${SPIDER_PASSWORD:?Please set SPIDER_PASSWORD}
      - SPIDER_LOG_LEVEL=error
      - SPIDER_HISCALL_LOG_LEVEL=error
      - ID_TRANSFORM_MODE=OFF
      - ADMINWEB=OFF
      - SPIDER_BACKUP_ENABLED=false
    healthcheck: # for CB-Spider
      test: ["CMD", "curl", "-f", "http://localhost:1024/spider/readyz"]
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 10s

  # CB-MapUI
  # This is the Map-based client for CB-Tumblebug.
  cb-mapui:
    image: cloudbaristaorg/cb-mapui:0.12.29
    container_name: cb-mapui
    # build:
    #   context: ../cb-mapui
    #   dockerfile: Dockerfile
    networks:
      - internal_network
      - external_network # Keep this for the time being to support legacy access methods (http://localhost:1324)
    ports:
      - target: 1324
        published: 1324
        protocol: tcp
    # healthcheck:
    #   test: ["CMD", "curl", "-f", "http://localhost:1324"]
    #   interval: 30s
    #   timeout: 5s
    #   retries: 3
    #   start_period: 10s

  # TB-MCP (Tumblebug Model Context Protocol Server)
  # This provides MCP interface for CB-Tumblebug to work with AI assistants like Claude
  cb-tumblebug-mcp-server:
    build:
      context: ./src/interface/mcp
      dockerfile: Dockerfile
    container_name: cb-tumblebug-mcp-server
    networks:
      - internal_network
      - external_network
    ports:
      - "8000:8000"
    environment:
      # TB-MCP Configuration
      - TUMBLEBUG_API_BASE_URL=http://cb-tumblebug:1323/tumblebug
      - TUMBLEBUG_USERNAME=default
      - TUMBLEBUG_PASSWORD=default
      - PYTHONUNBUFFERED=1
      - MCP_SERVER_HOST=0.0.0.0
      - MCP_SERVER_PORT=8000
      # Logging Configuration (INFO, DEBUG, WARNING, ERROR)
      - MCP_LOG_LEVEL=INFO

  # MC-Terrarium
  # Resource extensions (AWS-to-site VPN) for CB-Tumblebug using OpenTofu.
  # CSP credentials are managed by OpenBao (no more env_file injection).
  mc-terrarium:
    image: cloudbaristaorg/mc-terrarium:0.1.4
    container_name: mc-terrarium
    # build:
    #   context: ../mc-terrarium
    #   dockerfile: Dockerfile
    networks:
      - internal_network # Inter-service communication (OpenBao access)
      - external_network # CSP API calls (requires internet access)
    ports:
      - target: 8055
        published: 8055
        protocol: tcp
    # [Legacy] CSP credentials via env_file — replaced by OpenBao centralized credential management.
    # Credentials are now read from OpenBao at runtime via the vault provider.
    # env_file:
    #   - ${HOME}/.cloud-barista/secrets/credentials             # AWS credential
    #   - ${HOME}/.cloud-barista/secrets/credential-azure.env    # Azure credential
    #   - ${HOME}/.cloud-barista/secrets/credential-alibaba.env  # Alibaba credential
    #   - ${HOME}/.cloud-barista/secrets/credential-tencent.env  # Tencent credential
    #   - ${HOME}/.cloud-barista/secrets/credential-ibm.env      # IBM credential
    #   - ${HOME}/.cloud-barista/secrets/credential-ncp.env      # NCP credential
    volumes:
      # [Legacy] GCP credential file mount — replaced by OpenBao.
      # - ${HOME}/.cloud-barista/secrets/credential-gcp.json:/app/secrets/credential-gcp.json:ro
      - ./container-volume/mc-terrarium-container/.terrarium:/app/.terrarium
      - /etc/ssl/certs:/etc/ssl/certs:ro
    environment:
      - TERRARIUM_ROOT=/app
      # - TERRARIUM_SELF_ENDPOINT=localhost:8055
      # - TERRARIUM_API_ALLOW_ORIGINS=*
      # - TERRARIUM_API_AUTH_ENABLED=true
      - TERRARIUM_API_USERNAME=${TERRARIUM_API_USERNAME:?Please set TERRARIUM_API_USERNAME}
      - TERRARIUM_API_PASSWORD=${TERRARIUM_API_PASSWORD:?Please set TERRARIUM_API_PASSWORD}
      # - TERRARIUM_LOGFILE_PATH=log/terrarium.log
      # - TERRARIUM_LOGFILE_MAXSIZE=1000
      # - TERRARIUM_LOGFILE_MAXBACKUPS=3
      # - TERRARIUM_LOGFILE_MAXAGE=30
      # - TERRARIUM_LOGFILE_COMPRESS=false
      - TERRARIUM_LOGLEVEL=info
      # - TERRARIUM_LOGWRITER=both
      # - TERRARIUM_NODE_ENV=production
      #
      # Note: OpenBao does not have its own OpenTofu/Terraform provider yet.
      # The only available option is the hashicorp/vault provider, which
      # exclusively reads VAULT_ADDR and VAULT_TOKEN from env vars.
      # See: https://registry.terraform.io/providers/hashicorp/vault/latest/docs#token
      - VAULT_ADDR=http://openbao:8200
      - VAULT_TOKEN=${VAULT_TOKEN:-}
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://localhost:8055/terrarium/readyz"]
      interval: 10m
      timeout: 5s
      retries: 3
      start_period: 10s
    depends_on:
      openbao:
        condition: service_healthy
    restart: unless-stopped

  # OpenBao (secrets management)
  # OpenBao securely stores and provides CSP credentials via API.
  #
  # [Persistent mode] (default)
  #   - File-based storage — secrets survive restarts
  #   - Requires one-time initialization + unseal after every restart
  #   - First run:  ./init/openbao/openbao-init.sh (or make init-openbao)
  #   - After restart: ./init/openbao/openbao-unseal.sh (or make unseal)
  #
  # [Dev mode]
  #   - In-memory storage — secrets are LOST on container restart
  #   - Auto-initialized, auto-unsealed, root token set by BAO_DEV_ROOT_TOKEN_ID
  #   - To switch: see "Switching to dev mode" comments below
  openbao:
    image: openbao/openbao:2.5.1
    container_name: openbao
    cap_add:
      - IPC_LOCK
    networks:
      - internal_network # Inter-service communication (terrarium connects here)
      - external_network # Host port exposure (for CLI/API access from host)
    ports:
      - target: 8200
        published: 8200
        protocol: tcp

    # Persistent mode (active)
    environment:
      - BAO_ADDR=http://0.0.0.0:8200 # BAO_ADDR is for binding listener inside container
      - SKIP_SETCAP=true
    # Fix bind-mount ownership (host UID 1000 → container openbao UID 100)
    entrypoint: ["sh", "-c"]
    command:
      - |
        chown -R openbao:openbao /openbao/data || { echo "ERROR: chown failed on /openbao/data"; exit 1; }
        exec docker-entrypoint.sh server -config=/openbao/config/openbao-config.hcl
    volumes:
      - ./container-volume/openbao-data:/openbao/data
      - ./init/openbao/openbao-config.hcl:/openbao/config/openbao-config.hcl:ro

    # Dev mode (inactive)
    # To switch to dev mode:
    #   1. Comment out the "Persistent mode" environment, command, and volumes above
    #   2. Uncomment the "Dev mode" environment and command below
    #   3. Run: docker compose up -d
    #   (No init/unseal needed — dev mode is auto-initialized and auto-unsealed)
    #
    # environment:
    #   - BAO_ADDR=http://0.0.0.0:8200
    #   - BAO_DEV_ROOT_TOKEN_ID=${VAULT_TOKEN:-root-token}
    # command: server -dev

    healthcheck:
      # 'bao status' exit codes:
      #   0 = unsealed, 1 = sealed but running, 2 = uninitialized (first run)
      # All three mean the OpenBao process is up and accepting API calls.
      test: ["CMD", "sh", "-c", "rc=0; bao status || rc=$$?; [ $$rc -le 2 ]"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped

  # # Swagger UI
  # swagger-ui:
  #   image: swaggerapi/swagger-ui
  #   container_name: swagger-ui
  #   networks:
  #     - external_network
  #   ports:
  #     - 1325:8080
  #   volumes:
  #     # cb-tumblebug swagger.yaml mount
  #     - ./src/interface/rest/docs/swagger.yaml:/swagger.yaml
  #   environment:
  #     # Options: https://github.com/swagger-api/swagger-ui/blob/37b8c1a8b67200dd425216ab8f97b725a429a5c0/docs/usage/configuration.md#docker
  #     - SWAGGER_JSON=/swagger.yaml
  #     - QUERY_CONFIG_ENABLED=true
  #   logging:
  #     # Disable logging
  #     driver: "none"
  #   healthcheck:
  #     test: [ "CMD", "curl", "-f", "localhost", "1325"]
  #     timeout: 5s
  #     retries: 3
  #     start_period: 3s

  # # cb-tumblebug-etcd-conf
  # cb-tumblebug-etcd-conf:
  #   image: alpine:latest
  #   container_name: cb-tumblebug-etcd-conf
  #   networks:
  #     - internal_network
  #     - external_network
  #   depends_on:
  #     - cb-tumblebug-etcd
  #   volumes:
  #     - ./scripts/etcd/:/scripts/etcd/
  #   environment:
  #     - ETCD_VERSION_TAG=v3.5.14
  #     - ETCD_ENDPOINTS=http://cb-tumblebug-etcd:2379
  #     - ETCD_PATH=/tmp/etcd-download-test
  #     - ETCD_AUTH_ENABLED=true
  #     - ETCD_ROOT_PASSWORD=default
  #     - ETCD_ADMIN_USERNAME=default
  #     - ETCD_ADMIN_PASSWORD=default
  #   command: sh -c "sh /scripts/etcd/etcd-conf.sh"
  #   healthcheck: # for etcd-conf
  #     test: ["CMD", "test", "-f", "/tmp/healthcheck"]
  #     interval: 30s
  #     timeout: 10s
  #     retries: 3
  #     start_period: 10s

  # CB-Tumblebug Metabase Dashboard for PostgreSQL
  # Enable this service to manage the PostgreSQL database of CB-Tumblebug.
  cb-tumblebug-metabase:
    image: metabase/metabase:latest
    container_name: cb-tumblebug-metabase
    restart: always
    attach: false # Exclude from docker compose up foreground output
    networks:
      - internal_network
      - external_network
    ports:
      - 3000:3000
    environment:
      # - MB_DB_TYPE=postgres
      # - MB_DB_DBNAME=tumblebug
      # - MB_DB_PORT=5432
      # - MB_DB_USER=tumblebug
      # - MB_DB_PASS=tumblebug
      # - MB_DB_HOST=cb-tumblebug-postgres
      - MB_ADMIN_EMAIL=admin1@your.org
      - MB_ADMIN_PASSWORD=admin1@your.org
      - MB_ADMIN_FIRST_NAME=Cloud
      - MB_ADMIN_LAST_NAME=Barista
      - MB_SITE_NAME=CB-Tumblebug Analytics
      - MB_SITE_LOCALE=en
      - JAVA_TIMEZONE=Asia/Seoul
      - MB_JETTY_REQUEST_LOGS_ENABLED=false
      - MB_JETTY_ALLOWED_HOSTS=localhost
      - MB_LOGGER_LEVEL=OFF
      - MB_LOGGING_LEVEL=OFF
      - MB_EMOJI_IN_LOGS=false
      # Query result limits for large datasets (400k+ records)
      - MB_UNAGGREGATED_QUERY_ROW_LIMIT=10000
      - MB_AGGREGATED_QUERY_ROW_LIMIT=10000
      # Performance optimization for large datasets
      - JAVA_OPTS=-Xmx2g -Xms1g -XX:+UseG1GC
      - MB_ASYNC_QUERY_THREAD_POOL_SIZE=50
      - MB_QUERY_CACHING_ENABLED=true
    volumes:
      - ./container-volume/cb-tumblebug-container/meta_db/metabase-data:/metabase-data
    depends_on:
      cb-tumblebug-postgres:
        condition: service_healthy
    user: "0:0"
    logging:
      driver: "none"

  # Metabase Auto-Configuration Service
  cb-tumblebug-metabase-init:
    image: alpine:latest
    container_name: cb-tumblebug-metabase-init
    networks:
      - internal_network
      - external_network
    depends_on:
      cb-tumblebug-metabase:
        condition: service_started
      cb-tumblebug-postgres:
        condition: service_healthy
    volumes:
      - ./init/initMetabase.sh:/scripts/initMetabase.sh:ro
      - ./container-volume/cb-tumblebug-container/meta_db/metabase-init-marker:/marker
    environment:
      - METABASE_URL=http://cb-tumblebug-metabase:3000
      - POSTGRES_HOST=cb-tumblebug-postgres
      - POSTGRES_PORT=5432
      - POSTGRES_DB=tumblebug
      - POSTGRES_DATABASE=tumblebug
      - POSTGRES_USER=tumblebug
      - POSTGRES_PASSWORD=tumblebug
      - ADMIN_EMAIL=admin1@your.org
      - ADMIN_PASSWORD=admin1@your.org
    command: |
      sh -c "
        apk add --no-cache curl jq >/dev/null 2>&1
        sleep 5  # Wait for services to stabilize

        # Skip if already initialized
        if [ -f /marker/init-completed ]; then
          echo '[Metabase] Already initialized, skipping.'
          exit 0
        fi

        # Retry init up to 3 times
        for i in 1 2 3; do
          echo \"[Metabase] Init attempt \$$i/3...\"
          sh /scripts/initMetabase.sh && {
            mkdir -p /marker && date > /marker/init-completed
            echo '[Metabase] Init completed.'
            exit 0
          }
          [ \$$i -lt 3 ] && sleep 30
        done

        echo '[Metabase] Init failed. Configure manually at http://localhost:3000'
        exit 1
      "
    restart: "no"
    # To re-init: sudo rm -rf container-volume/cb-tumblebug-container/meta_db/metabase-*

  # # CB-Tumblebug pgAdmin Dashboard for PostgreSQL
  # # Enable this service to manage the PostgreSQL database of CB-Tumblebug.
  # cb-tumblebug-pgadmin:
  #   image: dpage/pgadmin4:latest
  #   container_name: cb-tumblebug-pgadmin
  #   restart: always
  #   networks:
  #     - internal_network
  #     - external_network
  #   ports:
  #     - 5050:80
  #   volumes:
  #     - ./container-volume/cb-tumblebug-container/meta_db/pgadmin:/var/lib/pgadmin
  #   environment:
  #     - PGADMIN_DEFAULT_EMAIL=admin1@your.org
  #     - PGADMIN_DEFAULT_PASSWORD=tumblebug
  #     - PGADMIN_CONFIG_SERVER_MODE=True
  #     - PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED=False
  #     - PGADMIN_CONFIG_CONSOLE_LOG_LEVEL=40
  #     - PGADMIN_CONFIG_FILE_LOG_LEVEL=40
  #     - PGADMIN_CONFIG_ENHANCED_COOKIE_PROTECTION=False
  #     - PGADMIN_CONFIG_SESSION_EXPIRATION_TIME=1440
  #     - PGADMIN_CONFIG_ENABLE_PSQL=False
  #     - PGADMIN_CONFIG_ENABLE_CONSOLE_LOGGING=False
  #     - PGADMIN_CONFIG_ENABLE_FILE_LOGGING=False
  #     - PGADMIN_SERVER_JSON={"Servers":{"1":{"Name":"CB-Tumblebug PostgreSQL","Group":"Cloud-Barista","Host":"cb-tumblebug-postgres","Port":5432,"MaintenanceDB":"tumblebug","Username":"tumblebug","SSLMode":"prefer","Password":"tumblebug"}}}
  #   user: "0:0"
  #   depends_on:
  #     - cb-tumblebug-postgres
  #   logging:
  #     driver: "none"