docker-compose.yml

services:
  postgres:
    # Postgres 16. Tag is overridable via POSTGRES_IMAGE for
    # air-gapped hosts that have a specific tag pre-cached.
    image: ${POSTGRES_IMAGE:-postgres:16-alpine}
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-simpleaudit}
      POSTGRES_USER: ${POSTGRES_USER:-simpleaudit}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      # Creates the separate Hatchet queue database on first init.
      # Only runs when the data volume is empty (fresh install).
      - ./deploy/postgres-init.sql:/docker-entrypoint-initdb.d/10-hatchet-db.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-simpleaudit} -d ${POSTGRES_DB:-simpleaudit}"]
      interval: 5s
      timeout: 3s
      retries: 20


  # core stack (postgres + hatchet + web + worker) can run on hosts that cannot
  # pull MinIO; enable with `docker compose --profile storage up`. The audit
  # execution path does not require it — only large-artifact persistence does.
  mock-model:
    profiles: ["mock"]
    # Compose application image (web + worker only). The root Dockerfile is the
    # single-container HF Space image and must NOT be used here.
    build:
      context: .
      dockerfile: deploy/compose/Dockerfile
    command: python /app/deploy/mock_openai_server.py
    environment:
      PORT: "8901"
    ports:
      - "8901:8901"
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request;urllib.request.urlopen('http://localhost:8901/healthz',timeout=3)\" || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10

  # Durable workflow engine.
  # Postgres-backed task queue that coordinates audit execution. It is NOT the
  # authoritative SimpleAudit database; PostgreSQL domain tables remain source of truth.
  #
  # The default image is hatchet-lite-dev (authentication compiled out) so a
  # fresh `docker compose up` works turnkey: workers connect with the fixed
  # worker token the dev image seeds into the DB (see HATCHET_API_KEY below,
  # populated by the bootstrap_platform command on first start). For hardened
  # deployments set HATCHET_IMAGE to the auth-enabled hatchet-lite and provide
  # your own HATCHET_API_KEY.
  hatchet-server:
    image: ${HATCHET_IMAGE:-ghcr.io/hatchet-dev/hatchet/hatchet-lite-dev:latest}
    environment:
      # Full config per https://docs.hatchet.run/self-hosting/configuration-options
      DATABASE_URL: postgresql://${POSTGRES_USER:-simpleaudit}:${POSTGRES_PASSWORD}@postgres:5432/${HATCHET_DB:-hatchet}?sslmode=disable
      # Session store requires an explicit cookie domain.
      SERVER_AUTH_COOKIE_DOMAIN: ${HATCHET_COOKIE_DOMAIN:-localhost}
      SERVER_AUTH_COOKIE_INSECURE: "t"
      SERVER_AUTH_SET_EMAIL_VERIFIED: "t"
      # gRPC: workers connect over plaintext inside the compose network.
      SERVER_GRPC_BIND_ADDRESS: "0.0.0.0"
      SERVER_GRPC_INSECURE: "t"
      SERVER_GRPC_BROADCAST_ADDRESS: hatchet-server:7077
      SERVER_GRPC_PORT: "7077"
      SERVER_HTTP_PORT: "8888"
      SERVER_URL: http://hatchet-server:8888
      SERVER_LOG_LEVEL: info
      SERVER_INTERNAL_CLIENT_INTERNAL_GRPC_BROADCAST_ADDRESS: hatchet-server:7077
    ports:
      - "8888:8888"   # Hatchet HTTP API / dashboard
      - "7077:7077"   # gRPC (worker <-> server)
    volumes:
      # The auth-disabled dev image writes its fixed worker JWT here at startup.
      # Mounted read-only into the worker so a fresh `docker compose up` works
      # turnkey (see HATCHET_TOKEN_FILE on the worker). Ignored when using the
      # auth-enabled image with an explicit HATCHET_API_KEY.
      - hatchet_config:/config
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8888/healthz || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 20

