docker-compose.yml

services:
  postgres:
    image: postgres:15.7-alpine
    restart: unless-stopped
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-secrux}
      POSTGRES_USER: ${POSTGRES_USER:-secrux}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-secrux}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-secrux} -d ${POSTGRES_DB:-secrux}"]
      interval: 10s
      timeout: 5s
      retries: 5

  zookeeper:
    image: confluentinc/cp-zookeeper:7.5.3
    restart: unless-stopped
    ports:
      - "2181:2181"
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000
      ZOOKEEPER_SYNC_LIMIT: 2
      ZOOKEEPER_4LW_COMMANDS_WHITELIST: srvr,ruok
      KAFKA_OPTS: "-Dzookeeper.4lw.commands.whitelist=srvr,ruok"
    healthcheck:
      test: ["CMD", "bash", "-c", "echo ruok | nc localhost 2181 | grep imok"]
      interval: 30s
      timeout: 10s
      retries: 5

  kafka:
    image: confluentinc/cp-kafka:7.5.3
    restart: unless-stopped
    ports:
      # Use 19092 to avoid host port conflicts (some local apps use 9092).
      - "${KAFKA_PORT:-19092}:9092"
    depends_on:
      - zookeeper
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      # Two listeners: one for host access (host.docker.internal:9092), one for docker network (kafka:29092)
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT
      # NOTE: For host-run clients, host.docker.internal may not resolve; advertise 127.0.0.1 for the host listener.
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:29092,PLAINTEXT_HOST://127.0.0.1:${KAFKA_PORT:-19092}
      KAFKA_LISTENERS: PLAINTEXT://0.0.0.0:29092,PLAINTEXT_HOST://0.0.0.0:9092
      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
    healthcheck:
      test: ["CMD", "bash", "-c", "kafka-topics --bootstrap-server localhost:9092 --list || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    ports:
      - "${REDIS_PORT:-6379}:6379"
    command: ["redis-server", "--save", "", "--appendonly", "no"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  keycloak:
    image: quay.io/keycloak/keycloak:24.0.4
    restart: unless-stopped
    command:
      - start-dev
      - --http-port=8081
      - --hostname-strict=false
      - --import-realm
    environment:
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
      KC_HEALTH_ENABLED: "true"
    ports:
      - "${KEYCLOAK_PORT:-8081}:8081"
    volumes:
      - ./keycloak:/opt/keycloak/data/import
    healthcheck:
      test: ["CMD-SHELL", "bash -lc \"exec 3<>/dev/tcp/localhost/8081 && printf 'GET /health/ready HTTP/1.0\\r\\nHost: localhost\\r\\n\\r\\n' >&3 && head -n1 <&3 | grep 200\""]
      interval: 15s
      timeout: 5s
      retries: 10

  ai-postgres:
    image: postgres:15.7-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${AI_POSTGRES_DB:-secrux_ai}
      POSTGRES_USER: ${AI_POSTGRES_USER:-secrux_ai}
      POSTGRES_PASSWORD: ${AI_POSTGRES_PASSWORD:-secrux_ai}
    volumes:
      - ai_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${AI_POSTGRES_USER:-secrux_ai} -d ${AI_POSTGRES_DB:-secrux_ai}"]
      interval: 10s
      timeout: 5s
      retries: 5

  ai-service:
    build:
      context: ./secrux-ai
    restart: unless-stopped
    environment:
      SECRUX_AI_SERVICE_TOKEN: ${SECRUX_AI_SERVICE_TOKEN:-local-dev-token}
      AI_DATABASE_URL: ${AI_DATABASE_URL:-postgresql+psycopg://secrux_ai:secrux_ai@ai-postgres:5432/secrux_ai}
      SECRUX_AI_LLM_BASE_URL: ${SECRUX_AI_LLM_BASE_URL:-}
      SECRUX_AI_LLM_API_KEY: ${SECRUX_AI_LLM_API_KEY:-}
      SECRUX_AI_LLM_MODEL: ${SECRUX_AI_LLM_MODEL:-}
      SECRUX_AI_PROMPT_DUMP: ${SECRUX_AI_PROMPT_DUMP:-off}
      SECRUX_AI_PROMPT_DUMP_DIR: ${SECRUX_AI_PROMPT_DUMP_DIR:-/app/storage/prompt-dumps}
      SECRUX_AI_PROMPT_DUMP_FILE_STRATEGY: ${SECRUX_AI_PROMPT_DUMP_FILE_STRATEGY:-target}
      SECRUX_AI_PROMPT_DUMP_FILTER_PURPOSE: ${SECRUX_AI_PROMPT_DUMP_FILTER_PURPOSE:-review}
      SECRUX_AI_PROMPT_DUMP_FILTER_JOB_ID: ${SECRUX_AI_PROMPT_DUMP_FILTER_JOB_ID:-}
      SECRUX_AI_PROMPT_DUMP_FILTER_TARGET_ID: ${SECRUX_AI_PROMPT_DUMP_FILTER_TARGET_ID:-}
      SECRUX_AI_PROMPT_DUMP_FILTER_AGENT: ${SECRUX_AI_PROMPT_DUMP_FILTER_AGENT:-}
      SECRUX_AI_PROMPT_DUMP_FILTER_MODE: ${SECRUX_AI_PROMPT_DUMP_FILTER_MODE:-}
      SECRUX_AI_PROMPT_DUMP_INCLUDE_RESPONSE: ${SECRUX_AI_PROMPT_DUMP_INCLUDE_RESPONSE:-false}
      SECRUX_AI_PROMPT_DUMP_INCLUDE_FINDING: ${SECRUX_AI_PROMPT_DUMP_INCLUDE_FINDING:-false}
      SECRUX_AI_PROMPT_DUMP_INCLUDE_ENRICHMENT: ${SECRUX_AI_PROMPT_DUMP_INCLUDE_ENRICHMENT:-false}
      SECRUX_AI_PROMPT_DUMP_MAX_CHARS: ${SECRUX_AI_PROMPT_DUMP_MAX_CHARS:-200000}
    depends_on:
      ai-postgres:
        condition: service_healthy
    volumes:
      - ai_mcp_data:/app/storage/mcps
      - ai_agent_data:/app/storage/agents
      - ./secrux-ai/storage/prompt-dumps:/app/storage/prompt-dumps
    ports:
      - "${AI_PORT:-5156}:5156"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:5156/health').read()"]
      interval: 15s
      timeout: 5s
      retries: 5

  secrux-server:
    build:
      context: ./secrux-server
    restart: unless-stopped
    ports:
      - "${SECRUX_SERVER_PORT:-8080}:8080"
      - "${EXECUTOR_GATEWAY_PORT:-5155}:5155"
    volumes:
      # Optional: mount TLS certs for Executor Gateway (generated by ./gen-executor-gateway-certs.sh)
      - ./certs/executor-gateway:/certs/executor-gateway:ro
    environment:
      SPRING_DATASOURCE_URL: ${SPRING_DATASOURCE_URL:-jdbc:postgresql://postgres:5432/secrux}
      SPRING_DATASOURCE_USERNAME: ${SPRING_DATASOURCE_USERNAME:-secrux}
      SPRING_DATASOURCE_PASSWORD: ${SPRING_DATASOURCE_PASSWORD:-secrux}

      SECRUX_KAFKA_BOOTSTRAP_SERVERS: ${SECRUX_KAFKA_BOOTSTRAP_SERVERS:-kafka:29092}

      SECRUX_AUTH_MODE: ${SECRUX_AUTH_MODE:-KEYCLOAK}
      SECRUX_AUTH_ISSUER_URI: ${SECRUX_AUTH_ISSUER_URI:-http://keycloak:8081/realms/secrux}
      # Keycloak issuer seen by browsers is usually http://localhost:8081; accept it as an alias in quickstart.
      SECRUX_AUTH_ISSUER_ALIASES: ${SECRUX_AUTH_ISSUER_ALIASES:-http://localhost:8081/realms/secrux}
      SECRUX_AUTH_AUDIENCE: ${SECRUX_AUTH_AUDIENCE:-secrux-api}

