docker-compose.yml

# ferrosa-memory-mcp development cluster
# 3-node Ferrosa cluster + MinIO (S3)
#
# Usage:
#   podman compose up -d
#
# Ports:
#   19042-19044  CQL (node1-3)
#   17687-17689  Bolt/Cypher (node1-3)
#   17474-17476  Graph HTTP (node1-3)
#   19090-19092  Web console (node1-3)
#   19000-19001  MinIO S3 + console

services:
  # --- S3-compatible object storage (MinIO — supports conditional PUT/CAS) ---

  minio:
    image: minio/minio:latest
    # Cap memory so a runaway MinIO can't take out the Ferrosa nodes.
    # MinIO steady-state is <200MB for this workload; 1G leaves headroom
    # and fails loud if we blow past it (cgroup OOM = container OOMKilled=true
    # which the watchdog logs, instead of the host SIGKILLing the VM).
    mem_limit: 1g
    memswap_limit: 1g
    # Bounded restart — infinite loops surface in the podman events watchdog
    # as runaway RestartCount in the per-minute snapshot.
    restart: on-failure:5
    ports:
      - "19000:9000"
      - "19001:9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin  # pragma: allowlist secret
    volumes:
      - ~/data/ferrosa-memory/minio:/data
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9000/minio/health/live"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s

  minio-init:
    image: minio/mc
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      sh -c "mc alias set local http://minio:9000 minioadmin minioadmin &&
             mc mb local/ferrosa-memory --ignore-existing &&
             echo 'bucket created'"
    restart: "no"

  # --- 3-node Ferrosa cluster (CQL + Graph + Bolt) ---
  # Progressive join: node1=standalone, node2=pair, node3=cluster

  node1:
    image: ferrosa-memory-node
    user: "1000:1000"
    # 2G cap per Ferrosa node. Historical steady-state is ~1-2GB under
    # dev load (13.9k entities, 68k edges). The 2G ceiling covers
    # compaction + SSTable cache headroom and lets 3 nodes + MinIO fit
    # comfortably in an 8-16G podman VM without overcommit (3×2 + 1 = 7G
    # container budget). A 4G ceiling was previously used but summed to
    # 13G — more than an 8G VM can back, which caused silent VM panics
    # (containers healthy, VM stopped) rather than clean cgroup OOMs.
    # If this cap is hit the container OOMKilleds internally
    # (State.OOMKilled=true), restart:on-failure kicks in, and the
    # watchdog logs the event with context for forensics.
    #
    # memswap_limit matches mem_limit so the container cannot silently
    # spill to swap inside the podman VM — we want a clear OOM event,
    # not degraded performance we would miss.
    mem_limit: 2g
    memswap_limit: 2g
    restart: on-failure:5
    stop_grace_period: 35s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      minio-init:
        condition: service_completed_successfully
    ports:
      - "19042:9042"    # CQL
      - "17474:7474"    # Graph HTTP
      - "17687:7687"    # Bolt
      - "19090:9090"    # Web console
      - "18080:8080"    # SPARQL
    environment:
      FERROSA_HOST_ID: "11111111-1111-1111-1111-111111111111"
      FERROSA_DATA_DIR: /var/lib/ferrosa
      FERROSA_AUTH_ENABLED: "true"
      FERROSA_AUTH_DISABLED: "false"
      FERROSA_CQL_BIND: "0.0.0.0:9042"
      FERROSA_CQL_BROADCAST: "127.0.0.1:19042"
      FERROSA_CQL_INTERNAL_CLIENT_CIDRS: "10.89.1.0/24"
      FERROSA_CQL_MAX_CONNECTIONS_PER_IP: "256"
      FERROSA_WEB_BIND: "0.0.0.0:9090"
      FERROSA_GRAPH_ENABLED: "true"
      FERROSA_SPARQL_ENABLED: "true"
      FERROSA_SPARQL_BIND: "0.0.0.0:8080"
      FERROSA_CLUSTER_NAME: ferrosa-memory
      FERROSA_CLUSTER_MODE: standalone
      FERROSA_INTERNODE_BIND: "0.0.0.0:7000"
      FERROSA_INTERNODE_BROADCAST: "node1:7000"
      FERROSA_S3_ENDPOINT: "http://minio:9000"
      FERROSA_S3_BUCKET: ferrosa-memory
      FERROSA_S3_REGION: us-east-1
      FERROSA_S3_ALLOW_HTTP: "true"
      FERROSA_S3_ACCESS_KEY_ID: minioadmin
      FERROSA_S3_SECRET_ACCESS_KEY: minioadmin  # pragma: allowlist secret
      FERROSA_S3_PREFIX: node1
    volumes:
      - ~/data/ferrosa-memory/node1:/var/lib/ferrosa
    healthcheck:
      test: ["CMD-SHELL", "bash -c '</dev/tcp/127.0.0.1/9042' || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 15s

  node2:
    image: ferrosa-memory-node
    user: "1000:1000"
    # 2G cap per Ferrosa node. Historical steady-state is ~1-2GB under
    # dev load (13.9k entities, 68k edges). The 2G ceiling covers
    # compaction + SSTable cache headroom and lets 3 nodes + MinIO fit
    # comfortably in an 8-16G podman VM without overcommit (3×2 + 1 = 7G
    # container budget). A 4G ceiling was previously used but summed to
    # 13G — more than an 8G VM can back, which caused silent VM panics
    # (containers healthy, VM stopped) rather than clean cgroup OOMs.
    # If this cap is hit the container OOMKilleds internally
    # (State.OOMKilled=true), restart:on-failure kicks in, and the
    # watchdog logs the event with context for forensics.
    #
    # memswap_limit matches mem_limit so the container cannot silently
    # spill to swap inside the podman VM — we want a clear OOM event,
    # not degraded performance we would miss.
    mem_limit: 2g
    memswap_limit: 2g
    restart: on-failure:5
    stop_grace_period: 35s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      node1:
        condition: service_healthy
    ports:
      - "19043:9042"    # CQL
      - "17475:7474"    # Graph HTTP
      - "17688:7687"    # Bolt
      - "19091:9090"    # Web console
    environment:
      FERROSA_HOST_ID: "22222222-2222-2222-2222-222222222222"
      FERROSA_DATA_DIR: /var/lib/ferrosa
      FERROSA_AUTH_ENABLED: "true"
      FERROSA_AUTH_DISABLED: "false"
      FERROSA_CQL_BIND: "0.0.0.0:9042"
      FERROSA_CQL_BROADCAST: "127.0.0.1:19043"
      FERROSA_CQL_INTERNAL_CLIENT_CIDRS: "10.89.1.0/24"
      FERROSA_CQL_MAX_CONNECTIONS_PER_IP: "256"
      FERROSA_WEB_BIND: "0.0.0.0:9090"
      FERROSA_GRAPH_ENABLED: "true"
      FERROSA_SPARQL_ENABLED: "true"
      FERROSA_SPARQL_BIND: "0.0.0.0:8080"
      FERROSA_CLUSTER_NAME: ferrosa-memory
      FERROSA_CLUSTER_MODE: pair
      FERROSA_SEED: "node1:7000"
      FERROSA_INTERNODE_BIND: "0.0.0.0:7000"
      FERROSA_INTERNODE_BROADCAST: "node2:7000"
      FERROSA_S3_ENDPOINT: "http://minio:9000"
      FERROSA_S3_BUCKET: ferrosa-memory
      FERROSA_S3_REGION: us-east-1
      FERROSA_S3_ALLOW_HTTP: "true"
      FERROSA_S3_ACCESS_KEY_ID: minioadmin
      FERROSA_S3_SECRET_ACCESS_KEY: minioadmin  # pragma: allowlist secret
      FERROSA_S3_PREFIX: node2
    volumes:
      - ~/data/ferrosa-memory/node2:/var/lib/ferrosa
    healthcheck:
      test: ["CMD-SHELL", "bash -c '</dev/tcp/127.0.0.1/9042' || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 15s

  node3:
    image: ferrosa-memory-node
    user: "1000:1000"
    # 2G cap per Ferrosa node. Historical steady-state is ~1-2GB under
    # dev load (13.9k entities, 68k edges). The 2G ceiling covers
    # compaction + SSTable cache headroom and lets 3 nodes + MinIO fit
    # comfortably in an 8-16G podman VM without overcommit (3×2 + 1 = 7G
    # container budget). A 4G ceiling was previously used but summed to
    # 13G — more than an 8G VM can back, which caused silent VM panics
    # (containers healthy, VM stopped) rather than clean cgroup OOMs.
    # If this cap is hit the container OOMKilleds internally
    # (State.OOMKilled=true), restart:on-failure kicks in, and the
    # watchdog logs the event with context for forensics.
    #
    # memswap_limit matches mem_limit so the container cannot silently
    # spill to swap inside the podman VM — we want a clear OOM event,
    # not degraded performance we would miss.
    mem_limit: 2g
    memswap_limit: 2g
    restart: on-failure:5
    stop_grace_period: 35s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      node1:
        condition: service_healthy
      node2:
        condition: service_healthy
    ports:
      - "19044:9042"    # CQL
      - "17476:7474"    # Graph HTTP
      - "17689:7687"    # Bolt
      - "19092:9090"    # Web console
    environment:
      FERROSA_HOST_ID: "33333333-3333-3333-3333-333333333333"
      FERROSA_DATA_DIR: /var/lib/ferrosa
      FERROSA_AUTH_ENABLED: "true"
      FERROSA_AUTH_DISABLED: "false"
      FERROSA_CQL_BIND: "0.0.0.0:9042"
      FERROSA_CQL_BROADCAST: "127.0.0.1:19044"
      FERROSA_CQL_INTERNAL_CLIENT_CIDRS: "10.89.1.0/24"
      FERROSA_CQL_MAX_CONNECTIONS_PER_IP: "256"
      FERROSA_WEB_BIND: "0.0.0.0:9090"
      FERROSA_GRAPH_ENABLED: "true"
      FERROSA_SPARQL_ENABLED: "true"
      FERROSA_SPARQL_BIND: "0.0.0.0:8080"
      FERROSA_CLUSTER_NAME: ferrosa-memory
      FERROSA_CLUSTER_MODE: cluster
      FERROSA_SEED: "node1:7000"
      FERROSA_INTERNODE_BIND: "0.0.0.0:7000"
      FERROSA_INTERNODE_BROADCAST: "node3:7000"
      FERROSA_S3_ENDPOINT: "http://minio:9000"
      FERROSA_S3_BUCKET: ferrosa-memory
      FERROSA_S3_REGION: us-east-1
      FERROSA_S3_ALLOW_HTTP: "true"
      FERROSA_S3_ACCESS_KEY_ID: minioadmin
      FERROSA_S3_SECRET_ACCESS_KEY: minioadmin  # pragma: allowlist secret
      FERROSA_S3_PREFIX: node3
    volumes:
      - ~/data/ferrosa-memory/node3:/var/lib/ferrosa
    healthcheck:
      test: ["CMD-SHELL", "bash -c '</dev/tcp/127.0.0.1/9042' || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 15s

  ferrosa-memory-mcp:
    build:
      context: .
      dockerfile: Containerfile
    stop_grace_period: 35s
    depends_on:
      node1:
        condition: service_healthy
      node2:
        condition: service_healthy
      node3:
        condition: service_healthy
    # Runtime config intentionally uses localhost contact points for CQL,
    # Graph, SPARQL, Ollama, and loopback-only operator HTTP/Viz binds.
    # Keep this service on the host network so the mounted config means the
    # same thing inside the container as it does for the historical standalone
    # `docker run --network host` launch.
    network_mode: host
    environment:
      FERROSA_MEMORY_CONFIG: /run/secrets/ferrosa-memory/ferrosa-memory-http-podman.toml
    volumes:
      - ./.runtime:/run/secrets/ferrosa-memory:ro
    healthcheck:
      test: ["CMD", "curl", "-ksf", "https://127.0.0.1:8765/healthz/live"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s