  # SimpleAudit worker pool. Runs separately from the web process; the web server
  # never executes model calls. Scale by adding replicas or GPU-labeled workers.
  worker:
    # Compose application image (web + worker only). The root Dockerfile is the
    # single-container HF Space image and must NOT be used here.
    build:
      context: .
      dockerfile: deploy/compose/Dockerfile
    env_file: .env
    environment:
      POSTGRES_HOST: postgres
      HATCHET_SERVER_URL: http://hatchet-server:8888
      HATCHET_GRPC_URL: hatchet-server:7077
      WORKER_POOL: ${WORKER_POOL:-cpu}
      # Worker reads its API token from this file (written by the auth-disabled
      # hatchet dev image). Set HATCHET_API_KEY in .env to override with an
      # explicit token for the auth-enabled image.
      HATCHET_TOKEN_FILE: /config/authdisabled-token
    volumes:
      - hatchet_config:/config:ro
    depends_on:
      postgres:
        condition: service_healthy
      hatchet-server:
        condition: service_healthy
    command: python manage.py run_worker --pool ${WORKER_POOL:-cpu}
    # Liveness: the worker runs as PID 1 and stays alive while connected to
    # Hatchet; if it exits (e.g. cannot connect after retries) the container
    # dies and restarts. The slim image has no ps/pgrep, so we read /proc/1/
    # cmdline to confirm the run_worker process is the live entrypoint.
    healthcheck:
      test: ["CMD-SHELL", "tr '\\0' ' ' < /proc/1/cmdline | grep -q 'run_worker' || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    restart: unless-stopped

  web:
    build:
      context: .
      dockerfile: deploy/compose/Dockerfile
    env_file: .env
    environment:
      POSTGRES_HOST: postgres
      HATCHET_SERVER_URL: http://hatchet-server:8888
      HATCHET_GRPC_URL: hatchet-server:7077
      # Web enqueues audit tasks to Hatchet, so it needs the same worker API
      # token as the worker. The auth-disabled dev image writes a per-instance
      # JWT to this file; mounting the shared config volume read-only makes a
      # fresh `docker compose up` work turnkey. Set HATCHET_API_KEY in .env to
      # override with an explicit token for the auth-enabled image.
      HATCHET_TOKEN_FILE: /config/authdisabled-token
      # Server-side model/knowledge sync must reach Open WebUI at its /chat
      # subpath on the internal network (the default 127.0.0.1:8080 is the
      # web container's own loopback — unreachable from inside). Harmless
      # while chat is off: the sync only runs when SIMPLEAUDIT_CHAT is on,
      # and by then the open-webui compose name resolves.
      SIMPLEAUDIT_CHAT_UPSTREAM: http://open-webui:8080/chat
    volumes:
      - hatchet_config:/config:ro
    depends_on:
      postgres:
        condition: service_healthy
      hatchet-server:
        condition: service_healthy
    # No published port: chat-proxy (Caddy) is the front door on :8000.
    # Single-line sh -c so the argument list is unambiguous (a folded YAML block
    # previously broke the flag parsing). Migrate + idempotent bootstrap +
    # idempotent seed (scenario packs + models + demo audits) + static
    # collection, then serve with gunicorn. The seed is safe on every start:
    # it skips anything already present. Set SEED_ON_BOOT=false to opt out.
    # Set SEED_DEMO_AUDITS=false to skip demo audit runs only.
    command: 'sh -c "python manage.py migrate --noinput && python manage.py bootstrap_platform --username ${BOOTSTRAP_USERNAME:-studio} --email ${BOOTSTRAP_EMAIL:-admin@example.local} --password ${BOOTSTRAP_PASSWORD:?Set BOOTSTRAP_PASSWORD in .env} --project-name ${BOOTSTRAP_PROJECT_NAME:-Default} && if [ "${SEED_ON_BOOT:-true}" != "false" ]; then SEED_ARGS=\"\"; if [ \"${SEED_DEMO_AUDITS:-true}\" = \"false\" ]; then SEED_ARGS=\"--skip-demo-audits\"; fi; python manage.py seed_platform $$SEED_ARGS || echo ''WARNING: seed_platform failed - continuing without seed data''; fi && python manage.py collectstatic --noinput && gunicorn config.wsgi:application -c gunicorn.conf.py"'
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8000/healthz"]
      interval: 30s
      timeout: 5s
      retries: 5
    # Matches the worker. The whole command is idempotent (migrate, bootstrap
    # and seed all skip what already exists), so a restart is safe and a
    # gunicorn crash or a Postgres blip no longer leaves the UI down for good.
    # A bad .env still fails every attempt, but the error repeats in the logs
    # instead of being printed once into a container nobody looks at.
    restart: unless-stopped

