docker-compose.yml

services:
  # PostgreSQL database
  postgres:
    image: postgres:latest
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
      POSTGRES_DB: mlflowdb
    ports:
      - 5432:5432
    volumes:
      - ./postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d mlflowdb"]
      interval: 10s
      timeout: 5s
      retries: 5

  minio: 
    build: 
      context: ./minio 
      dockerfile: dockerfile
    restart: unless-stopped
    ports:
      - "9000:9000"
      # MinIO Console is available at http://localhost:9001
      - "9001:9001"
    volumes: 
      - ./minio/data:/minio/data
    environment:
      MINIO_ROOT_USER: "minio_user"
      MINIO_ROOT_PASSWORD: "minio_password"
    healthcheck:
      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/9000' || exit 1
      interval: 1s
      timeout: 10s
      retries: 5
    
  mlflow: 
    build: 
      context: ./mlflow
      dockerfile: dockerfile
    restart: unless-stopped
    depends_on: 
      minio: 
        condition: service_healthy
      postgres:
        condition: service_healthy
    # Port removed - only accessible through Caddy auth proxy
    # ports: 
    #   - 5000:5000
    environment: 
      DB_URL: "postgresql://user:password@postgres:5432/mlflowdb"
      MLFLOW_S3_ENDPOINT_URL: "http://minio:9000"
      AWS_ACCESS_KEY_ID: "minio_user"
      AWS_SECRET_ACCESS_KEY: "minio_password"
      HOST: "[::]"
      PORT: "5000"
  
  # Caddy reverse proxy with authentication
  caddy:
    build:
      context: ./caddy
      dockerfile: dockerfile
    restart: unless-stopped
    depends_on:
      mlflow:
        condition: service_started
    ports:
      - "8080:8080"  # Railway will handle SSL termination
    environment:
      # Railway will use this to determine service port
      PORT: 8080
      # Railway will provide these credentials, or use defaults for local dev
      AUTH_USERNAME: ${AUTH_USERNAME:-admin}
      AUTH_PASSWORD: ${AUTH_PASSWORD:-changeme}
      MLFLOW_URL: mlflow:5000
      MLFLOW_HOST: mlflow
      MLFLOW_PORT: 5000
      # Optional OAuth2 configuration (commented out by default)
      # OAUTH2_CLIENT_ID: ${OAUTH2_CLIENT_ID}
      # OAUTH2_CLIENT_SECRET: ${OAUTH2_CLIENT_SECRET}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3