services:
  traefik:
    image: traefik:v3.0
    container_name: taas-traefik
    restart: unless-stopped
    command:
      - "--configFile=/traefik/traefik.yml"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"  # Traefik dashboard
    volumes:
      - ./traefik:/traefik
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      JWT_SECRET: "${JWT_SECRET:-change-me-in-production-jwt-secret-32-chars-min}"
    networks:
      - taas-network
    depends_on:
      - api-server
      - charging-engine
      - carrier-connector

  mongodb:
    image: mongo:7.0
    container_name: taas-mongodb
    restart: unless-stopped
    ports:
      - "27017:27017"
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: changeme
      MONGO_INITDB_DATABASE: free5gc
    volumes:
      - mongodb_data:/data/db
    networks:
      - taas-network

  redis:
    image: redis:9-alpine
    container_name: taas-redis
    restart: unless-stopped
    ports:
      - "6379:6379"
    command: redis-server --maxmemory 2gb --maxmemory-policy allkeys-lru
    volumes:
      - redis_data:/data
    networks:
      - taas-network

  db:
    image: mongo:5.0
    container_name: free5gc-mongo
    restart: unless-stopped
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: free5gc
    volumes:
      - free5gc_dbdata:/data/db
    networks:
      - taas-network

  free5gc-nrf:
    container_name: nrf
    image: free5gc/nrf:v4.2.1
    command: ./nrf -c ./config/nrfcfg.yaml
    expose:
      - "8000"
    volumes:
      - ./deployments/free5gc/config:/free5gc/config
    environment:
      GIN_MODE: release
    networks:
      - taas-network
    depends_on:
      - db

  free5gc-amf:
    container_name: amf
    image: free5gc/amf:v4.2.1
    command: ./amf -c ./config/amfcfg.yaml
    expose:
      - "8000"
    volumes:
      - ./deployments/free5gc/config:/free5gc/config
    environment:
      GIN_MODE: release
    networks:
      - taas-network
    depends_on:
      - db
      - free5gc-nrf

  free5gc-smf:
    container_name: smf
    image: free5gc/smf:v4.2.1
    command: ./smf -c ./config/smfcfg.yaml
    expose:
      - "8000"
    volumes:
      - ./deployments/free5gc/config:/free5gc/config
    environment:
      GIN_MODE: release
    networks:
      - taas-network
    depends_on:
      - db
      - free5gc-nrf

  free5gc-upf:
    container_name: upf
    image: free5gc/upf:v4.2.1
    command: bash -c "./upf-iptables.sh && ./upf -c ./config/upfcfg.yaml"
    volumes:
      - ./deployments/free5gc/config:/free5gc/config
      - ./deployments/free5gc/upf-iptables.sh:/free5gc/upf-iptables.sh
    cap_add:
      - NET_ADMIN
    networks:
      - taas-network
    depends_on:
      - free5gc-smf

  free5gc-udr:
    container_name: udr
    image: free5gc/udr:v4.2.1
    command: ./udr -c ./config/udrcfg.yaml
    expose:
      - "8000"
    volumes:
      - ./deployments/free5gc/config:/free5gc/config
    environment:
      GIN_MODE: release
    networks:
      - taas-network
    depends_on:
      - db
      - free5gc-nrf

  free5gc-udm:
    container_name: udm
    image: free5gc/udm:v4.2.1
    command: ./udm -c ./config/udmcfg.yaml
    expose:
      - "8000"
    volumes:
      - ./deployments/free5gc/config:/free5gc/config
    environment:
      GIN_MODE: release
    networks:
      - taas-network
    depends_on:
      - db
      - free5gc-nrf

  free5gc-ausf:
    container_name: ausf
    image: free5gc/ausf:v4.2.1
    command: ./ausf -c ./config/ausfcfg.yaml
    expose:
      - "8000"
    volumes:
      - ./deployments/free5gc/config:/free5gc/config
    environment:
      GIN_MODE: release
    networks:
      - taas-network
    depends_on:
      - db
      - free5gc-nrf

  free5gc-nssf:
    container_name: nssf
    image: free5gc/nssf:v4.2.1
    command: ./nssf -c ./config/nssfcfg.yaml
    expose:
      - "8000"
    volumes:
      - ./deployments/free5gc/config:/free5gc/config
    environment:
      GIN_MODE: release
    networks:
      - taas-network
    depends_on:
      - db
      - free5gc-nrf

  free5gc-pcf:
    container_name: pcf
    image: free5gc/pcf:v4.2.1
    command: ./pcf -c ./config/pcfcfg.yaml
    expose:
      - "8000"
    volumes:
      - ./deployments/free5gc/config:/free5gc/config
    environment:
      GIN_MODE: release
    networks:
      - taas-network
    depends_on:
      - db
      - free5gc-nrf

  api-server:
    build:
      context: .
      dockerfile: deployments/docker/api-server.Dockerfile
    container_name: taas-api-server
    restart: unless-stopped
    expose:
      - "8000"
    environment:
      MONGODB_URI: mongodb://admin:changeme@mongodb:27017/free5gc
      REDIS_URI: redis://redis:6379
      API_PORT: 8000
      GIN_MODE: release
    depends_on:
      - mongodb
      - redis
    networks:
      - taas-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api-server.rule=Host(`api.telecom.com`) && PathPrefix(`/api/v1`)"
      - "traefik.http.routers.api-server.entrypoints=websecure"
      - "traefik.http.routers.api-server.tls=true"
      - "traefik.http.routers.api-server.middlewares=api-ratelimit,secure-headers,compression"
      - "traefik.http.services.api-server.loadbalancer.server.port=8000"
      - "traefik.http.routers.api-server-docs.rule=Host(`api.telecom.com`) && Path(`/api/v1/swagger`) || Path(`/api/v1/swagger/*`)"
      - "traefik.http.routers.api-server-docs.entrypoints=websecure"
      - "traefik.http.routers.api-server-docs.tls=true"
      - "traefik.http.routers.api-server-docs.middlewares=secure-headers,compression"

  carrier-connector:
    build:
      context: .
      dockerfile: deployments/docker/carrier-connector.Dockerfile
    container_name: taas-carrier-connector
    restart: unless-stopped
    expose:
      - "8081"
    environment:
      SMDP_URL: https://smdp.example.com
      SMDP_API_KEY: your-api-key
    networks:
      - taas-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.carrier-connector.rule=Host(`api.telecom.com`) && PathPrefix(`/v1/es2`) || PathPrefix(`/v1/carrier`)"
      - "traefik.http.routers.carrier-connector.entrypoints=websecure"
      - "traefik.http.routers.carrier-connector.tls=true"
      - "traefik.http.routers.carrier-connector.middlewares=carrier-ratelimit,secure-headers,compression,retry-attempts"
      - "traefik.http.services.carrier-connector.loadbalancer.server.port=8081"

  charging-engine:
    build:
      context: .
      dockerfile: deployments/docker/charging-engine.Dockerfile
    container_name: taas-charging-engine
    restart: unless-stopped
    expose:
      - "8080"
    environment:
      REDIS_URI: redis://redis:6379
      SERVER_PORT: 8080
      RUST_LOG: info
    depends_on:
      - redis
    networks:
      - taas-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.charging-engine.rule=Host(`api.telecom.com`) && PathPrefix(`/v1/credit`) || PathPrefix(`/v1/usage`) || PathPrefix(`/v1/rating-plans`)"
      - "traefik.http.routers.charging-engine.entrypoints=websecure"
      - "traefik.http.routers.charging-engine.tls=true"
      - "traefik.http.routers.charging-engine.middlewares=charging-ratelimit,secure-headers,compression,retry-attempts"
      - "traefik.http.services.charging-engine.loadbalancer.server.port=8080"
      - "traefik.http.routers.charging-engine-health.rule=Host(`api.telecom.com`) && Path(`/v1/health`)"
      - "traefik.http.routers.charging-engine-health.entrypoints=websecure"
      - "traefik.http.routers.charging-engine-health.tls=true"
      - "traefik.http.routers.charging-engine-health.middlewares=secure-headers"

  packet-gateway:
    build:
      context: .
      dockerfile: deployments/docker/packet-gateway.Dockerfile
    container_name: taas-packet-gateway
    restart: unless-stopped
    expose:
      - "8083"
    environment:
      REDIS_URL: redis://redis:6379
      CHARGING_ENGINE_URL: http://charging-engine:8080
      HEALTH_PORT: 8083
    depends_on:
      - redis
      - charging-engine
    networks:
      - taas-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.packet-gateway.rule=Host(`api.telecom.com`) && PathPrefix(`/v1/packet`) || PathPrefix(`/v1/gateway`)"
      - "traefik.http.routers.packet-gateway.entrypoints=websecure"
      - "traefik.http.routers.packet-gateway.tls=true"
      - "traefik.http.routers.packet-gateway.middlewares=charging-ratelimit,secure-headers,compression,retry-attempts"
      - "traefik.http.services.packet-gateway.loadbalancer.server.port=8083"
      - "traefik.http.routers.packet-gateway-health.rule=Host(`api.telecom.com`) && Path(`/health`)"
      - "traefik.http.routers.packet-gateway-health.entrypoints=websecure"
      - "traefik.http.routers.packet-gateway-health.tls=true"
      - "traefik.http.routers.packet-gateway-health.middlewares=secure-headers"

  web-dashboard:
    build:
      context: .
      dockerfile: deployments/docker/web-dashboard.Dockerfile
    container_name: taas-web-dashboard
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      NEXT_PUBLIC_API_URL: https://api.telecom.com
    depends_on:
      - api-server
    networks:
      - taas-network

volumes:
  mongodb_data:
    driver: local
  redis_data:
    driver: local
  free5gc_dbdata:
    driver: local

networks:
  taas-network:
    driver: bridge