  # Chat module — ON by default. .env carries both switches (SIMPLEAUDIT_CHAT=docker
  # so the web service serves /playground/ + /chat/authz, COMPOSE_PROFILES=chat so the
  # open-webui container joins a plain `docker compose up -d`); comment them out
  # to leave chat out entirely. See chat/config.py.
  #
  # Single-origin model: chat-proxy (Caddy) is the ONLY published port and fronts
  # both Studio and Open WebUI. Open WebUI publishes NO port: chat-proxy is the
  # only route to it, because it trusts the identity headers on any request it
  # receives (a forged X-Studio-Role: admin would be instant takeover).
  #
  # The image is the subpath fork (deploy/openwebui-subpath/build.sh): built with
  # WEBUI_SUBPATH=/chat so it serves its whole app AT /chat. chat-proxy must
  # forward /chat/* WITHOUT stripping the prefix (see the Caddyfile header).
  open-webui:
    profiles: ["chat"]
    image: ${OPEN_WEBUI_IMAGE:-ghcr.io/sushantgautam/open-webui:v0.12.0-subpath}
    environment:
      WEBUI_SUBPATH: /chat
      WEBUI_AUTH_TRUSTED_EMAIL_HEADER: X-Studio-Email
      WEBUI_AUTH_TRUSTED_NAME_HEADER: X-Studio-Name
      WEBUI_AUTH_TRUSTED_ROLE_HEADER: X-Studio-Role
      ENABLE_SIGNUP: "false"
      # Nothing in this stack serves Ollama; Open WebUI polls it otherwise.
      ENABLE_OLLAMA_API: "false"
      # Same origin as Studio; the browser reaches it at /chat/ via chat-proxy.
      WEBUI_URL: ${SIMPLEAUDIT_STUDIO_URL:-http://localhost:8000}/chat/
      # The image entrypoint is start.sh (no `open-webui` CLI on PATH); it reads
      # HOST/PORT and launches uvicorn itself.
      HOST: "0.0.0.0"
      PORT: ${SIMPLEAUDIT_CHAT_UPSTREAM_PORT:-8080}
      # Optional: export Open WebUI's spans to Studio's OTLP listener. Off by
      # default — set SIMPLEAUDIT_CHAT_OTLP=true to enable. Open WebUI passes
      # OTEL_EXPORTER_OTLP_ENDPOINT to its HTTP exporter as-is, so this must be
      # the full Studio ingestion URL. Exports
      # unauthenticated by default (matches an enabled "none" credential); for a
      # basic/bearer credential set OTEL_BASIC_AUTH_USERNAME / OTEL_BASIC_AUTH_PASSWORD.
      ENABLE_OTEL: ${SIMPLEAUDIT_CHAT_OTLP:-false}
      ENABLE_OTEL_TRACES: ${SIMPLEAUDIT_CHAT_OTLP:-false}
      OTEL_OTLP_SPAN_EXPORTER: "http"
      OTEL_EXPORTER_OTLP_ENDPOINT: ${SIMPLEAUDIT_CHAT_OTLP_ENDPOINT:-http://web:8000/otlp/v1/traces}
      OTEL_SERVICE_NAME: ${SIMPLEAUDIT_CHAT_OTLP_SERVICE_NAME:-open-webui}
    volumes:
      - open_webui_data:/app/backend/data
    restart: unless-stopped

  # The single published port for the whole stack, in EVERY configuration:
  # Studio at /, its wrapper at /playground/, and — with the chat profile — the embedded chat
  # at /chat/. Without the profile the /chat/* rules simply 502 (no upstream);
  # Studio 404s /chat/ and /playground/ anyway because SIMPLEAUDIT_CHAT is off.
  # No depends_on on open-webui on purpose: a dependency would force the chat
  # container up in a no-chat deployment.
  chat-proxy:
    image: ${CADDY_IMAGE:-caddy:2-alpine}
    environment:
      STUDIO_PORT: ${STUDIO_PORT:-8000}
      STUDIO_URL: ${SIMPLEAUDIT_STUDIO_URL:-http://localhost:8000}
      SIMPLEAUDIT_CHAT_UPSTREAM_PORT: ${SIMPLEAUDIT_CHAT_UPSTREAM_PORT:-8080}
      STUDIO_UPSTREAM: web:8000
    volumes:
      - ./deploy/openwebui-subpath/Caddyfile.subpath:/etc/caddy/Caddyfile:ro
      # (custom.css is no longer mounted: Caddyfile.subpath reverse-proxies
      # /chat/static/custom.css to Studio's /chat/css-mask, which picks the
      # admin vs plain mask from the session.)
    ports:
      - "${STUDIO_PORT:-8000}:8000"
    depends_on:
      web:
        condition: service_healthy
    restart: unless-stopped

volumes:
  postgres_data:
  open_webui_data:
  # Shared Hatchet config; carries the auth-disabled worker JWT from server -> worker.
  hatchet_config: