docker-compose.yml

# ANet University — full-stack development & production base
#
# Bring up:   docker compose up -d
# Status:     docker compose ps
# Logs:       docker compose logs -f api
# Tear down:  docker compose down  (use `-v` to also wipe volumes)
#
# Profiles allow opting out of heavy components in dev:
#   docker compose --profile core up        # minimal: db + redis + api + mcp
#   docker compose --profile full up        # everything (default)
#   docker compose --profile obs up         # add observability stack
#
# All component versions are pinned. Update via PRs only.

name: anu

x-env-base: &env-base
  TZ: ${TZ:-UTC}
  PYTHONUNBUFFERED: "1"
  PYTHONDONTWRITEBYTECODE: "1"
  LOG_LEVEL: ${LOG_LEVEL:-info}

x-anu-env: &anu-env
  # Shared by api / mcp / worker
  ANU_DATABASE_URL: postgresql+asyncpg://anu:${POSTGRES_PASSWORD:?set in .env}@postgres:5432/anu
  ANU_DATABASE_URL_SYNC: postgresql://anu:${POSTGRES_PASSWORD:?set in .env}@postgres:5432/anu
  ANU_REDIS_URL: redis://redis:6379/0
  ANU_OBJECT_STORE_ENDPOINT: http://minio:9000
  ANU_OBJECT_STORE_REGION: us-east-1
  ANU_OBJECT_STORE_ACCESS_KEY: ${MINIO_ROOT_USER:?set in .env}
  ANU_OBJECT_STORE_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?set in .env}
  ANU_OBJECT_STORE_BUCKET: anu
  ANU_ANET_DAEMON_URL: http://anet-daemon:3998
  ANU_ANET_TOKEN_FILE: /var/anet-data/api_token
  ANU_ENVIRONMENT: ${ANU_ENVIRONMENT:-development}
  ANU_SECRET_KEY: ${ANU_SECRET_KEY:?set in .env}
  ANU_STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
  ANU_STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
  ANU_CLERK_SECRET_KEY: ${CLERK_SECRET_KEY:-}
  ANU_CLERK_JWT_AUDIENCE: ${CLERK_JWT_AUDIENCE:-}
  ANU_ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
  ANU_ANTHROPIC_BASE_URL: ${ANTHROPIC_BASE_URL:-https://api.anthropic.com}
  ANU_VOYAGE_API_KEY: ${VOYAGE_API_KEY:-}
  ANU_COHERE_API_KEY: ${COHERE_API_KEY:-}
  ANU_FIRECRAWL_API_KEY: ${FIRECRAWL_API_KEY:-}
  ANU_E2B_API_KEY: ${E2B_API_KEY:-}
  ANU_SEMANTIC_SCHOLAR_API_KEY: ${SEMANTIC_SCHOLAR_API_KEY:-}
  SENTRY_DSN: ${SENTRY_DSN:-}
  OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}

# ─────────────────────────────────────────────────────────────────────────
# Services
# ─────────────────────────────────────────────────────────────────────────
services:

  # 1. Postgres 16 + pgvector + Apache AGE (custom image)
  postgres:
    build:
      context: ./infra/postgres
      dockerfile: Dockerfile
    image: anu/postgres:16-pgvector-age
    profiles: ["core", "full", "obs"]
    environment:
      <<: *env-base
      POSTGRES_USER: anu
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
      POSTGRES_DB: anu
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./infra/postgres/init:/docker-entrypoint-initdb.d:ro
    ports:
      - "${POSTGRES_HOST_PORT:-5432}:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U anu -d anu"]
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

  # 2. Redis (cache, rate limit, pub-sub, Arq queue)
  redis:
    image: redis:7.4-alpine
    profiles: ["core", "full", "obs"]
    command: ["redis-server", "--appendonly", "yes", "--maxmemory", "512mb", "--maxmemory-policy", "allkeys-lru"]
    volumes:
      - redis_data:/data
    ports:
      - "${REDIS_HOST_PORT:-6379}:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10
    restart: unless-stopped

  # 3. MinIO — S3-compatible object store for CAS (lessons, reports, bundles)
  minio:
    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
    profiles: ["core", "full", "obs"]
    command: ["server", "/data", "--console-address", ":9001"]
    environment:
      <<: *env-base
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:?set in .env}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?set in .env}
    volumes:
      - minio_data:/data
    ports:
      - "${MINIO_S3_PORT:-9000}:9000"
      - "${MINIO_CONSOLE_PORT:-9001}:9001"
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:9000/minio/health/ready"]
      interval: 10s
      timeout: 5s
      retries: 6
    restart: unless-stopped

  # 4. MinIO bucket bootstrap (one-shot)
  minio-init:
    image: minio/mc:RELEASE.2025-04-16T18-13-26Z
    profiles: ["core", "full", "obs"]
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c '
      mc alias set local http://minio:9000 "$$MINIO_ROOT_USER" "$$MINIO_ROOT_PASSWORD" &&
      mc mb --ignore-existing local/anu &&
      mc anonymous set download local/anu/public &&
      echo "MinIO buckets ready"
      '
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:?set in .env}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?set in .env}
    restart: "no"

  # 5. AgentNetwork daemon — local libp2p node + REST API on :3998
  anet-daemon:
    build:
      context: ./infra/anet
      dockerfile: Dockerfile
    image: anu/anet-daemon:latest
    profiles: ["full"]
    environment:
      <<: *env-base
      AGENTNETWORK_DATA_DIR: /var/anet-data
      ANET_API_HOST: 0.0.0.0
      ANET_API_PORT: "3998"
    volumes:
      - anet_data:/var/anet-data
    ports:
      - "${ANET_API_PORT:-3998}:3998"
      # libp2p p2p ports — adjust if anet uses different defaults
      - "${ANET_P2P_PORT:-4001}:4001"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:3998/api/status || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s
    restart: unless-stopped

  # 6. API — FastAPI backend (auth, enroll, exam, services, studio, audit)
  api:
    build:
      context: ./apps/api
      dockerfile: Dockerfile
      target: ${BUILD_TARGET:-runtime}
      additional_contexts:
        repo-root: ./   # exposes install.sh + Docs/ for COPY --from=repo-root
    image: anu/api:${ANU_VERSION:-dev}
    profiles: ["core", "full", "obs"]
    environment:
      <<: [*env-base, *anu-env]
      ANU_SERVICE_NAME: api
      ANU_WEB_BASE_URL: ${ANU_WEB_BASE_URL:-http://localhost:3000}
      ANU_API_BASE_URL: ${ANU_API_BASE_URL:-http://localhost:8000}
      ANU_PUBLIC_BASE_URL: ${ANU_PUBLIC_BASE_URL:-http://localhost:8000}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully
    volumes:
      - anet_data:/var/anet-data:ro
      # Dev hot-reload: mount only source subtrees so the image's /app/.venv
      # and built artifacts stay intact. Remove for prod compose overlay.
      - ./apps/api/anu:/app/anu:cached
      - ./apps/api/anu_skills:/app/anu_skills:cached
      - ./apps/api/alembic:/app/alembic:cached
      - ./apps/api/alembic.ini:/app/alembic.ini:ro
      - ./install.sh:/app/install.sh:ro
      # Dev convenience: seed_data.py + ops scripts available inside the container
      - ./scripts:/opt/anu/scripts:ro
    ports:
      - "${API_HOST_PORT:-8000}:8000"
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 20s
    restart: unless-stopped

  # 7. MCP server — Streamable HTTP + SSE transport, fronted via api or direct
  mcp:
    build:
      context: ./apps/mcp
      dockerfile: Dockerfile
    image: anu/mcp:${ANU_VERSION:-dev}
    profiles: ["core", "full", "obs"]
    environment:
      <<: [*env-base, *anu-env]
      ANU_SERVICE_NAME: mcp
      ANU_API_INTERNAL_URL: http://api:8000
      ANU_MCP_BIND_HOST: 0.0.0.0
      ANU_MCP_BIND_PORT: "7900"
    depends_on:
      api:
        condition: service_healthy
    volumes:
      - anet_data:/var/anet-data:ro
      - ./apps/mcp/anu_mcp:/app/anu_mcp:cached
    ports:
      - "${MCP_HOST_PORT:-7900}:7900"
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:7900/health"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 15s
    restart: unless-stopped

  # 8. Worker — Arq async tasks (LLM grading, review pipeline, studio.build)
  worker:
    build:
      context: ./apps/worker
      dockerfile: Dockerfile
    image: anu/worker:${ANU_VERSION:-dev}
    profiles: ["full", "obs"]
    environment:
      <<: [*env-base, *anu-env]
      ANU_SERVICE_NAME: worker
      ANU_API_INTERNAL_URL: http://api:8000
      ANU_WORKER_CONCURRENCY: "${WORKER_CONCURRENCY:-8}"
    depends_on:
      api:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - anet_data:/var/anet-data:ro
      - ./apps/worker/anu_worker:/app/anu_worker:cached
    restart: unless-stopped

  # 9. Web — Next.js 15 (SaaS landing + transcript pages + admin)
  web:
    build:
      context: ./apps/web
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_API_BASE_URL: ${ANU_API_BASE_URL:-http://localhost:8000}
        NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${CLERK_PUBLISHABLE_KEY:-}
        NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-}
    image: anu/web:${ANU_VERSION:-dev}
    profiles: ["full", "obs"]
    environment:
      <<: *env-base
      NODE_ENV: ${NODE_ENV:-production}
      PORT: "3000"
      NEXT_PUBLIC_API_BASE_URL: ${ANU_API_BASE_URL:-http://localhost:8000}
      NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${CLERK_PUBLISHABLE_KEY:-}
      NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-}
      CLERK_SECRET_KEY: ${CLERK_SECRET_KEY:-}
    depends_on:
      api:
        condition: service_healthy
    ports:
      - "${WEB_HOST_PORT:-3000}:3000"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
      interval: 15s
      timeout: 5s
      retries: 6
      start_period: 30s
    restart: unless-stopped

  # 10. Mailhog — dev SMTP capture
  mailhog:
    image: mailhog/mailhog:v1.0.1
    profiles: ["full"]
    ports:
      - "${MAILHOG_SMTP_PORT:-1025}:1025"
      - "${MAILHOG_UI_PORT:-8025}:8025"
    restart: unless-stopped

  # 11. OpenTelemetry collector — receives traces from api/mcp/worker
  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.112.0
    profiles: ["obs"]
    command: ["--config=/etc/otelcol/config.yaml"]
    volumes:
      - ./infra/otel/config.yaml:/etc/otelcol/config.yaml:ro
    ports:
      - "${OTEL_GRPC_PORT:-4317}:4317"
      - "${OTEL_HTTP_PORT:-4318}:4318"
    restart: unless-stopped

  # 12. Grafana — local Grafana for dev observability (prod uses Grafana Cloud)
  grafana:
    image: grafana/grafana:11.4.0
    profiles: ["obs"]
    environment:
      <<: *env-base
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
    volumes:
      - grafana_data:/var/lib/grafana
    ports:
      - "${GRAFANA_PORT:-3001}:3000"
    restart: unless-stopped

# ─────────────────────────────────────────────────────────────────────────
# Volumes (named — survive `docker compose down`; remove with `-v`)
# ─────────────────────────────────────────────────────────────────────────
volumes:
  postgres_data:
  redis_data:
  minio_data:
  anet_data:
  grafana_data:

# ─────────────────────────────────────────────────────────────────────────
# Networks (default bridge is fine for now)
# ─────────────────────────────────────────────────────────────────────────
networks:
  default:
    name: anu_net