docker-compose.yml

services:
  # PostgreSQL Database
  db:
    image: postgres:16-bookworm
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-agentgate}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env file}
      POSTGRES_DB: ${POSTGRES_DB:-agentgate}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-agentgate}"]
      interval: 5s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /var/run/postgresql

  # Redis for distributed rate limiting
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:-dev_redis_password_change_in_production}
    command: >
      redis-server
      --requirepass ${REDIS_PASSWORD:-dev_redis_password_change_in_production}
      --appendonly yes
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-dev_redis_password_change_in_production}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 128M
    security_opt:
      - no-new-privileges:true

  # FastAPI Backend
  server:
    build:
      context: .
      dockerfile: Dockerfile.server
      target: development
    ports:
      - "8000:8000"
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-agentgate}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env file}@db/${POSTGRES_DB:-agentgate}"
      SECRET_KEY: "${SECRET_KEY:?SECRET_KEY must be set in .env file}"
      ALLOWED_ORIGINS: "${ALLOWED_ORIGINS:-http://localhost:3000}"
      AGENTGATE_ENV: "${AGENTGATE_ENV:-development}"
      REDIS_URL: "${SERVER_REDIS_URL:-redis://:${REDIS_PASSWORD:-dev_redis_password_change_in_production}@redis:6379/0}"
      WORKERS: "${WORKERS:-1}"
      AGENTGATE_STATE_DIR: "/app/state"
      IDENTITY_PROVIDER_MODE: "${IDENTITY_PROVIDER_MODE:-local}"
      ALLOW_LOCAL_PASSWORD_AUTH: "${ALLOW_LOCAL_PASSWORD_AUTH:-false}"
      ALLOW_PRODUCTION_LOCAL_AUTH: "${ALLOW_PRODUCTION_LOCAL_AUTH:-false}"
      ROLE_OPERATOR_ALIAS_ENABLED: "${ROLE_OPERATOR_ALIAS_ENABLED:-true}"
      API_REFERENCE_ACCESS_MODE: "${API_REFERENCE_ACCESS_MODE:-public}"
      MCP_PRIVILEGED_ROLES: "${MCP_PRIVILEGED_ROLES:-admin}"
      MCP_REQUIRED_SCOPES: "${MCP_REQUIRED_SCOPES:-mcp:admin,mcp:access}"
      MCP_REQUIRE_SCOPE: "${MCP_REQUIRE_SCOPE:-false}"
      API_KEY_WILDCARD_ROLES: "${API_KEY_WILDCARD_ROLES:-admin,security_admin}"
      API_KEY_MCP_SCOPE_ROLES: "${API_KEY_MCP_SCOPE_ROLES:-admin,security_admin,developer}"
      API_KEY_ALLOWED_CUSTOM_SCOPES: "${API_KEY_ALLOWED_CUSTOM_SCOPES:-mcp:read,mcp:write,mcp:access,mcp:admin}"
      DESCOPE_JWKS_URL: "${DESCOPE_JWKS_URL:-}"
      DESCOPE_ISSUER: "${DESCOPE_ISSUER:-}"
      DESCOPE_AUDIENCE: "${DESCOPE_AUDIENCE:-}"
      OIDC_JWKS_URL: "${OIDC_JWKS_URL:-}"
      OIDC_ISSUER: "${OIDC_ISSUER:-}"
      OIDC_AUDIENCE: "${OIDC_AUDIENCE:-}"
    volumes:
      - server_state:/app/state
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health').read()"]
      interval: 30s
      timeout: 10s
      start_period: 40s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '0.9'
          memory: 3G
        reservations:
          cpus: '0.25'
          memory: 1G
    security_opt:
      - no-new-privileges:true

  # Next.js Dashboard
  dashboard:
    build:
      context: ./dashboard
      dockerfile: Dockerfile
      target: runner
    ports:
      - "3000:3000"
    environment:
      NEXTAUTH_URL: "${NEXTAUTH_URL:-http://localhost:3000}"
      NEXTAUTH_SECRET: "${NEXTAUTH_SECRET:?NEXTAUTH_SECRET must be set in .env file}"
      API_URL: "${API_URL:-http://server:8000}"
      AGENTGATE_API_URL: "${AGENTGATE_API_URL:-http://server:8000}"
      NEXT_PUBLIC_API_URL: "${NEXT_PUBLIC_API_URL:-http://localhost:8000}"
      NEXT_PUBLIC_DESCOPE_SIGNIN_URL: "${NEXT_PUBLIC_DESCOPE_SIGNIN_URL:-}"
      NEXT_PUBLIC_DESCOPE_SIGNUP_URL: "${NEXT_PUBLIC_DESCOPE_SIGNUP_URL:-}"
      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
      NODE_ENV: production
      NEXT_TELEMETRY_DISABLED: "1"
      PORT: 3000
      HOSTNAME: "0.0.0.0"
    depends_on:
      server:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3000/api/auth/session"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1024M
        reservations:
          cpus: '0.25'
          memory: 512M
    security_opt:
      - no-new-privileges:true

  # PostgreSQL Test Database (test profile only)
  db-test:
    image: postgres:16-bookworm
    environment:
      POSTGRES_USER: test
      POSTGRES_PASSWORD: test
      POSTGRES_DB: test_agentgate
    ports:
      - "5433:5432"
    profiles:
      - test
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U test"]
      interval: 5s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /var/run/postgresql

volumes:
  postgres_data:
  redis_data:
  server_state: