docker-compose.yml

services:

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    ports:
      - "5432:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./config/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s

  kafka:
    image: apache/kafka:3.9.0
    ports:
      - "9092:29092"
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_LISTENERS: PLAINTEXT://:9094,PLAINTEXT_HOST://:29092,CONTROLLER://:9093
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9094,PLAINTEXT_HOST://localhost:9092
      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@localhost:9093
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
    healthcheck:
      test: ["CMD", "/opt/kafka/bin/kafka-broker-api-versions.sh", "--bootstrap-server", "localhost:9094"]
      interval: 5s
      timeout: 10s
      retries: 12
      start_period: 15s

  kafka-init:
    image: apache/kafka:3.9.0
    depends_on:
      kafka:
        condition: service_healthy
    volumes:
      - ./config/kafka/create-topics.sh:/opt/kafka/create-topics.sh:ro
    entrypoint: ["/bin/bash", "/opt/kafka/create-topics.sh"]
    environment:
      KAFKA_BOOTSTRAP_SERVER: kafka:9094

  # Redis distributed position cache. Order-manager publishes
  # position snapshots here on every fill alongside the Kafka positions.updates topic;
  # execution-engine reads from it for sub-millisecond pre-trade risk checks.
  redis:
    image: redis:7.4-alpine
    command: ["redis-server", "--appendonly", "yes", "--maxmemory", "256mb", "--maxmemory-policy", "allkeys-lru"]
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s

  prometheus:
    image: prom/prometheus:v3.2.1
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--web.enable-remote-write-receiver"
      - "--storage.tsdb.path=/prometheus"
    ports:
      - "9090:9090"
    volumes:
      - ./config/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --tries=1 --spider http://localhost:9090/-/healthy || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  loki:
    image: grafana/loki:3.3.2
    command: ["-config.file=/etc/loki/loki-config.yaml"]
    volumes:
      - ./config/loki/loki-config.yaml:/etc/loki/loki-config.yaml:ro
      - loki-data:/loki
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --tries=1 --spider http://localhost:3100/ready || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  tempo:
    image: grafana/tempo:2.7.1
    command: ["-config.file=/etc/tempo/tempo-config.yaml"]
    volumes:
      - ./config/tempo/tempo-config.yaml:/etc/tempo/tempo-config.yaml:ro
      - tempo-data:/var/tempo
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --tries=1 --spider http://localhost:3200/ready || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  alloy:
    image: grafana/alloy:v1.6.1
    command:
      - "run"
      - "/etc/alloy/config.alloy"
      - "--server.http.listen-addr=0.0.0.0:12345"
      - "--stability.level=generally-available"
    ports:
      - "12345:12345"
      - "4317:4317"
      - "4318:4318"
    volumes:
      - ./config/alloy/config.alloy:/etc/alloy/config.alloy:ro
    depends_on:
      prometheus:
        condition: service_healthy
      loki:
        condition: service_healthy
      tempo:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "bash -c '</dev/tcp/localhost/12345' || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  grafana:
    image: grafana/grafana:11.5.2
    ports:
      - "3001:3000"
    environment:
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Admin
      GF_AUTH_DISABLE_LOGIN_FORM: "true"
    volumes:
      - ./config/grafana/provisioning:/etc/grafana/provisioning:ro
      - grafana-data:/var/lib/grafana
    depends_on:
      prometheus:
        condition: service_healthy
      loki:
        condition: service_healthy
      tempo:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --tries=1 --spider http://localhost:3000/api/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  analytics-service:
    build:
      context: .
      dockerfile: analytics-service/Dockerfile
    image: mariaalpha/analytics-service:local
    ports:
      - "8095:8095"
    environment:
      ANALYTICS_KAFKA_BOOTSTRAP_SERVERS: kafka:9094
      ANALYTICS_TOXICITY_THRESHOLD_BPS: ${ANALYTICS_TOXICITY_THRESHOLD_BPS:-5.0}
      ANALYTICS_TOXICITY_MIN_OBSERVATIONS: ${ANALYTICS_TOXICITY_MIN_OBSERVATIONS:-10}
      ANALYTICS_COMMISSION_BPS: ${ANALYTICS_COMMISSION_BPS:-0.5}
      # Roadmap 4.6.1 — portfolio construction & risk.
      ANALYTICS_PORTFOLIO_REFERENCE_PATH: /app/config/portfolio.yml
      ANALYTICS_STRESS_SCENARIOS_PATH: /app/config/stress-scenarios.yml
      ANALYTICS_PORTFOLIO_BASE_NAV: ${ANALYTICS_PORTFOLIO_BASE_NAV:-1000000}
      ANALYTICS_RETURNS_CLOCK: ${ANALYTICS_RETURNS_CLOCK:-arrival}
      ANALYTICS_RETURNS_BAR_SECONDS: ${ANALYTICS_RETURNS_BAR_SECONDS:-60}
      ANALYTICS_RISK_MODEL_PUBLISH_SECONDS: ${ANALYTICS_RISK_MODEL_PUBLISH_SECONDS:-300}
      ANALYTICS_EXECUTION_ENGINE_URL: http://execution-engine:8084
      ANALYTICS_REBALANCE_SUBMIT_ENABLED: ${ANALYTICS_REBALANCE_SUBMIT_ENABLED:-false}
    volumes:
      - ./config/portfolio.yml:/app/config/portfolio.yml:ro
      - ./config/stress-scenarios.yml:/app/config/stress-scenarios.yml:ro
    depends_on:
      kafka:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8095/health')"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  ml-signal-service:
    build:
      context: .
      dockerfile: ml-signal-service/Dockerfile
    ports:
      - "8090:8090"
      - "50051:50051"
    environment:
      ML_SIGNAL_KAFKA_BOOTSTRAP_SERVERS: kafka:9094
      ML_SIGNAL_SIGNAL_MODEL_PATH: /app/ml-models/signal_model.joblib
      ML_SIGNAL_REGIME_MODEL_PATH: /app/ml-models/regime_model.joblib
    depends_on:
      kafka:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8090/health')"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  market-data-gateway:
    build:
      context: .
      dockerfile: market-data-gateway/Dockerfile
    image: mariaalpha/market-data-gateway:local
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
    environment:
      SPRING_PROFILES_ACTIVE: ${MARKET_DATA_PROFILE:-simulated}
      KAFKA_BOOTSTRAP_SERVERS: kafka:9094
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB:-mariaalpha}
      POSTGRES_USER: ${POSTGRES_USER:-mariaalpha}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mariaalpha}
      SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB:-mariaalpha}
      SPRING_LIQUIBASE_LIQUIBASE_SCHEMA: liq_mdg
      ALPACA_API_KEY_ID: ${ALPACA_API_KEY_ID:-}
      ALPACA_API_SECRET_KEY: ${ALPACA_API_SECRET_KEY:-}
      MANAGEMENT_PORT: 8081
      MARKET_DATA_SYMBOLS: AAPL,MSFT,GOOGL,AMZN,TSLA,NVDA
    volumes:
      - ./config/symbols.yml:/app/config/symbols.yml:ro
    ports:
      - "8079:8079"
      - "8081:8081"
      - "50052:50052"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8081/actuator/health/liveness"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 15s

  strategy-engine:
    build:
      context: .
      dockerfile: strategy-engine/Dockerfile
    image: mariaalpha/strategy-engine:local
    depends_on:
      kafka:
        condition: service_healthy
      ml-signal-service:
        condition: service_healthy
    environment:
      KAFKA_BOOTSTRAP_SERVERS: kafka:9094
      ML_SERVICE_HOST: ml-signal-service
      ML_SERVICE_PORT: 50051
      MANAGEMENT_PORT: 8083
      # RFQ pricing reads positions from order-manager; falls back to flat on timeout.
      ORDER_MANAGER_BASE_URL: http://order-manager:8086
      # Roadmap 5.1.1 backtester — fetches real Alpaca historical bars via POST /api/backtest.
      # Independent of the market-data profile; empty keys simply disable live fetches.
      ALPACA_API_KEY_ID: ${ALPACA_API_KEY_ID:-}
      ALPACA_API_SECRET_KEY: ${ALPACA_API_SECRET_KEY:-}
    ports:
      - "8082:8082"
      - "8083:8083"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8083/actuator/health/liveness"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 15s

  execution-engine:
    build:
      context: .
      dockerfile: execution-engine/Dockerfile
    image: mariaalpha/execution-engine:local
    ports:
      - "8084:8084"
      - "8085:8085"
    environment:
      KAFKA_BOOTSTRAP_SERVERS: kafka:9094
      SPRING_PROFILES_ACTIVE: ${EXECUTION_PROFILE:-simulated}
      ALPACA_API_KEY_ID: ${ALPACA_API_KEY_ID:-}
      ALPACA_API_SECRET_KEY: ${ALPACA_API_SECRET_KEY:-}
      SPRING_DATA_REDIS_HOST: redis
      SPRING_DATA_REDIS_PORT: 6379
      # Extended risk-check overrides — exposed so ExtendedRiskChecksE2ETest can tighten
      # thresholds at runtime. Defaults match application.yml.
      EXECUTION_ENGINE_RISK_MAX_ADV_PARTICIPATION: ${EXECUTION_ENGINE_RISK_MAX_ADV_PARTICIPATION:-0.10}
      EXECUTION_ENGINE_RISK_MAX_ABSOLUTE_BETA_WEIGHTED_EXPOSURE: ${EXECUTION_ENGINE_RISK_MAX_ABSOLUTE_BETA_WEIGHTED_EXPOSURE:-2500000}
      EXECUTION_ENGINE_RISK_DEFAULT_SECTOR_EXPOSURE_LIMIT: ${EXECUTION_ENGINE_RISK_DEFAULT_SECTOR_EXPOSURE_LIMIT:-1000000}
      # Roadmap 4.6.1 — VaR aggregation. COVARIANCE uses the correlation matrix published by
      # analytics-service on analytics.risk-model; SUM_OF_ABSOLUTES pins the pre-4.6.1 behaviour.
      # Exposed here so the two can be A/B-compared on a running stack without a rebuild.
      EXECUTION_ENGINE_VAR_AGGREGATION: ${EXECUTION_ENGINE_VAR_AGGREGATION:-COVARIANCE}
      EXECUTION_ENGINE_RISK_MODEL_MAX_AGE_SECONDS: ${EXECUTION_ENGINE_RISK_MODEL_MAX_AGE_SECONDS:-900}
      EXECUTION_ENGINE_RISK_MAX_INTRADAY_VAR: ${EXECUTION_ENGINE_RISK_MAX_INTRADAY_VAR:-750000}
    depends_on:
      kafka:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:8085/actuator/health/liveness" ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  order-manager:
    build:
      context: .
      dockerfile: order-manager/Dockerfile
    image: mariaalpha/order-manager:local
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-default}
      KAFKA_BOOTSTRAP_SERVERS: kafka:9094
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB:-mariaalpha}
      POSTGRES_USER: ${POSTGRES_USER:-mariaalpha}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mariaalpha}
      SPRING_LIQUIBASE_LIQUIBASE_SCHEMA: liq_om
      SPRING_DATA_REDIS_HOST: redis
      SPRING_DATA_REDIS_PORT: 6379
      MANAGEMENT_PORT: 8087
    ports:
      - "8086:8086"
      - "8087:8087"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8087/actuator/health/liveness"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 15s

  post-trade:
    build:
      context: .
      dockerfile: post-trade/Dockerfile
    image: mariaalpha/post-trade:local
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      order-manager:
        condition: service_healthy
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-default}
      KAFKA_BOOTSTRAP_SERVERS: kafka:9094
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB:-mariaalpha}
      POSTGRES_USER: ${POSTGRES_USER:-mariaalpha}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mariaalpha}
      SPRING_LIQUIBASE_LIQUIBASE_SCHEMA: liq_pt
      ORDER_MANAGER_BASE_URL: http://order-manager:8086
      MANAGEMENT_PORT: 8089
    ports:
      - "8088:8088"
      - "8089:8089"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8089/actuator/health/liveness"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 15s

  api-gateway:
    build:
      context: .
      dockerfile: api-gateway/Dockerfile
    image: mariaalpha/api-gateway:local
    depends_on:
      kafka:
        condition: service_healthy
      strategy-engine:
        condition: service_healthy
      execution-engine:
        condition: service_started
      order-manager:
        condition: service_healthy
      post-trade:
        condition: service_healthy
      market-data-gateway:
        condition: service_healthy
      analytics-service:
        condition: service_healthy
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-default}
      KAFKA_BOOTSTRAP_SERVERS: kafka:9094
      MARIAALPHA_API_KEY: ${MARIAALPHA_API_KEY:?MARIAALPHA_API_KEY must be set}
      MARKET_DATA_GATEWAY_URL: http://market-data-gateway:8079
      MARKET_DATA_GATEWAY_MANAGEMENT_URL: http://market-data-gateway:8081
      STRATEGY_ENGINE_URL: http://strategy-engine:8082
      STRATEGY_ENGINE_MANAGEMENT_URL: http://strategy-engine:8083
      EXECUTION_ENGINE_URL: http://execution-engine:8084
      EXECUTION_ENGINE_MANAGEMENT_URL: http://execution-engine:8085
      ORDER_MANAGER_URL: http://order-manager:8086
      ORDER_MANAGER_MANAGEMENT_URL: http://order-manager:8087
      POST_TRADE_URL: http://post-trade:8088
      POST_TRADE_MANAGEMENT_URL: http://post-trade:8089
      ANALYTICS_SERVICE_URL: http://analytics-service:8095
      ANALYTICS_SERVICE_MANAGEMENT_URL: http://analytics-service:8095
      MANAGEMENT_PORT: 8091
      FIX_GATEWAY_ENABLED: "true"
      FIX_GATEWAY_PORT: "9878"
    ports:
      - "8080:8080"
      - "8091:8091"
      - "9878:9878"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8091/actuator/health/liveness"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 15s

  ui:
    build:
      context: .
      dockerfile: ui/Dockerfile
      args:
        # The API key is baked into the JS bundle at build time; the image must be
        # rebuilt when the key changes. For real deployments, prefer a runtime config-map pattern.
        VITE_MARIAALPHA_API_KEY: ${MARIAALPHA_API_KEY:?MARIAALPHA_API_KEY must be set}
        VITE_API_BASE_URL: ""
    image: mariaalpha/ui:local
    ports:
      - "5173:80"
    depends_on:
      api-gateway:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --tries=1 --spider http://127.0.0.1/ || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s

volumes:
  postgres-data:
  prometheus-data:
  loki-data:
  tempo-data:
  grafana-data:
  redis-data: