docker-compose.yml

services:
  # ===========================================================================
  # SPIRE Server — SPIFFE identity issuer and trust anchor
  # ===========================================================================
  spire-server:
    image: ghcr.io/spiffe/spire-server:1.11.2
    command: ["server", "--config", "/etc/spire/server.conf"]
    ports: ["8084:8084"]
    volumes:
      - "./config/spire/server.conf:/etc/spire/server.conf:ro"
      - "spire-data:/data/spire"
    healthcheck:
      test: ["CMD", "./bin/spire-server", "healthcheck", "-serverAddress", "0.0.0.0:8084"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - sovereign-isolated

  # ===========================================================================
  # SPIRE Agent — Workload attestation and SVID delivery
  # ===========================================================================
  spire-agent:
    image: ghcr.io/spiffe/spire-agent:1.11.2
    command: ["agent", "--config", "/etc/spire/agent.conf"]
    volumes:
      - "./config/spire/agent.conf:/etc/spire/agent.conf:ro"
      - "spire-data:/data/spire"
      - "/var/run/spire:/var/run/spire"   # Workload API UDS shared with services
      - "/etc/passwd:/etc/passwd:ro"       # UID-based workload attestation
    environment:
      SPIRE_JOIN_TOKEN: "${SPIRE_JOIN_TOKEN:-sovereign-default-token}"
    depends_on:
      spire-server:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "./bin/spire-agent", "healthcheck", "-socketPath", "/var/run/spire/agent.sock"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - sovereign-isolated

  # ===========================================================================
  # Keycloak — Identity Provider (OIDC/OAuth2)
  # ===========================================================================
  keycloak:
    image: quay.io/keycloak/keycloak:26.1
    command:
      - start-dev
      - --http-port=8083
      - --https-port=8443
      - --import-realm
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN:-admin}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
      KC_HOSTNAME: localhost
      KC_HTTP_ENABLED: "true"
    ports:
      - "8083:8083"
      - "8443:8443"
    volumes:
      - "./config/keycloak:/opt/keycloak/data/import:ro"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8083/realms/master"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - sovereign-isolated

  # ===========================================================================
  # OpenTelemetry Collector — Observability pipeline
  # ===========================================================================
  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.122.0
    command:
      - --config=/etc/otel-collector.yaml
    ports:
      - "4317:4317"
      - "4318:4318"
    volumes:
      - "./config/otel-collector.yaml:/etc/otel-collector.yaml:ro"
    networks:
      - sovereign-isolated

  # ===========================================================================
  # Gateway — OpenAI-compatible proxy with auth, DLP, compliance lock
  # ===========================================================================
  gateway:
    build: .
    command: uvicorn services.gateway_service:app --host 0.0.0.0 --port 8080
    ports: ["8080:8080"]
    env_file: [.env]
    environment:
      - COMPUTE_URL=http://vllm:8000
      - MEMORY_URL=http://memory:8082
      - OIDC_ISSUER_URL=http://keycloak:8083/realms/sovereign
      - OIDC_CLIENT_ID=sovereign-gateway
      - OASA_ENFORCE_COMPLIANCE=${OASA_ENFORCE_COMPLIANCE:-STRICT}
      - OASA_ENFORCE_AUTH=${OASA_ENFORCE_AUTH:-STRICT}
      - OASA_ENFORCE_POLICY=${OASA_ENFORCE_POLICY:-STRICT}
      - SPIFFE_ENABLED=${SPIFFE_ENABLED:-true}
    depends_on:
      vllm:
        condition: service_healthy
      memory:
        condition: service_started
      keycloak:
        condition: service_healthy
      spire-agent:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8080/health')"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - sovereign-isolated
      - sovereign-public

  # ===========================================================================
  # vLLM — High-performance inference engine (OpenAI-compatible API)
  # ===========================================================================
  vllm:
    image: vllm/vllm-openai:v0.7.2
    command:
      - vllm
      - serve
      - /data/${VLLM_MODEL_NAME:-Qwen/Qwen2.5-7B-Instruct}
      - --port
      - "8000"
      - --max-model-len
      - "${VLLM_MAX_MODEL_LEN:-4096}"
      - --gpu-memory-utilization
      - "${VLLM_GPU_MEMORY_UTIL:-0.90}"
      - --enable-flash-attention
    environment:
      - HF_HUB_OFFLINE=1
      - VLLM_ATTENTION_BACKEND=FLASH_ATTN
    ports: ["8000:8000"]
    volumes:
      - "./models:/data:ro"
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: ${VLLM_GPU_COUNT:-1}
              capabilities: [gpu]
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    restart: unless-stopped
    networks:
      - sovereign-isolated

  federation:
    build: .
    container_name: sovereignstack-federation
    command: uvicorn services.federation_service:app --host 0.0.0.0 --port 8088
    networks:
      - sovereign-isolated
    ports:
      - "8088:8088"
    env_file: [.env]
    environment:
      - NODE_ID=${FEDERATION_NODE_ID:-sovereign-node-1}
      - FEDERATION_TOKEN=${FEDERATION_TOKEN:-default-federation-token}
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8088/health')"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped

  # ===========================================================================
  # Ingest — Document ingestion service
  # ===========================================================================
  ingest:
    build: .
    command: uvicorn services.ingest_service:app --host 0.0.0.0 --port 8081
    ports: ["8081:8081"]
    volumes: ["./data:/app/data"]
    env_file: [.env]
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8081/health')"]
      interval: 15s
      timeout: 5s
      retries: 3
    networks:
      - sovereign-isolated

  # ===========================================================================
  # Memory — Vector store and KV cache (TurboMemory)
  # ===========================================================================
  memory:
    build: .
    command: uvicorn services.memory_service:app --host 0.0.0.0 --port 8082
    ports: ["8082:8082"]
    volumes: ["./data:/app/data"]
    env_file: [.env]
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8082/health')"]
      interval: 15s
      timeout: 5s
      retries: 3
    networks:
      - sovereign-isolated

  # ===========================================================================
  # Enterprise — Support contracts, SLA, managed updates, licensing
  # ===========================================================================
  enterprise:
    build: .
    command: uvicorn services.enterprise_service:app --host 0.0.0.0 --port 8085
    ports: ["8085:8085"]
    volumes: ["./data:/app/data"]
    env_file: [.env]
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8085/health')"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 5s
    networks:
      - sovereign-isolated

  # ===========================================================================
  # Weight Federation — Sharded secure cross-node inference
  # ===========================================================================
  weight-federation:
    build: .
    command: uvicorn services.weight_federation_service:app --host 0.0.0.0 --port 8087
    ports: ["8087:8087"]
    volumes: ["./data:/app/data"]
    env_file: [.env]
    environment:
      - NODE_ID=weight-federation-node-1
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8087/health')"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 5s
    networks:
      - sovereign-isolated

  # ===========================================================================
  # Certification — Registry, verification, certified entity management
  # ===========================================================================
  certification:
    build: .
    command: uvicorn services.certification_service:app --host 0.0.0.0 --port 8086
    ports: ["8086:8086"]
    volumes: ["./data:/app/data"]
    env_file: [.env]
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8086/health')"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 5s
    networks:
      - sovereign-isolated

  # ===========================================================================
  # Prometheus — Metrics scraping
  # ===========================================================================
  prometheus:
    image: prom/prometheus:v3.3.0
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --web.console.libraries=/usr/share/prometheus/console_libraries
      - --web.console.templates=/usr/share/prometheus/consoles
    ports: ["9090:9090"]
    volumes:
      - "./config/prometheus.yml:/etc/prometheus/prometheus.yml:ro"
    networks:
      - sovereign-isolated

  # ===========================================================================
  # Dashboard — Web UI for SovereignStack
  # ===========================================================================
  dashboard:
    build: ./dashboard
    container_name: sovereignstack-dashboard
    ports:
      - "3000:3000"
    networks:
      - sovereign-isolated
      - sovereign-public

volumes:
  spire-data:

networks:
  sovereign-isolated:
    driver: bridge
    internal: true
    name: sovereign-isolated-net
  sovereign-public:
    driver: bridge
    name: sovereign-public-net