bakery-ia/Tiltfile

# =============================================================================
# Bakery IA - Tiltfile for Secure Local Development
# =============================================================================
# Features:
#   - TLS encryption for PostgreSQL and Redis
#   - Strong 32-character passwords with PersistentVolumeClaims
#   - PostgreSQL pgcrypto extension and audit logging
#   - Organized resource dependencies and live-reload capabilities
#   - Local registry for faster image builds and deployments
#
# Build Optimization:
#   - Services only rebuild when their specific code changes (not all services)
#   - Shared folder changes trigger rebuild of ALL services (as they all depend on it)
#   - Uses 'only' parameter to watch only relevant files per service
#   - Frontend only rebuilds when frontend/ code changes
#   - Gateway only rebuilds when gateway/ or shared/ code changes
# =============================================================================


# =============================================================================
# TILT CONFIGURATION
# =============================================================================

# Update settings
update_settings(
    max_parallel_updates=2,  # Reduce parallel updates to avoid resource exhaustion
    k8s_upsert_timeout_secs=120  # Increase timeout for slower local builds
)

# Ensure we're running in the correct context
allow_k8s_contexts('kind-bakery-ia-local')

# =============================================================================
# DISK SPACE MANAGEMENT & CLEANUP CONFIGURATION
# =============================================================================

# Disk space management settings
disk_cleanup_enabled = True  # Default to True, can be disabled with TILT_DISABLE_CLEANUP=true
if 'TILT_DISABLE_CLEANUP' in os.environ:
    disk_cleanup_enabled = os.environ['TILT_DISABLE_CLEANUP'].lower() != 'true'

disk_space_threshold_gb = '10'
if 'TILT_DISK_THRESHOLD_GB' in os.environ:
    disk_space_threshold_gb = os.environ['TILT_DISK_THRESHOLD_GB']

disk_cleanup_frequency_minutes = '30'
if 'TILT_CLEANUP_FREQUENCY' in os.environ:
    disk_cleanup_frequency_minutes = os.environ['TILT_CLEANUP_FREQUENCY']

print("""
DISK SPACE MANAGEMENT CONFIGURATION
======================================
Cleanup Enabled: {}
Free Space Threshold: {}GB
Cleanup Frequency: Every {} minutes

To disable cleanup: export TILT_DISABLE_CLEANUP=true
To change threshold: export TILT_DISK_THRESHOLD_GB=20
To change frequency: export TILT_CLEANUP_FREQUENCY=60
""".format(
    'YES' if disk_cleanup_enabled else 'NO (TILT_DISABLE_CLEANUP=true)',
    disk_space_threshold_gb,
    disk_cleanup_frequency_minutes
))

# Automatic cleanup scheduler (informational only - actual scheduling done externally)
if disk_cleanup_enabled:
    local_resource(
        'automatic-disk-cleanup-info',
        cmd='''
            echo "Automatic disk cleanup is ENABLED"
            echo "Settings:"
            echo "  - Threshold: ''' + disk_space_threshold_gb + ''' GB free space"
            echo "  - Frequency: Every ''' + disk_cleanup_frequency_minutes + ''' minutes"
            echo ""
            echo "Note: Actual cleanup runs via external scheduling (cron job or similar)"
            echo "To run cleanup now: tilt trigger manual-disk-cleanup"
        ''',
        labels=['99-cleanup'],
        auto_init=True,
        allow_parallel=False
    )

# Manual cleanup trigger (can be run on demand)
local_resource(
    'manual-disk-cleanup',
    cmd='''
        echo "Starting manual disk cleanup..."
        python3 scripts/cleanup_disk_space.py --manual --verbose
    ''',
    labels=['99-cleanup'],
    auto_init=False,
    allow_parallel=False
)

# Disk space monitoring resource
local_resource(
    'disk-space-monitor',
    cmd='''
        echo "DISK SPACE MONITORING"
        echo "======================================"

        # Get disk usage
        df -h / | grep -v Filesystem | awk '{{print "Total: " $2 " | Used: " $3 " | Free: " $4 " | Usage: " $5}}'

        # Get Docker disk usage
        echo ""
        echo "DOCKER DISK USAGE:"
        docker system df

        # Get Kubernetes disk usage (if available)
        echo ""
        echo "KUBERNETES DISK USAGE:"
        kubectl get pvc -n bakery-ia --no-headers 2>/dev/null | awk '{{print "PVC: " $1 " | Status: " $2 " | Capacity: " $3 " | Used: " $4}}' || echo "  Kubernetes PVCs not available"

        echo ""
        echo "Cleanup Status:"
        if [ "{disk_cleanup_enabled}" = "True" ]; then
            echo "  Automatic cleanup: ENABLED (every {disk_cleanup_frequency_minutes} minutes)"
            echo "  Threshold: {disk_space_threshold_gb}GB free space"
        else
            echo "  Automatic cleanup: DISABLED"
            echo "  To enable: unset TILT_DISABLE_CLEANUP or set TILT_DISABLE_CLEANUP=false"
        fi

        echo ""
        echo "Manual cleanup commands:"
        echo "  tilt trigger manual-disk-cleanup  # Run cleanup now"
        echo "  docker system prune -a             # Manual Docker cleanup"
        echo "  kubectl delete jobs --all          # Clean up completed jobs"
    ''',
    labels=['99-cleanup'],
    auto_init=False,
    allow_parallel=False
)

# =============================================================================
# DOCKER REGISTRY CONFIGURATION
# =============================================================================

# Docker registry configuration
# Set USE_DOCKERHUB=true environment variable to push images to Docker Hub
# Otherwise, uses local registry for faster builds and deployments
use_dockerhub = False  # Default to False
if 'USE_DOCKERHUB' in os.environ:
    use_dockerhub = os.environ['USE_DOCKERHUB'].lower() == 'true'

dockerhub_username = 'uals'  # Default username
if 'DOCKERHUB_USERNAME' in os.environ:
    dockerhub_username = os.environ['DOCKERHUB_USERNAME']

if use_dockerhub:
    print("""
    DOCKER HUB MODE ENABLED
    Images will be pushed to Docker Hub: docker.io/%s
    Make sure you're logged in: docker login
    To disable: unset USE_DOCKERHUB or set USE_DOCKERHUB=false
    """ % dockerhub_username)
    default_registry('docker.io/%s' % dockerhub_username)
else:
    print("""
    LOCAL REGISTRY MODE
    Using local registry for faster builds: localhost:5001
    This registry is created by kubernetes_restart.sh script
    To use Docker Hub: export USE_DOCKERHUB=true
    """)
    default_registry('localhost:5001')

# =============================================================================
# SECURITY & INITIAL SETUP
# =============================================================================

print("""
======================================
Bakery IA Secure Development Mode
======================================

Security Features:
  TLS encryption for PostgreSQL and Redis
  Strong 32-character passwords
  PersistentVolumeClaims (no data loss)
  Column encryption: pgcrypto extension
  Audit logging: PostgreSQL query logging
  Object storage: MinIO with TLS for ML models

Monitoring:
  Service metrics available at /metrics endpoints
  Telemetry ready (traces, metrics, logs)
  SigNoz deployment optional for local dev (see signoz-info resource)

Applying security configurations...
""")

# Create Docker Hub secret for image pulls (if credentials are available)
local_resource(
    'dockerhub-secret',
    cmd='''
        echo "Setting up Docker Hub image pull secret..."

        # Check if Docker Hub credentials are available
        if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_PASSWORD" ]; then
            echo "  Found DOCKERHUB_USERNAME and DOCKERHUB_PASSWORD environment variables"
            ./infrastructure/kubernetes/create-dockerhub-secret.sh
        elif [ -f "$HOME/.docker/config.json" ]; then
            echo "  Attempting to use Docker CLI credentials..."
            ./infrastructure/kubernetes/create-dockerhub-secret.sh
        else
            echo "  Docker Hub credentials not found"
            echo "  To enable automatic Docker Hub authentication:"
            echo "    1. Run 'docker login', OR"
            echo "    2. Set environment variables:"
            echo "       export DOCKERHUB_USERNAME='your-username'"
            echo "       export DOCKERHUB_PASSWORD='your-password-or-token'"
            echo ""
            echo "  Continuing without Docker Hub authentication..."
            echo "  (This is OK for local development using local registry)"
        fi
    ''',
    labels=['00-security'],
    auto_init=True
)

# Apply security configurations before loading main manifests
local_resource(
    'security-setup',
    cmd='''
        echo "Applying security secrets and configurations..."
        kubectl apply -f infrastructure/kubernetes/base/secrets.yaml
        kubectl apply -f infrastructure/kubernetes/base/secrets/postgres-tls-secret.yaml
        kubectl apply -f infrastructure/kubernetes/base/secrets/redis-tls-secret.yaml
        kubectl apply -f infrastructure/kubernetes/base/configs/postgres-init-config.yaml
        kubectl apply -f infrastructure/kubernetes/base/configmaps/postgres-logging-config.yaml
        echo "Security configurations applied"
    ''',
    resource_deps=['dockerhub-secret'],
    labels=['00-security'],
    auto_init=True
)

# Verify TLS certificates are mounted correctly
local_resource(
    'verify-tls',
    cmd='''
        echo "Verifying TLS configuration..."
        sleep 5  # Wait for pods to be ready

        # Check if auth-db pod exists and has TLS certs
        AUTH_POD=$(kubectl get pods -n bakery-ia -l app.kubernetes.io/name=auth-db -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")

        if [ -n "$AUTH_POD" ]; then
            echo "  Checking PostgreSQL TLS certificates..."
            kubectl exec -n bakery-ia "$AUTH_POD" -- ls -la /tls/ 2>/dev/null && \
                echo "  PostgreSQL TLS certificates mounted" || \
                echo "  PostgreSQL TLS certificates not found (pods may still be starting)"
        fi

        # Check if redis pod exists and has TLS certs
        REDIS_POD=$(kubectl get pods -n bakery-ia -l app.kubernetes.io/name=redis -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")

        if [ -n "$REDIS_POD" ]; then
            echo "  Checking Redis TLS certificates..."
            kubectl exec -n bakery-ia "$REDIS_POD" -- ls -la /tls/ 2>/dev/null && \
                echo "  Redis TLS certificates mounted" || \
                echo "  Redis TLS certificates not found (pods may still be starting)"
        fi

        echo "TLS verification complete"
    ''',
    resource_deps=['auth-db', 'redis'],
    auto_init=True,
    labels=['00-security']
)

# Verify PVCs are bound
local_resource(
    'verify-pvcs',
    cmd='''
        echo "Verifying PersistentVolumeClaims..."
        kubectl get pvc -n bakery-ia | grep -E "NAME|db-pvc" || echo "  PVCs not yet bound"
        PVC_COUNT=$(kubectl get pvc -n bakery-ia -o json | jq '.items | length')
        echo "  Found $PVC_COUNT PVCs"
        echo "PVC verification complete"
    ''',
    resource_deps=['auth-db'],
    auto_init=True,
    labels=['00-security']
)

# Install and verify cert-manager
local_resource(
    'cert-manager-install',
    cmd='''
        echo "Installing cert-manager..."

        # Check if cert-manager CRDs already exist
        if kubectl get crd certificates.cert-manager.io >/dev/null 2>&1; then
            echo "  cert-manager CRDs already installed"
        else
            echo "  Installing cert-manager v1.13.2..."
            kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.2/cert-manager.yaml

            echo "  Waiting for cert-manager to be ready..."
            kubectl wait --for=condition=available --timeout=120s deployment/cert-manager -n cert-manager
            kubectl wait --for=condition=available --timeout=120s deployment/cert-manager-webhook -n cert-manager

            echo "  cert-manager installed and ready"
        fi

        echo "cert-manager verification complete"
    ''',
    labels=['00-security'],
    auto_init=True
)

# =============================================================================
# LOAD KUBERNETES MANIFESTS
# =============================================================================

k8s_yaml(kustomize('infrastructure/kubernetes/overlays/dev'))

# =============================================================================
# DOCKER BUILD HELPERS
# =============================================================================

# Helper function for Python services with live updates
# This function ensures services only rebuild when their specific code changes,
# but all services rebuild when shared/ folder changes
def build_python_service(service_name, service_path):
    docker_build(
        'bakery/' + service_name,
        context='.',
        dockerfile='./services/' + service_path + '/Dockerfile',
        # Only watch files relevant to this specific service + shared code
        only=[
            './services/' + service_path,
            './shared',
            './scripts',
        ],
        live_update=[
            # Fall back to full image build if Dockerfile or requirements change
            fall_back_on([
                './services/' + service_path + '/Dockerfile',
                './services/' + service_path + '/requirements.txt',
                './shared/requirements-tracing.txt',
            ]),

            # Sync service code
            sync('./services/' + service_path, '/app'),

            # Sync shared libraries
            sync('./shared', '/app/shared'),

            # Sync scripts
            sync('./scripts', '/app/scripts'),

            # Install new dependencies if requirements.txt changes
            run(
                'pip install --no-cache-dir -r requirements.txt',
                trigger=['./services/' + service_path + '/requirements.txt']
            ),

            # Restart uvicorn on Python file changes (HUP signal triggers graceful reload)
            run(
                'kill -HUP 1',
                trigger=[
                    './services/' + service_path + '/**/*.py',
                    './shared/**/*.py'
                ]
            ),
        ],
        # Ignore common patterns that don't require rebuilds
        ignore=[
            '.git',
            '**/__pycache__',
            '**/*.pyc',
            '**/.pytest_cache',
            '**/node_modules',
            '**/.DS_Store'
        ]
    )

# =============================================================================
# INFRASTRUCTURE IMAGES
# =============================================================================

# Frontend (React + Vite)
frontend_debug_env = 'false'  # Default to false
if 'FRONTEND_DEBUG' in os.environ:
    frontend_debug_env = os.environ['FRONTEND_DEBUG']
frontend_debug = frontend_debug_env.lower() == 'true'

if frontend_debug:
    print("""
    FRONTEND DEBUG MODE ENABLED
    Building frontend with NO minification for easier debugging.
    Full React error messages will be displayed.
    To disable: unset FRONTEND_DEBUG or set FRONTEND_DEBUG=false
    """)
else:
    print("""
    FRONTEND PRODUCTION MODE
    Building frontend with minification for optimized performance.
    To enable debug mode: export FRONTEND_DEBUG=true
    """)

docker_build(
    'bakery/dashboard',
    context='./frontend',
    dockerfile='./frontend/Dockerfile.kubernetes.debug' if frontend_debug else './frontend/Dockerfile.kubernetes',
    live_update=[
        sync('./frontend/src', '/app/src'),
        sync('./frontend/public', '/app/public'),
    ],
    build_args={
        'NODE_OPTIONS': '--max-old-space-size=8192'
    },
    ignore=[
        'playwright-report/**',
        'test-results/**',
        'node_modules/**',
        '.DS_Store'
    ]
)

# Gateway
docker_build(
    'bakery/gateway',
    context='.',
    dockerfile='./gateway/Dockerfile',
    # Only watch gateway-specific files and shared code
    only=[
        './gateway',
        './shared',
        './scripts',
    ],
    live_update=[
        fall_back_on([
            './gateway/Dockerfile',
            './gateway/requirements.txt',
            './shared/requirements-tracing.txt',
        ]),
        sync('./gateway', '/app'),
        sync('./shared', '/app/shared'),
        sync('./scripts', '/app/scripts'),
        run('kill -HUP 1', trigger=['./gateway/**/*.py', './shared/**/*.py']),
    ],
    ignore=[
        '.git',
        '**/__pycache__',
        '**/*.pyc',
        '**/.pytest_cache',
        '**/node_modules',
        '**/.DS_Store'
    ]
)

# =============================================================================
# MICROSERVICE IMAGES
# =============================================================================

# Core Services
build_python_service('auth-service', 'auth')
build_python_service('tenant-service', 'tenant')

# Data & Analytics Services
build_python_service('training-service', 'training')
build_python_service('forecasting-service', 'forecasting')
build_python_service('ai-insights-service', 'ai_insights')

# Operations Services
build_python_service('sales-service', 'sales')
build_python_service('inventory-service', 'inventory')
build_python_service('production-service', 'production')
build_python_service('procurement-service', 'procurement')
build_python_service('distribution-service', 'distribution')

# Supporting Services
build_python_service('recipes-service', 'recipes')
build_python_service('suppliers-service', 'suppliers')
build_python_service('pos-service', 'pos')
build_python_service('orders-service', 'orders')
build_python_service('external-service', 'external')

# Platform Services
build_python_service('notification-service', 'notification')
build_python_service('alert-processor', 'alert_processor')
build_python_service('orchestrator-service', 'orchestrator')

# Demo Services
build_python_service('demo-session-service', 'demo_session')

# Tell Tilt that demo-cleanup-worker uses the demo-session-service image
k8s_image_json_path(
    'bakery/demo-session-service',
    '{.spec.template.spec.containers[?(@.name=="worker")].image}',
    name='demo-cleanup-worker'
)

# =============================================================================
# INFRASTRUCTURE RESOURCES
# =============================================================================

# Redis & RabbitMQ
k8s_resource('redis', resource_deps=['security-setup'], labels=['01-infrastructure'])
k8s_resource('rabbitmq', labels=['01-infrastructure'])
k8s_resource('nominatim', labels=['01-infrastructure'])

# MinIO Storage
k8s_resource('minio', resource_deps=['security-setup'], labels=['01-infrastructure'])
k8s_resource('minio-bucket-init', resource_deps=['minio'], labels=['01-infrastructure'])

# =============================================================================
# MONITORING RESOURCES - SigNoz (Unified Observability)
# =============================================================================

# Deploy SigNoz using Helm with automatic deployment and progress tracking
local_resource(
    'signoz-deploy',
    cmd='''
        echo "Deploying SigNoz Monitoring Stack..."
        echo ""

        # Ensure Docker Hub secret exists in bakery-ia namespace
        echo "Ensuring Docker Hub secret exists in bakery-ia namespace..."
        if ! kubectl get secret dockerhub-creds -n bakery-ia &>/dev/null; then
            echo "  Docker Hub secret not found, attempting to create..."
            ./infrastructure/kubernetes/create-dockerhub-secret.sh || echo "  Continuing without Docker Hub authentication..."
        else
            echo "  Docker Hub secret exists"
        fi
        echo ""

        # Check if SigNoz is already deployed
        if helm list -n bakery-ia | grep -q signoz; then
            echo "SigNoz already deployed, checking status..."
            helm status signoz -n bakery-ia
        else
            echo "Installing SigNoz..."

            # Add SigNoz Helm repository if not already added
            helm repo add signoz https://charts.signoz.io 2>/dev/null || true
            helm repo update signoz

            # Install SigNoz with custom values in the bakery-ia namespace
            helm upgrade --install signoz signoz/signoz \
                -n bakery-ia \
                -f infrastructure/helm/signoz-values-dev.yaml \
                --timeout 10m \
                --wait

            echo ""
            echo "SigNoz deployment completed"
        fi

        echo ""
        echo "SigNoz Access Information:"
        echo "   URL: https://monitoring.bakery-ia.local"
        echo "   Username: admin"
        echo "   Password: admin"
        echo ""
        echo "OpenTelemetry Collector Endpoints:"
        echo "   gRPC: localhost:4317"
        echo "   HTTP: localhost:4318"
        echo ""
        echo "To check pod status: kubectl get pods -n signoz"
    ''',
    labels=['05-monitoring'],
    auto_init=False,
)

# Track SigNoz pods in Tilt UI using workload tracking
# These will automatically discover pods once SigNoz is deployed
local_resource(
    'signoz-status',
    cmd='''
        echo "SigNoz Status Check"
        echo ""

        # Check pod status
        echo "Current SigNoz pods:"
        kubectl get pods -n bakery-ia -l app.kubernetes.io/instance=signoz -o wide 2>/dev/null || echo "No pods found"

        echo ""
        echo "SigNoz Services:"
        kubectl get svc -n bakery-ia -l app.kubernetes.io/instance=signoz 2>/dev/null || echo "No services found"

        # Check if all pods are ready
        TOTAL_PODS=$(kubectl get pods -n bakery-ia -l app.kubernetes.io/instance=signoz --no-headers 2>/dev/null | wc -l | tr -d ' ')
        READY_PODS=$(kubectl get pods -n bakery-ia -l app.kubernetes.io/instance=signoz --field-selector=status.phase=Running --no-headers 2>/dev/null | wc -l | tr -d ' ')

        if [ "$TOTAL_PODS" -gt 0 ]; then
            echo ""
            echo "Pod Status: $READY_PODS/$TOTAL_PODS ready"

            if [ "$READY_PODS" -eq "$TOTAL_PODS" ]; then
                echo "All SigNoz pods are running!"
                echo ""
                echo "Access SigNoz at: https://monitoring.bakery-ia.local"
                echo "Credentials: admin / admin"
            else
                echo "Waiting for pods to become ready..."
            fi
        fi
    ''',
    labels=['05-monitoring'],
    auto_init=False,
)

# Optional exporters (in monitoring namespace) - DISABLED since using SigNoz
# k8s_resource('node-exporter', labels=['05-monitoring'])
# k8s_resource('postgres-exporter', resource_deps=['auth-db'], labels=['05-monitoring'])

# =============================================================================
# DATABASE RESOURCES
# =============================================================================

# Core Service Databases
k8s_resource('auth-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('tenant-db', resource_deps=['security-setup'], labels=['06-databases'])

# Data & Analytics Databases
k8s_resource('training-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('forecasting-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('ai-insights-db', resource_deps=['security-setup'], labels=['06-databases'])

# Operations Databases
k8s_resource('sales-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('inventory-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('production-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('procurement-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('distribution-db', resource_deps=['security-setup'], labels=['06-databases'])

# Supporting Service Databases
k8s_resource('recipes-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('suppliers-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('pos-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('orders-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('external-db', resource_deps=['security-setup'], labels=['06-databases'])

# Platform Service Databases
k8s_resource('notification-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('alert-processor-db', resource_deps=['security-setup'], labels=['06-databases'])
k8s_resource('orchestrator-db', resource_deps=['security-setup'], labels=['06-databases'])

# Demo Service Databases
k8s_resource('demo-session-db', resource_deps=['security-setup'], labels=['06-databases'])

# =============================================================================
# MIGRATION JOBS
# =============================================================================

# Core Service Migrations
k8s_resource('auth-migration', resource_deps=['auth-db'], labels=['07-migrations'])
k8s_resource('tenant-migration', resource_deps=['tenant-db'], labels=['07-migrations'])

# Data & Analytics Migrations
k8s_resource('training-migration', resource_deps=['training-db'], labels=['07-migrations'])
k8s_resource('forecasting-migration', resource_deps=['forecasting-db'], labels=['07-migrations'])
k8s_resource('ai-insights-migration', resource_deps=['ai-insights-db'], labels=['07-migrations'])

# Operations Migrations
k8s_resource('sales-migration', resource_deps=['sales-db'], labels=['07-migrations'])
k8s_resource('inventory-migration', resource_deps=['inventory-db'], labels=['07-migrations'])
k8s_resource('production-migration', resource_deps=['production-db'], labels=['07-migrations'])
k8s_resource('procurement-migration', resource_deps=['procurement-db'], labels=['07-migrations'])
k8s_resource('distribution-migration', resource_deps=['distribution-db'], labels=['07-migrations'])

# Supporting Service Migrations
k8s_resource('recipes-migration', resource_deps=['recipes-db'], labels=['07-migrations'])
k8s_resource('suppliers-migration', resource_deps=['suppliers-db'], labels=['07-migrations'])
k8s_resource('pos-migration', resource_deps=['pos-db'], labels=['07-migrations'])
k8s_resource('orders-migration', resource_deps=['orders-db'], labels=['07-migrations'])
k8s_resource('external-migration', resource_deps=['external-db'], labels=['07-migrations'])

# Platform Service Migrations
k8s_resource('notification-migration', resource_deps=['notification-db'], labels=['07-migrations'])
k8s_resource('alert-processor-migration', resource_deps=['alert-processor-db'], labels=['07-migrations'])
k8s_resource('orchestrator-migration', resource_deps=['orchestrator-db'], labels=['07-migrations'])

# Demo Service Migrations
k8s_resource('demo-session-migration', resource_deps=['demo-session-db'], labels=['07-migrations'])

# =============================================================================
# DATA INITIALIZATION JOBS
# =============================================================================

k8s_resource('external-data-init', resource_deps=['external-migration', 'redis'], labels=['08-data-init'])
k8s_resource('nominatim-init', labels=['08-data-init'])

# =============================================================================
# APPLICATION SERVICES
# =============================================================================

# Core Services
k8s_resource('auth-service', resource_deps=['auth-migration', 'redis'], labels=['09-services-core'])
k8s_resource('tenant-service', resource_deps=['tenant-migration', 'redis'], labels=['09-services-core'])

# Data & Analytics Services
k8s_resource('training-service', resource_deps=['training-migration', 'redis'], labels=['10-services-analytics'])
k8s_resource('forecasting-service', resource_deps=['forecasting-migration', 'redis'], labels=['10-services-analytics'])
k8s_resource('ai-insights-service', resource_deps=['ai-insights-migration', 'redis', 'forecasting-service', 'production-service', 'procurement-service'], labels=['10-services-analytics'])

# Operations Services
k8s_resource('sales-service', resource_deps=['sales-migration', 'redis'], labels=['11-services-operations'])
k8s_resource('inventory-service', resource_deps=['inventory-migration', 'redis'], labels=['11-services-operations'])
k8s_resource('production-service', resource_deps=['production-migration', 'redis'], labels=['11-services-operations'])
k8s_resource('procurement-service', resource_deps=['procurement-migration', 'redis'], labels=['11-services-operations'])
k8s_resource('distribution-service', resource_deps=['distribution-migration', 'redis', 'rabbitmq'], labels=['11-services-operations'])

# Supporting Services
k8s_resource('recipes-service', resource_deps=['recipes-migration', 'redis'], labels=['12-services-supporting'])
k8s_resource('suppliers-service', resource_deps=['suppliers-migration', 'redis'], labels=['12-services-supporting'])
k8s_resource('pos-service', resource_deps=['pos-migration', 'redis'], labels=['12-services-supporting'])
k8s_resource('orders-service', resource_deps=['orders-migration', 'redis'], labels=['12-services-supporting'])
k8s_resource('external-service', resource_deps=['external-migration', 'external-data-init', 'redis'], labels=['12-services-supporting'])

# Platform Services
k8s_resource('notification-service', resource_deps=['notification-migration', 'redis', 'rabbitmq'], labels=['13-services-platform'])
k8s_resource('alert-processor', resource_deps=['alert-processor-migration', 'redis', 'rabbitmq'], labels=['13-services-platform'])
k8s_resource('orchestrator-service', resource_deps=['orchestrator-migration', 'redis'], labels=['13-services-platform'])

# Demo Services
k8s_resource('demo-session-service', resource_deps=['demo-session-migration', 'redis'], labels=['14-services-demo'])
k8s_resource('demo-cleanup-worker', resource_deps=['demo-session-service', 'redis'], labels=['14-services-demo'])

# =============================================================================
# FRONTEND & GATEWAY
# =============================================================================

k8s_resource('gateway', resource_deps=['auth-service'], labels=['15-frontend'])
k8s_resource('frontend', resource_deps=['gateway'], labels=['15-frontend'])

# =============================================================================
# CRONJOBS (Remaining K8s CronJobs)
# =============================================================================

k8s_resource('demo-session-cleanup', resource_deps=['demo-session-service'], labels=['16-cronjobs'])
k8s_resource('external-data-rotation', resource_deps=['external-service'], labels=['16-cronjobs'])

# =============================================================================
# WATCH SETTINGS
# =============================================================================

# Watch settings
watch_settings(
    ignore=[
        '.git/**',
        '**/__pycache__/**',
        '**/*.pyc',
        '**/.pytest_cache/**',
        '**/node_modules/**',
        '**/.DS_Store',
        '**/*.swp',
        '**/*.swo',
        '**/.venv/**',
        '**/venv/**',
        '**/.mypy_cache/**',
        '**/.ruff_cache/**',
        '**/.tox/**',
        '**/htmlcov/**',
        '**/.coverage',
        '**/dist/**',
        '**/build/**',
        '**/*.egg-info/**',
        '**/infrastructure/tls/**/*.pem',
        '**/infrastructure/tls/**/*.cnf',
        '**/infrastructure/tls/**/*.csr',
        '**/infrastructure/tls/**/*.srl',
        '**/*.tmp',
        '**/*.tmp.*',
        '**/migrations/versions/*.tmp.*',
        '**/playwright-report/**',
        '**/test-results/**',
    ]
)

# =============================================================================
# STARTUP SUMMARY
# =============================================================================

print("""
Security setup complete!

Database Security Features Active:
  TLS encryption: PostgreSQL and Redis
  Strong passwords: 32-character cryptographic
  Persistent storage: PVCs for all databases
  Column encryption: pgcrypto extension
  Audit logging: PostgreSQL query logging

Internal Schedulers Active:
  Alert Priority Recalculation: Hourly @ :15 (alert-processor)
  Usage Tracking: Daily @ 2:00 AM UTC (tenant-service)
  Disk Cleanup: Every {disk_cleanup_frequency_minutes} minutes (threshold: {disk_space_threshold_gb}GB)

Access your application:
  Main Application:      https://bakery-ia.local
  API Endpoints:         https://bakery-ia.local/api/v1/...
  Local Access:          https://localhost

  Service Metrics:
  Gateway:               http://localhost:8000/metrics
  Any Service:           kubectl port-forward <service> 8000:8000

  SigNoz (Unified Observability):
  Deploy via Tilt:      Trigger 'signoz-deployment' resource
  Manual deploy:        ./infrastructure/helm/deploy-signoz.sh dev
  Access (if deployed): https://monitoring.bakery-ia.local
  Username:             admin
  Password:             admin

Verify security:
  kubectl get pvc -n bakery-ia
  kubectl get secrets -n bakery-ia | grep tls
  kubectl logs -n bakery-ia <db-pod> | grep SSL

Verify schedulers:
  kubectl exec -it -n bakery-ia deployment/alert-processor -- curl localhost:8000/scheduler/status
  kubectl logs -f -n bakery-ia -l app=tenant-service | grep "usage tracking"

Documentation:
  docs/SECURITY_IMPLEMENTATION_COMPLETE.md
  docs/DATABASE_SECURITY_ANALYSIS_REPORT.md

Build Optimization Active:
  Services only rebuild when their code changes
  Shared folder changes trigger ALL services (as expected)
  Reduces unnecessary rebuilds and disk usage
  Edit service code: only that service rebuilds
  Edit shared/ code: all services rebuild (required)

Useful Commands:
  # Work on specific services only
  tilt up <service-name> <service-name>

  # View logs by label
  tilt logs 09-services-core
  tilt logs 13-services-platform

DNS Configuration:
  # To access the application via domain names, add these entries to your hosts file:
  # sudo nano /etc/hosts
  # Add these lines:
  # 127.0.0.1 bakery-ia.local
  # 127.0.0.1 monitoring.bakery-ia.local

======================================
""")