docker-compose.yml

services:
  postgres:
    image: pgvector/pgvector:pg15
    container_name: template-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: application
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    ports:
      - "5436:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init-scripts:/docker-entrypoint-initdb.d
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d application"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  minio:
    image: minio/minio:latest
    container_name: template-minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    ports:
      - "9002:9000"
      - "9003:9001"
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  minio-init:
    image: minio/mc:latest
    container_name: template-minio-init
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set local http://minio:9000 minioadmin minioadmin;
      mc mb local/uploads --ignore-existing;
      mc anonymous set download local/uploads;
      exit 0;
      "

  mailhog:
    image: mailhog/mailhog:latest
    platform: linux/amd64
    container_name: template-mailhog
    restart: unless-stopped
    ports:
      - "1025:1025"
      - "8025:8025"
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:8025 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s

  # OPT-IN: behind the `langfuse` Compose profile, so `./gradlew devUp` stays lean.
  # Bring it up with `./gradlew devUpLangfuse` (or `docker compose --profile langfuse up -d --wait`).
  # Only langfuse-web publishes a host port (3000); clickhouse/redis/postgres/minio stay internal
  # (no published ports → no clash with the app's MinIO on 9000/9001). The stack is fully
  # self-contained (its own langfuse-minio) so it never collides with the app's shared services.
  # The SALT / ENCRYPTION_KEY / NEXTAUTH_SECRET / *_PASSWORD below are LOCAL-DEV values —
  # regenerate them (e.g. `openssl rand -hex 32`) for any non-local deployment.
  # ───────────────────────────────────────────────────────────────────────────
  langfuse-postgres:
    image: postgres:16
    container_name: template-langfuse-postgres
    profiles: ["langfuse"]
    restart: unless-stopped
    environment:
      POSTGRES_DB: langfuse
      POSTGRES_USER: langfuse
      POSTGRES_PASSWORD: langfuse
    volumes:
      - langfuse_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U langfuse -d langfuse"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  langfuse-clickhouse:
    image: clickhouse/clickhouse-server:24.12
    container_name: template-langfuse-clickhouse
    profiles: ["langfuse"]
    restart: unless-stopped
    user: "101:101"
    environment:
      CLICKHOUSE_DB: default
      CLICKHOUSE_USER: clickhouse
      CLICKHOUSE_PASSWORD: clickhouse
    volumes:
      - langfuse_clickhouse_data:/var/lib/clickhouse
      - langfuse_clickhouse_logs:/var/log/clickhouse-server
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8123/ping || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s

  langfuse-redis:
    image: redis:7
    container_name: template-langfuse-redis
    profiles: ["langfuse"]
    restart: unless-stopped
    command: ["redis-server", "--requirepass", "langfuse"]
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "langfuse", "ping"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 5s

  # Dedicated blob storage for Langfuse (event/media uploads). Kept SEPARATE from the app's `minio`
  # so the langfuse profile is fully self-contained — it never collides with, or depends on, the
  # app's shared services (which may be owned by a different Compose project on the same machine).
  langfuse-minio:
    image: minio/minio:latest
    container_name: template-langfuse-minio
    profiles: ["langfuse"]
    restart: unless-stopped
    command: server /data
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    volumes:
      - langfuse_minio_data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  langfuse-minio-init:
    image: minio/mc:latest
    container_name: template-langfuse-minio-init
    profiles: ["langfuse"]
    depends_on:
      langfuse-minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set local http://langfuse-minio:9000 minioadmin minioadmin;
      mc mb local/langfuse --ignore-existing;
      exit 0;
      "

  langfuse-worker:
    image: langfuse/langfuse-worker:3
    container_name: template-langfuse-worker
    profiles: ["langfuse"]
    restart: unless-stopped
    depends_on:
      langfuse-postgres:
        condition: service_healthy
      langfuse-clickhouse:
        condition: service_healthy
      langfuse-redis:
        condition: service_healthy
      langfuse-minio:
        condition: service_healthy
      langfuse-minio-init:
        condition: service_completed_successfully
    environment:
      DATABASE_URL: postgresql://langfuse:langfuse@langfuse-postgres:5432/langfuse
      NEXTAUTH_URL: http://localhost:3000
      SALT: template-local-dev-salt
      ENCRYPTION_KEY: "3e3ca4d97022cad63b65b90ef4dd1cf5b4c287a948be075ff71fa6d62bf4bd27"
      TELEMETRY_ENABLED: "false"
      CLICKHOUSE_MIGRATION_URL: clickhouse://langfuse-clickhouse:9000
      CLICKHOUSE_URL: http://langfuse-clickhouse:8123
      CLICKHOUSE_USER: clickhouse
      CLICKHOUSE_PASSWORD: clickhouse
      CLICKHOUSE_CLUSTER_ENABLED: "false"
      REDIS_HOST: langfuse-redis
      REDIS_PORT: "6379"
      REDIS_AUTH: langfuse
      LANGFUSE_S3_EVENT_UPLOAD_BUCKET: langfuse
      LANGFUSE_S3_EVENT_UPLOAD_REGION: us-east-1
      LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT: http://langfuse-minio:9000
      LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID: minioadmin
      LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY: minioadmin
      LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE: "true"
      LANGFUSE_S3_EVENT_UPLOAD_PREFIX: events/

  langfuse-web:
    image: langfuse/langfuse:3
    container_name: template-langfuse-web
    profiles: ["langfuse"]
    restart: unless-stopped
    depends_on:
      langfuse-postgres:
        condition: service_healthy
      langfuse-clickhouse:
        condition: service_healthy
      langfuse-redis:
        condition: service_healthy
      langfuse-minio:
        condition: service_healthy
      langfuse-minio-init:
        condition: service_completed_successfully
    ports:
      - "3000:3000"
    environment:
      DATABASE_URL: postgresql://langfuse:langfuse@langfuse-postgres:5432/langfuse
      NEXTAUTH_URL: http://localhost:3000
      NEXTAUTH_SECRET: template-local-dev-nextauth-secret
      SALT: template-local-dev-salt
      ENCRYPTION_KEY: "3e3ca4d97022cad63b65b90ef4dd1cf5b4c287a948be075ff71fa6d62bf4bd27"
      TELEMETRY_ENABLED: "false"
      CLICKHOUSE_MIGRATION_URL: clickhouse://langfuse-clickhouse:9000
      CLICKHOUSE_URL: http://langfuse-clickhouse:8123
      CLICKHOUSE_USER: clickhouse
      CLICKHOUSE_PASSWORD: clickhouse
      CLICKHOUSE_CLUSTER_ENABLED: "false"
      REDIS_HOST: langfuse-redis
      REDIS_PORT: "6379"
      REDIS_AUTH: langfuse
      LANGFUSE_S3_EVENT_UPLOAD_BUCKET: langfuse
      LANGFUSE_S3_EVENT_UPLOAD_REGION: us-east-1
      LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT: http://langfuse-minio:9000
      LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID: minioadmin
      LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY: minioadmin
      LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE: "true"
      LANGFUSE_S3_EVENT_UPLOAD_PREFIX: events/
      # Headless init — pins the org/project/API keys + 90-day retention on first boot.
      # The same keys go in the app .env (LANGFUSE_PUBLIC_KEY/SECRET_KEY) → no manual UI step.
      LANGFUSE_INIT_ORG_ID: template
      LANGFUSE_INIT_ORG_NAME: Template
      LANGFUSE_INIT_PROJECT_ID: template-dev
      LANGFUSE_INIT_PROJECT_NAME: Template Dev
      LANGFUSE_INIT_PROJECT_PUBLIC_KEY: pk-lf-local-dev
      LANGFUSE_INIT_PROJECT_SECRET_KEY: sk-lf-local-dev
      LANGFUSE_INIT_PROJECT_RETENTION: "90"
      LANGFUSE_INIT_USER_EMAIL: dev@example.com
      LANGFUSE_INIT_USER_NAME: Dev
      LANGFUSE_INIT_USER_PASSWORD: langfuse-dev-password

volumes:
  langfuse_postgres_data:
  langfuse_clickhouse_data:
  langfuse_clickhouse_logs:
  langfuse_minio_data:
  postgres_data:
    driver: local
  minio_data:
    driver: local