      SECRUX_KEYCLOAK_ADMIN_ENABLED: ${SECRUX_KEYCLOAK_ADMIN_ENABLED:-true}
      SECRUX_KEYCLOAK_ADMIN_BASE_URL: ${SECRUX_KEYCLOAK_ADMIN_BASE_URL:-http://keycloak:8081}
      SECRUX_KEYCLOAK_ADMIN_REALM: ${SECRUX_KEYCLOAK_ADMIN_REALM:-secrux}
      SECRUX_KEYCLOAK_ADMIN_CLIENT_ID: ${SECRUX_KEYCLOAK_ADMIN_CLIENT_ID:-secrux-admin}
      SECRUX_KEYCLOAK_ADMIN_CLIENT_SECRET: ${SECRUX_KEYCLOAK_ADMIN_CLIENT_SECRET:-changeme}

      SECRUX_CRYPTO_SECRET: ${SECRUX_CRYPTO_SECRET:-change-me-in-production}

      # AI config DB used by secrux-server (jOOQ aiDslContext + spring.flyway.ai)
      # Defaults to the bundled ai-postgres container in quickstart.
      SECRUX_AI_DB_URL: ${SECRUX_AI_DB_URL:-jdbc:postgresql://ai-postgres:5432/secrux_ai}
      SECRUX_AI_DB_USERNAME: ${SECRUX_AI_DB_USERNAME:-secrux_ai}
      SECRUX_AI_DB_PASSWORD: ${SECRUX_AI_DB_PASSWORD:-secrux_ai}

      SECRUX_AI_SERVICE_BASE_URL: ${SECRUX_AI_SERVICE_BASE_URL:-http://ai-service:5156}
      SECRUX_AI_SERVICE_TOKEN: ${SECRUX_AI_SERVICE_TOKEN:-local-dev-token}

      EXECUTOR_GATEWAY_ENABLED: ${EXECUTOR_GATEWAY_ENABLED:-true}
      EXECUTOR_GATEWAY_PORT: ${EXECUTOR_GATEWAY_PORT:-5155}
      EXECUTOR_GATEWAY_CERTIFICATE_PATH: ${EXECUTOR_GATEWAY_CERTIFICATE_PATH:-/certs/executor-gateway/gateway.crt}
      EXECUTOR_GATEWAY_PRIVATE_KEY_PATH: ${EXECUTOR_GATEWAY_PRIVATE_KEY_PATH:-/certs/executor-gateway/gateway.key}
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_started
      keycloak:
        condition: service_healthy
      ai-service:
        condition: service_healthy

  secrux-console:
    build:
      context: ./secrux-console
    restart: unless-stopped
    ports:
      - "${CONSOLE_PORT:-5173}:80"
    environment:
      SECRUX_API_BASE_URL: ${SECRUX_API_BASE_URL:-http://localhost:8080}
      SECRUX_AUTH_MODE_UI: ${SECRUX_AUTH_MODE_UI:-keycloak}
      SECRUX_OIDC_BASE_URL: ${SECRUX_OIDC_BASE_URL:-http://localhost:8081}
      SECRUX_OIDC_REALM: ${SECRUX_OIDC_REALM:-secrux}
      SECRUX_OIDC_CLIENT_ID: ${SECRUX_OIDC_CLIENT_ID:-secrux-console}
      SECRUX_OIDC_SCOPE: ${SECRUX_OIDC_SCOPE:-openid}
      SECRUX_APP_VERSION: ${SECRUX_APP_VERSION:-dev}
    depends_on:
      - secrux-server

volumes:
  postgres_data:
  ai_postgres_data:
  ai_mcp_data:
  ai_agent_data: