docker-compose.yaml

services:

  arbiter:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: arbiter-app
    ports:
      - "8080:8080"
    environment:
      - SPRING_DATA_MONGODB_URI=mongodb://mongodb:27017/arbiter
      - SPRING_DATA_REDIS_HOST=valkey
      - SPRING_DATA_REDIS_PORT=6379
      - SPRING_SESSION_STORE_TYPE=redis
      # AES-256 key for at-rest credential encryption — base64 of exactly 32
      # random bytes. The application refuses to start without it. Generate one
      # and place it in .env (next to this file):
      #
      # echo "ARBITER_CRYPTO_SECRET=$(openssl rand -base64 32)" >> .env
      - ARBITER_CRYPTO_SECRET=${ARBITER_CRYPTO_SECRET:?Set ARBITER_CRYPTO_SECRET in .env (see .env.example)}
      # Initial password for the bootstrap admin (admin@philterd.ai). Used only
      # when no admin account yet exists in the database. Must be at least 12
      # characters; Arbiter refuses to start if it is missing or too short.
      - ARBITER_ADMIN_INITIAL_PASSWORD=ChangeMeOnFirstLogin!
      # The dev compose explicitly opts in to demo-data loading (R2-F4). The
      # default in application.properties is now off — production deployments
      # should never load synthetic data, but the dev stack benefits from it.
      - ARBITER_DEMO_DATA_ENABLED=true

    volumes:
      - ./sample-files:/app/sample-files:ro
      # Test fixture for the Local Directory data source. Configure a Local
      # Directory source in the admin UI with directory path /app/local-files
      # to ingest the files in ./local-files. Mounted read-only so the
      # container can never modify the host directory.
      - ./local-files:/app/local-files:ro
      # Test fixture for the Local Directory destination. The DemoDataSourceLoader
      # registers an "output" destination pointing at /app/output, which maps to
      # the host's /tmp so finalized exports land somewhere easy to inspect.
      # Mounted read-write so the application can actually write export files.
      - /tmp:/app/output
    depends_on:
      mongodb:
        condition: service_healthy
      opensearch:
        condition: service_healthy
      elasticsearch:
        condition: service_healthy
      valkey:
        condition: service_healthy
      minio:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    networks:
      - arbiter

  valkey:
    image: valkey/valkey:8-alpine
    container_name: arbiter-valkey
    ports:
      - "6379"
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 5s
    networks:
      - arbiter

  mongodb:
    image: mongo:latest
    container_name: arbiter-mongodb
    ports:
      - "27017:27017"
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.runCommand({ping:1})"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - arbiter

  policy-editor:
    image: philterd/philterd-redaction-policy-editor:latest
    container_name: arbiter-policy-editor
    ports:
      - "8081:8080"
    networks:
      - arbiter

  opensearch:
    image: opensearchproject/opensearch:3.6.0
    container_name: arbiter-opensearch
    environment:
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
      - "DISABLE_SECURITY_PLUGIN=true"
      - "DISABLE_INSTALL_DEMO_CONFIG=true"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - "9200:9200"
    healthcheck:
      test: ["CMD-SHELL", "curl -fs http://localhost:9200 >/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - arbiter

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.15.0
    container_name: arbiter-elasticsearch
    environment:
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - "xpack.security.enabled=false"
      - "xpack.security.enrollment.enabled=false"
      - "xpack.security.http.ssl.enabled=false"
      - "xpack.security.transport.ssl.enabled=false"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - "9200"
    healthcheck:
      test: ["CMD-SHELL", "curl -fs http://localhost:9200 >/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - arbiter

  # S3-compatible object storage for the demo S3 data source.
  minio:
    image: minio/minio:latest
    container_name: arbiter-minio
    command: server /data --console-address ":9001"
    environment:
      - MINIO_ROOT_USER=minioadmin
      - MINIO_ROOT_PASSWORD=minioadmin
    ports:
      - "9000:9000"
      - "9001:9001"
    healthcheck:
      test: ["CMD-SHELL", "mc ready local || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s
    networks:
      - arbiter

  # One-shot bootstrap that waits for MinIO to become ready, creates the
  # "arbiter-demo" bucket, and seeds it with the bundled sample files.
  minio-init:
    image: minio/mc:latest
    container_name: arbiter-minio-init
    depends_on:
      minio:
        condition: service_healthy
    volumes:
      - ./sample-files:/sample-files:ro
    entrypoint: >
      /bin/sh -c "
        mc alias set local http://minio:9000 minioadmin minioadmin &&
        mc mb --ignore-existing local/arbiter-demo &&
        mc mirror --overwrite /sample-files/ local/arbiter-demo/arbiter-demo/ &&
        echo 'Seeded arbiter-demo bucket from /sample-files (under arbiter-demo/ prefix).'
      "
    networks:
      - arbiter

  # Lightweight PostgreSQL for the demo Relational Database data source.
  # First-boot initialisation runs every .sql file under
  # /docker-entrypoint-initdb.d/, so init-postgres.sql creates the
  # `documents(filename, text)` table and inserts synthetic PII rows.
  # DemoDataSourceLoader registers a matching "Demo PostgreSQL" data source
  # whose SQL query reads from that table.
  postgres:
    image: postgres:16-alpine
    container_name: arbiter-postgres
    environment:
      - POSTGRES_USER=arbiter_demo
      - POSTGRES_PASSWORD=arbiter_demo
      - POSTGRES_DB=arbiter_demo
    ports:
      - "5432:5432"
    volumes:
      - ./init-postgres.sql:/docker-entrypoint-initdb.d/01-documents.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U arbiter_demo -d arbiter_demo"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - arbiter

networks:
  arbiter:
    driver: bridge