docker-compose.yml

networks:
  sovereign-net-frontend:
    driver: bridge
  sovereign-net-backend:
    driver: bridge
  sovereign-net-ai:
    driver: bridge

volumes:
  sovereign-vol-redpanda:
  sovereign-vol-postgres:
  sovereign-vol-redis:
  sovereign-vol-frontend-node-modules:

services:
  # --- Ingestion & Streaming ---
  sovereign-redpanda:
    image: docker.redpanda.com/redpandadata/redpanda:latest
    container_name: sovereign-redpanda
    command:
      - redpanda
      - start
      - --smp 1
      - --memory 1G
      - --reserve-memory 0M
      - --overprovisioned
      - --node-id 0
      - --check=false
      - --kafka-addr internal://0.0.0.0:9092,external://0.0.0.0:19092
      # Advertise internal for backend, external for host access if needed
      - --advertise-kafka-addr internal://sovereign-redpanda:9092,external://localhost:29092
      - --pandaproxy-addr internal://0.0.0.0:8082,external://0.0.0.0:18082
      - --advertise-pandaproxy-addr internal://sovereign-redpanda:8082,external://localhost:28082
      - --schema-registry-addr internal://0.0.0.0:8081,external://0.0.0.0:18081
    volumes:
      - sovereign-vol-redpanda:/var/lib/redpanda/data
    networks:
      - sovereign-net-backend
    healthcheck:
      test: [ "CMD-SHELL", "rpk cluster health" ]
      interval: 10s
      timeout: 5s
      retries: 5

  # --- Ingestion: Maritime AIS (via Python Poller with Dynamic Area Management) ---
  sovereign-ais-poller:
    build:
      context: ./backend/ingestion/maritime_poller
      dockerfile: Dockerfile
    container_name: sovereign-ais-poller
    environment:
      - AISSTREAM_API_KEY=${AISSTREAM_API_KEY}
      - KAFKA_BROKERS=sovereign-redpanda:9092
      - REDIS_HOST=sovereign-redis
      - REDIS_PORT=6379
      - CENTER_LAT=${CENTER_LAT:-45.5152}
      - CENTER_LON=${CENTER_LON:--122.6784}
      - COVERAGE_RADIUS_NM=${COVERAGE_RADIUS_NM:-150}
      - ARBITRATION_CLEANUP_INTERVAL=${ARBITRATION_CLEANUP_INTERVAL:-30}
    networks:
      - sovereign-net-backend
    depends_on:
      sovereign-redpanda:
        condition: service_healthy
      sovereign-redis:
        condition: service_started
    restart: unless-stopped

  # --- Ingestion: Aviation ADS-B (via Python Poller) ---
  sovereign-adsb-poller:
    build:
      context: ./backend/ingestion/aviation_poller
      dockerfile: Dockerfile
    container_name: sovereign-adsb-poller
    environment:
      - KAFKA_BROKERS=sovereign-redpanda:9092
      - REDIS_URL=redis://sovereign-redis:6379
      - CENTER_LAT=${CENTER_LAT:-45.5152}
      - CENTER_LON=${CENTER_LON:--122.6784}
      - COVERAGE_RADIUS_NM=${COVERAGE_RADIUS_NM:-150}
      - OPENSKY_ENABLED=${OPENSKY_ENABLED:-false}
      - OPENSKY_CLIENT_ID=${OPENSKY_CLIENT_ID:-}
      - OPENSKY_CLIENT_SECRET=${OPENSKY_CLIENT_SECRET:-}
      - OPENSKY_RATE_LIMIT_PERIOD=${OPENSKY_RATE_LIMIT_PERIOD:-0}
      - OPENSKY_WATCHLIST_ENABLED=${OPENSKY_WATCHLIST_ENABLED:-false}
      - OPENSKY_WATCHLIST_AUTO_SEED=${OPENSKY_WATCHLIST_AUTO_SEED:-true}
      - OPENSKY_WATCHLIST_SEED_TYPES=${OPENSKY_WATCHLIST_SEED_TYPES:-military,government,drone}
      - OPENSKY_WATCHLIST_TTL_DAYS=${OPENSKY_WATCHLIST_TTL_DAYS:-7}
      - OPENSKY_WATCHLIST_BATCH_SIZE=${OPENSKY_WATCHLIST_BATCH_SIZE:-100}
    networks:
      - sovereign-net-backend
    depends_on:
      sovereign-redpanda:
        condition: service_healthy
      sovereign-redis:
        condition: service_started
    restart: unless-stopped

  # --- Ingestion: Space Domain (Orbital TLE + SatNOGS Spectrum + Space Weather) ---
  sovereign-space-pulse:
    build:
      context: ./backend/ingestion/space_pulse
      dockerfile: Dockerfile
    container_name: sovereign-space-pulse
    environment:
      - KAFKA_BROKERS=sovereign-redpanda:9092
      - REDIS_HOST=sovereign-redis
      - REDIS_PORT=6379
      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD:-password}@sovereign-timescaledb:5432/${POSTGRES_DB:-sovereign_watch}
      # UTC hour (0-23) at which Celestrak TLE refreshes are allowed to run.
      # Set to -1 to disable hour gating and fetch immediately when interval elapses.
      - SPACE_TLE_FETCH_HOUR=${SPACE_TLE_FETCH_HOUR:-${ORBITAL_TLE_FETCH_HOUR:-2}}
      # SatNOGS transmitter catalog refresh interval (hours)
      - SATNOGS_DB_INTERVAL_H=${SATNOGS_DB_INTERVAL_H:-24}
      # SatNOGS observation poll interval (hours)
      - SATNOGS_NETWORK_INTERVAL_H=${SATNOGS_NETWORK_INTERVAL_H:-1}
      # Aurora GeoJSON poll interval in seconds (default 300 = 5 min)
      - AURORA_INTERVAL_S=${AURORA_INTERVAL_S:-300}
      # Kp-index poll interval in seconds (default 900 = 15 min)
      - KP_INTERVAL_S=${KP_INTERVAL_S:-900}
    networks:
      - sovereign-net-backend
    depends_on:
      sovereign-redpanda:
        condition: service_healthy
      sovereign-redis:
        condition: service_started
      sovereign-timescaledb:
        condition: service_healthy
    restart: unless-stopped

  # --- Ingestion: Infrastructure (Cables, Outages, Datacenters, FCC Towers) ---
  sovereign-infra-poller:
    build:
      context: ./backend/ingestion/infra_poller
      dockerfile: Dockerfile
    container_name: sovereign-infra-poller
    environment:
      - REDIS_URL=redis://sovereign-redis:6379/0
      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD:-password}@sovereign-timescaledb:5432/${POSTGRES_DB:-sovereign_watch}
      # UTC hour (0-23) at which the weekly FCC tower sync is allowed to run.
      - POLL_FCC_START_HOUR=${POLL_FCC_START_HOUR:-3}
    networks:
      - sovereign-net-backend
    depends_on:
      sovereign-redis:
        condition: service_started
      sovereign-timescaledb:
        condition: service_healthy
    restart: unless-stopped

  # --- Ingestion: Geopolitical OSINT (via GDELT CSV Poller) ---
  sovereign-gdelt-pulse:
    build:
      context: ./backend/ingestion/gdelt_pulse
      dockerfile: Dockerfile
    container_name: sovereign-gdelt-pulse
    environment:
      - KAFKA_BROKERS=sovereign-redpanda:9092
      - POLL_INTERVAL=900
    networks:
      - sovereign-net-backend
    depends_on:
      sovereign-redpanda:
        condition: service_healthy
    restart: unless-stopped

  # --- Ingestion: RF Infrastructure (Repeaters, NOAA NWR, Public Safety) ---
  sovereign-rf-pulse:
    build:
      context: ./backend/ingestion/rf_pulse
      dockerfile: Dockerfile
    container_name: sovereign-rf-pulse
    environment:
      - KAFKA_BROKERS=sovereign-redpanda:9092
      - REDIS_HOST=sovereign-redis
      - REDIS_PORT=6379
      - CENTER_LAT=${CENTER_LAT:-45.5152}
      - CENTER_LON=${CENTER_LON:--122.6784}
      - COVERAGE_RADIUS_NM=${COVERAGE_RADIUS_NM:-150}
      - RF_ARD_INTERVAL_H=${RF_ARD_INTERVAL_H:-24}
      - RF_NOAA_INTERVAL_H=${RF_NOAA_INTERVAL_H:-168}
      - RF_RADIOREF_INTERVAL_H=${RF_RADIOREF_INTERVAL_H:-168}
      - RADIOREF_APP_KEY=${RADIOREF_APP_KEY}
      - RADIOREF_USERNAME=${RADIOREF_USERNAME}
      - RADIOREF_PASSWORD=${RADIOREF_PASSWORD}
      # UTC hour (0-23) at which the weekly RadioReference SOAP fetch is allowed to run.
      # Set to -1 to disable (fetch immediately when interval elapses).
      - RF_RR_FETCH_HOUR=${RF_RR_FETCH_HOUR:-4}
    networks:
      - sovereign-net-backend
    depends_on:
      sovereign-redpanda:
        condition: service_healthy
      sovereign-redis:
        condition: service_started
    restart: unless-stopped

  # --- Persistence ---
  sovereign-timescaledb:
    image: timescale/timescaledb-ha:pg16
    container_name: sovereign-timescaledb
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-password}
      POSTGRES_DB: ${POSTGRES_DB:-sovereign_watch}
    volumes:
      - sovereign-vol-postgres:/home/postgres/pgdata/data
      - ./backend/db/init.sql:/docker-entrypoint-initdb.d/init.sql
    networks:
      - sovereign-net-backend
      - sovereign-net-ai
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U postgres" ]
      interval: 5s
      timeout: 5s
      retries: 5

  sovereign-redis:
    image: redis:alpine
    container_name: sovereign-redis
    command: redis-server --appendonly yes
    volumes:
      - sovereign-vol-redis:/data
    networks:
      - sovereign-net-backend
      - sovereign-net-ai
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 5s
      timeout: 3s
      retries: 5

  # --- Backend & AI ---
  sovereign-backend:
    build:
      context: ./backend/api
      dockerfile: Dockerfile
    container_name: sovereign-backend
    environment:
      - DB_DSN=postgresql://postgres:${POSTGRES_PASSWORD:-password}@sovereign-timescaledb:5432/${POSTGRES_DB:-sovereign_watch}
      - CENTER_LAT=${CENTER_LAT:-45.5152}
      - CENTER_LON=${CENTER_LON:--122.6784}
      - COVERAGE_RADIUS_NM=${COVERAGE_RADIUS_NM:-150}
      - AISSTREAM_API_KEY=${AISSTREAM_API_KEY}
      - RADIOREF_APP_KEY=${RADIOREF_APP_KEY}
      - RADIOREF_USERNAME=${RADIOREF_USERNAME}
      - RADIOREF_PASSWORD=${RADIOREF_PASSWORD}
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-http://localhost,http://127.0.0.1}
      - LITELLM_MODEL=${LITELLM_MODEL:-secure-core}
      - OPEN_API_BASE=${OPEN_API_BASE:-http://host.docker.internal:11434}
      - OPEN_API_KEY=${OPEN_API_KEY}
      - OPEN_API_MODEL=${OPEN_API_MODEL:-llama3}
      - OPEN_API_LABEL=${OPEN_API_LABEL:-Llama3}
      - GEMINI_API_KEY=${GEMINI_API_KEY}
      - GEMINI_MODEL=${GEMINI_MODEL}
      - GEMINI_LABEL=${GEMINI_LABEL}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - ANTHROPIC_MODEL=${ANTHROPIC_MODEL}
      - ANTHROPIC_LABEL=${ANTHROPIC_LABEL}
      - MODELS_YAML_PATH=/app/models.yaml
      - LITELLM_CONFIG_PATH=/app/litellm_config.yaml
    volumes:
      - ./backend/api:/app
      - ./backend/ai/models.yaml:/app/models.yaml:ro
      - ./backend/ai/litellm_config.yaml:/app/litellm_config.yaml:ro
    networks:
      - sovereign-net-backend
      - sovereign-net-ai
    depends_on:
      sovereign-timescaledb:
        condition: service_healthy

  # --- JS8Call Radio Terminal (Phase 1/2/3) ---
  # Headless JS8Call instance with virtual PulseAudio routing from a KiwiSDR node.
  # The FastAPI WebSocket bridge (server.py) runs inside this same container on
  # port 8080 and is accessed by the frontend RadioTerminal component.
  sovereign-js8call:
    build:
      context: ./js8call
      dockerfile: Dockerfile
    container_name: sovereign-js8call
    environment:
      # KiwiSDR WebSDR source – override with your target node
      - KIWI_HOST=${KIWI_HOST:-kiwisdr.example.com}
      - KIWI_PORT=${KIWI_PORT:-8073}
      - KIWI_FREQ=${KIWI_FREQ:-14078} # kHz – 20m JS8Call calling frequency
      - KIWI_MODE=${KIWI_MODE:-usb}
      # Operator Maidenhead grid for distance/bearing calculations
      - MY_GRID=${MY_GRID:-CN85}
      # JS8Call TCP API – internal to container
      - JS8CALL_HOST=127.0.0.1
      - JS8CALL_PORT=2442
      # FastAPI bridge port (exposed below)
      - BRIDGE_PORT=8080
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-http://localhost,http://127.0.0.1}
    networks:
      - sovereign-net-backend
    cap_add: []
    restart: unless-stopped
    healthcheck:
      test: [ "CMD-SHELL", "curl -sf http://localhost:8080/health || exit 1" ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

  # --- Frontend ---
  sovereign-frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    container_name: sovereign-frontend
    volumes:
      - ./frontend:/app
      - sovereign-vol-frontend-node-modules:/app/node_modules # Prevent host from overwriting container node_modules
    networks:
      - sovereign-net-frontend
      - sovereign-net-backend
    environment:
      - VITE_API_URL=${VITE_API_URL:-http://localhost}
      - VITE_ENABLE_MAPBOX=${VITE_ENABLE_MAPBOX:-true}
      - VITE_MAPBOX_TOKEN=${VITE_MAPBOX_TOKEN}
      - VITE_CENTER_LAT=${CENTER_LAT:-45.5152}
      - VITE_CENTER_LON=${CENTER_LON:--122.6784}
      - VITE_COVERAGE_RADIUS_NM=${COVERAGE_RADIUS_NM:-150}
      - VITE_ENABLE_3D_TERRAIN=${VITE_ENABLE_3D_TERRAIN:-false}
      - VITE_JS8_WS_URL=${VITE_JS8_WS_URL}
      - VITE_JS8_BASE_URL=${VITE_JS8_BASE_URL}

  # --- Nginx Reverse Proxy (single entry point) ---
  sovereign-nginx:
    image: nginx:alpine
    container_name: sovereign-nginx
    ports:
      - "80:80"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    networks:
      - sovereign-net-frontend
      - sovereign-net-backend
    depends_on:
      - sovereign-frontend
      - sovereign-backend
      - sovereign-js8call
    restart: unless-stopped