docker-compose.yml

version: '3.8'

services:
  db:
    image: postgres:15-alpine
    container_name: deeptrail_control_db
    environment:
      POSTGRES_USER: deepsecure_user
      POSTGRES_PASSWORD: deepsecure_password
      POSTGRES_DB: deeptrail_controldb
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5434:5432" # Expose on 5434 to avoid conflict
    networks:
      - deepsecure_network
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U deepsecure_user -d deeptrail_controldb" ]
      interval: 10s
      timeout: 5s
      retries: 5

  # Redis service for gateway split-key storage
  redis:
    image: redis:7-alpine
    container_name: deeptrail_gateway_redis
    ports:
      - "6380:6379" # Expose on 6380 to avoid conflict
    volumes:
      - redis_data:/data
    networks:
      - deepsecure_network
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 5s
      timeout: 3s
      retries: 5
    command: redis-server --appendonly yes # Enable persistence

  keycloak:
    image: quay.io/keycloak/keycloak:24.0
    container_name: deeptrail_keycloak
    entrypoint: ["/bin/bash", "/opt/keycloak/data/import/keycloak-start.sh"]
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=admin
      - KC_HEALTH_ENABLED=true
      - KC_HOSTNAME_STRICT=false
      - KC_HTTP_ENABLED=true
    ports:
      - "8080:8080"
    volumes:
      - ./config/keycloak:/opt/keycloak/data/import
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n' >&3 && head -1 <&3 | grep -q '200'"]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 30s
    depends_on:
      - db
    networks:
      - deepsecure_network

  deeptrail-control:
    build:
      context: ./deeptrail-control
    container_name: deeptrail_control_app
    ports:
      - "8000:8001"
    depends_on:
      db:
        condition: service_healthy
    env_file:
      - path: .env.google
        required: false
      - path: .env.services
        required: false
    environment:
      - DATABASE_URL=postgresql://deepsecure_user:deepsecure_password@db/deeptrail_controldb
      - SECRET_KEY=your-secret-key-for-jwt
      - BACKEND_API_TOKEN=DEFAULT_QUICKSTART_TOKEN
      - GATEWAY_URL=http://deeptrail-gateway:8001
      - GATEWAY_INTERNAL_API_TOKEN=gateway-internal-secret-token

      # This tells the service where to find the policy file we mounted below.
      - POLICY_PATH=/app/policies.yml

      # Other app settings
      - ALGORITHM=HS256
      - VAULT_ENCRYPTION_KEY=6aXYH6SUDBHEeLRLpJUUe14B2JVnWQItH4NyJxXxFgA=
      - POSTGRES_DRIVER=psycopg2
      # Pass the current DeepSecure version to the container
      - DEEPSECURE_VERSION=0.1.12

      # Redis URL for cache invalidation pub/sub
      - REDIS_URL=redis://redis:6379

      # IdP Configuration (Keycloak dev-time)
      # IDP_ISSUER_URL uses the Docker-internal hostname for server-to-server
      # token validation; IDP_BROWSER_URL exposes the host-reachable URL that
      # the authorize endpoint returns to browsers (and host-side test/demo
      # scripts such as scripts/demo_sarah_journey.sh that cannot resolve
      # `keycloak:8080`).
      - IDP_PROVIDER=keycloak
      - IDP_ISSUER_URL=http://keycloak:8080/realms/deepsecure
      - IDP_BROWSER_URL=http://localhost:8080/realms/deepsecure
      - IDP_CLIENT_ID=deepsecure-control
      - IDP_CLIENT_SECRET=control-secret
      - IDP_REALM=deepsecure
      - IDP_REDIRECT_URI=http://localhost:8000/api/v1/auth/sso/callback

      # OAuth Configuration (test values for integration testing)
      # Caddy TLS proxy on :8443 handles OAuth callbacks requiring HTTPS (e.g. Slack)
      - OAUTH_REDIRECT_BASE_URL=https://localhost:8443
      # Notion + Slack OAuth credentials loaded from .env.services (via env_file above).
      # Google OAuth credentials loaded from .env.google (via env_file above).
      # GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_HD are set there.
      # Google Workspace Directory API (service account with domain-wide delegation)
      - FERNET_KEY=8hRIHNo6DAfIIq3Oy-Ql2wK4GSn8sRLKiQbZ_BFs1Xg=
      - IDP_FETCH_GROUPS=true
      - GOOGLE_SERVICE_ACCOUNT_EMAIL=deepsecure-admin@gen-lang-client-0227820266.iam.gserviceaccount.com
      - GOOGLE_ADMIN_EMAIL=mahendra@deeptrail.com
      - GOOGLE_APPLICATION_CREDENTIALS=/gcloud/application_default_credentials.json
      
    volumes:
      # Mount the policies file into the container to make it accessible to the service.
      # The ':ro' makes the file read-only inside the container for better security.
      - ./deeptrail-control/policies.yml:/app/policies.yml:ro
      - ./deeptrail-control/group_policies.yaml:/app/group_policies.yaml:ro
      # Mount ADC credentials for local dev (Directory API via service account)
      - ${HOME}/.config/gcloud/application_default_credentials.json:/gcloud/application_default_credentials.json:ro
      
    networks:
      - deepsecure_network

  # TLS reverse proxy for OAuth callbacks (Slack requires HTTPS redirect URIs).
  # Serves https://localhost:8443 → proxies to deeptrail-control:8001 (HTTP).
  # When a frontend is added, Caddy gets replaced and the mkcert certs stay.
  caddy:
    image: caddy:2-alpine
    container_name: deeptrail_caddy
    ports:
      - "8443:443"
    volumes:
      - ./config/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./config/certs:/etc/caddy/certs:ro
    depends_on:
      - deeptrail-control
    networks:
      - deepsecure_network

  deeptrail-gateway:
    build:
      context: ./deeptrail-gateway
    container_name: deeptrail_gateway_app
    ports:
      - "8002:8001"
    depends_on:
      - deeptrail-control
      - redis
    environment:
      - CONTROL_PLANE_URL=http://deeptrail-control:8001
      - SECRET_KEY=your-secret-key-for-jwt
      - REDIS_URL=redis://redis:6379
      - GATEWAY_ENCRYPTION_KEY=gateway-master-encryption-key-32-chars
      - GATEWAY_INTERNAL_API_TOKEN=gateway-internal-secret-token
      # Pass the current DeepSecure version to the container
      - DEEPSECURE_VERSION=0.1.12
      # OAuth / MCP realm (internal JWKS URL vs public issuer for token validation)
      - KEYCLOAK_URL=http://keycloak:8080
      - KEYCLOAK_ISSUER_URL=http://localhost:8080
      - KEYCLOAK_MCP_REALM=mcp
      - OAUTH_AUDIENCE=mcp-gateway
    networks:
      - deepsecure_network

  frontend:
    build:
      context: ./frontend
    container_name: deeptrail_frontend
    ports:
      - "3000:3000"
    depends_on:
      - deeptrail-control
      - deeptrail-gateway
    environment:
      - NODE_ENV=production
      - DEEPTRAIL_CONTROL_INTERNAL_URL=http://deeptrail-control:8001
      - DEEPTRAIL_GATEWAY_INTERNAL_URL=http://deeptrail-gateway:8001
      - NEXT_PUBLIC_APP_NAME=DeepSecure
      - NEXT_PUBLIC_DEMO_ENABLED=true
      - FRONTEND_ORIGIN=http://localhost:3000
      - SESSION_SECRET=${SESSION_SECRET:-dev-session-secret-change-in-prod-32chars}
      - CSRF_SECRET=${CSRF_SECRET:-dev-csrf-secret-change-in-production}
    networks:
      - deepsecure_network

volumes:
  postgres_data:
  redis_data:

networks:
  deepsecure_network:
    driver: bridge