chore(infra): update compose configurations, mqtt health bridge, and export scripts

compose.yaml

@@ -217,25 +217,37 @@ services:
       # See finlyticassets above: broker has no auth configured yet, do not enable.
       #- MQTT__Username=${MQTT_USERNAME:-admin}
       #- MQTT__Password=${MQTT_PASSWORD}
-      - MQTT__ClientId=finlytic_bot
-      - Alpaca__KeyId=${ALPACA_KEY_ID:-PK_PAPER_PLACEHOLDER_KEY}
-      - Alpaca__SecretKey=${ALPACA_SECRET_KEY:-SK_PAPER_PLACEHOLDER_SECRET}
       - Alpaca__IsPaper=true
 
+  finlyticnotify:
+    image: finlyticnotify
+    build:
+      context: .
+      dockerfile: FinlyticNotify/Dockerfile
+    restart: unless-stopped
+    networks:
+      - postgres-network
+    environment:
+      - ConnectionStrings__DefaultConnection=Host=${DB_HOST:-OmniDB};Port=${DB_PORT:-5432};Database=finlytic_notify;Username=admin;Password=${DB_PASSWORD}
+      - MQTT__Host=${MQTT_HOST:-host.docker.internal}
+      - MQTT__Port=${MQTT_PORT:-4545}
+      - MQTT__ClientId=finlytic_notify
+      - Ntfy__BaseUrl=${NTFY_BASE_URL:-http://host.docker.internal:8080}
+      - Ntfy__TopicPrefix=finlytic
+      - Ntfy__BroadcastChannel=broadcast
+      - Ntfy__NewsChannel=news
+      - Ntfy__DefaultUsername=admin
+      - Ntfy__MinProposalScore=70.0
+      - Ntfy__NotifyOnProposals=true
+      - Ntfy__NotifyOnTradeUpdates=true
+      - Ntfy__NotifyOnBotTrades=true
+      - Ntfy__NotifyOnNews=true
+
   finlyticbackend:
     image: finlyticbackend
     build:
       context: .
       dockerfile: FinlyticBackend/Dockerfile
-    # on-failure (bounded), NOT unless-stopped: this is the one service that
-    # deliberately throws at startup if JWT_SECRET_KEY / ADMIN_DEFAULT_PASSWORD
-    # are missing or too weak (see Program.cs fail-fast guards). An
-    # unless-stopped policy would crash-loop that misconfiguration forever,
-    # burning CPU/log volume while masking the real problem. A bounded
-    # on-failure still recovers from transient startup races (e.g. DB not
-    # yet reachable) but eventually settles into a visibly "Exited" container
-    # (`docker compose ps`) once the retries are exhausted, surfacing a
-    # persistent config error instead of hiding it.
     restart: on-failure:5
     ports:
       - "5000:8080"
@@ -254,55 +266,6 @@ services:
     volumes:
       - ${FINLYTIC_DATA_ROOT:-C:/Users/larsh/Documents/docker/finlytic}/assets/index:/app/assets/index
       - ${FINLYTIC_DATA_ROOT:-C:/Users/larsh/Documents/docker/finlytic}/assets/logos:/app/assets/logos
-    # Honest healthcheck: actually opens a TCP connection to the real Kestrel
-    # port and parses the real HTTP status line from the real GET /health
-    # endpoint (Program.cs, AllowAnonymous, no auth required). The final image
-    # (mcr.microsoft.com/dotnet/aspnet:10.0) has neither curl nor wget
-    # installed (verified) — installing one just for this would add an extra
-    # apt layer, so instead we use bash's built-in /dev/tcp (bash itself IS
-    # present in the base image, verified), invoked directly via exec form so
-    # it does not go through /bin/sh (which is dash on this image and does
-    # NOT support /dev/tcp).
-    healthcheck:
-      test:
-        - CMD
-        - bash
-        - -c
-        - >-
-          exec 3<>/dev/tcp/127.0.0.1/8080 &&
-          printf 'GET /health HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 &&
-          head -n1 <&3 | grep -q '200'
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 20s
-
-  # ──────────────────────────────────────────────────────────────────────────
-  # No HEALTHCHECK on the 8 worker services above (finlyticassets, finlyticnews,
-  # finlyticfundamentals, finlyticsentiment, finlytictechnicals, finlyticengine,
-  # finlyticsimulation, finlyticbot) — and this is deliberate, not an omission:
-  #
-  #   - They are Microsoft.NET.Sdk.Worker projects and MUST NOT host an HTTP
-  #     server (Rules.md §5), so there is no `GET /health`-style endpoint to
-  #     probe, by design.
-  #   - Docker already restarts/reports a dead PID 1 via the `restart` policy
-  #     above without any HEALTHCHECK — a HEALTHCHECK only adds value if it
-  #     can distinguish "process alive but broken" from "process alive and
-  #     working", which requires touching something specific to the app.
-  #   - The only things reachable from inside these containers without an
-  #     app-level probe endpoint are the external DB/MQTT dependencies
-  #     themselves (e.g. via bash's /dev/tcp, as used for finlyticbackend
-  #     above). But a bare TCP-reachability check to OmniDB/MQTT tests the
-  #     network path, not the worker — it would report "healthy" while the
-  #     worker is deadlocked, and "unhealthy" during a legitimate external
-  #     outage the worker's own retry logic is already handling. That is
-  #     placebo/misleading in both directions, not an honest signal.
-  #
-  #   Conclusion: no meaningful, non-cosmetic healthcheck is possible here
-  #   without adding an HTTP endpoint (forbidden by Rules.md §5). Leaving
-  #   HEALTHCHECK unset is the honest choice.
-  # ──────────────────────────────────────────────────────────────────────────
-
 networks:
   postgres-network:
     external: true