services:
  clickhouse:
    image: clickhouse/clickhouse-server:24.8-alpine
    container_name: clickhouse
    restart: always
    environment:
      CLICKHOUSE_DB: analytics
      CLICKHOUSE_USER: analytics
      CLICKHOUSE_PASSWORD: ${CH_PASSWORD}
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    volumes:
      - clickhouse_data:/var/lib/clickhouse
      - ./clickhouse/schema.sql:/docker-entrypoint-initdb.d/01_schema.sql:ro
    networks:
      - coolify
    ports:
      # HTTP solo en localhost del VPS (no publico). Ingesta del PC via tunel SSH.
      # Grafana usa el nativo 9000 por la red coolify (no expuesto).
      - "127.0.0.1:8123:8123"
    deploy:
      resources:
        limits:
          memory: 2g

  grafana:
    image: grafana/grafana:11.2.0
    container_name: grafana
    restart: always
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: ${GF_PASSWORD}
      GF_INSTALL_PLUGINS: grafana-clickhouse-datasource
      GF_SERVER_ROOT_URL: https://grafana.datardos.com
      GF_USERS_ALLOW_SIGN_UP: "false"
      CH_PASSWORD: ${CH_PASSWORD}
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
    networks:
      - coolify
    labels:
      traefik.enable: "true"
      traefik.docker.network: coolify
      traefik.http.routers.grafana.entrypoints: https
      traefik.http.routers.grafana.rule: Host(`grafana.datardos.com`)
      traefik.http.routers.grafana.tls: "true"
      traefik.http.routers.grafana.tls.certresolver: letsencrypt
      traefik.http.services.grafana.loadbalancer.server.port: "3000"

volumes:
  clickhouse_data:
  grafana_data:

networks:
  coolify:
    external: true