docker-compose.yml

# Copyright © 2025–2026 Stefano Noferi & Admina contributors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Admina Platform — Docker Compose
# Governed AI Development Framework
# https://admina.org
#
# Secrets are auto-generated on first launch.
#
#   admina dev                          # recommended — auto-generates secrets
#   ./scripts/bootstrap-secrets.sh      # generate .env without admina CLI
#   docker compose up --build           # reads secrets from .env
#
# View credentials:  admina password show  (or cat .env)


services:

  # ═══════════════════════════════════════════════════════
  # CORE: MCP Governance Proxy
  # ═══════════════════════════════════════════════════════
  proxy:
    build:
      context: .
      dockerfile: admina/proxy/Dockerfile
    container_name: admina-proxy
    ports:
      - "8080:8080"   # MCP Proxy + Admin API
    env_file:
      - .env
    environment:
      - REDIS_URL=redis://redis:6379/0
      - CLICKHOUSE_HOST=clickhouse
      - CLICKHOUSE_PORT=8123
      - CLICKHOUSE_DB=admina
      - MINIO_ENDPOINT=minio:9000
      - MINIO_BUCKET=forensic-blackbox
      # Persistent forensic backend for the docker-compose dev stack.
      # Without these two lines the proxy would default to in-memory
      # only, which is the safer default for a fresh `pip install`
      # but a poor demo experience.
      - FORENSIC_BACKEND=filesystem
      - FORENSIC_BASE_DIR=/app/.admina/forensic
      - OTEL_ENDPOINT=http://otel-collector:4317
      - UPSTREAM_MCP_URL=http://mock-mcp-server:9000
      - LOG_LEVEL=INFO
      - ADMINA_API_KEY=${ADMINA_API_KEY:-}
    depends_on:
      redis:
        condition: service_healthy
      clickhouse:
        condition: service_healthy
      minio:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - admina

  # ═══════════════════════════════════════════════════════
  # DASHBOARD: Web UI for governance monitoring
  # ═══════════════════════════════════════════════════════
  dashboard:
    build:
      context: .
      dockerfile: dashboard/Dockerfile
    container_name: admina-dashboard
    ports:
      - "3000:80"
    environment:
      - ADMINA_API_KEY=${ADMINA_API_KEY:-}
      - ADMINA_DASHBOARD_PASSWORD=${ADMINA_DASHBOARD_PASSWORD:-}
    depends_on:
      - proxy
    healthcheck:
      # BusyBox wget on nginx:alpine resolves "localhost" to ::1 first and
      # nginx listens on 0.0.0.0; force IPv4 to avoid spurious "Connection
      # refused" failures.
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/health"]
      interval: 30s
      timeout: 3s
      retries: 3
    networks:
      - admina

  # ═══════════════════════════════════════════════════════
  # DATA: ClickHouse for governance event analytics
  # ═══════════════════════════════════════════════════════
  clickhouse:
    image: clickhouse/clickhouse-server:24.3
    container_name: admina-clickhouse
    ports:
      - "127.0.0.1:8123:8123"   # ClickHouse HTTP interface (localhost only)
    environment:
      - CLICKHOUSE_DB=admina
      - CLICKHOUSE_USER=default
      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:-}
      - CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1
    volumes:
      - clickhouse-data:/var/lib/clickhouse
    healthcheck:
      test: ["CMD", "clickhouse-client", "--user", "default", "--password", "${CLICKHOUSE_PASSWORD}", "--query", "SELECT 1"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks:
      - admina

  # ═══════════════════════════════════════════════════════
  # STORAGE: MinIO (S3-compatible) for Forensic Black Box
  # ═══════════════════════════════════════════════════════
  minio:
    image: minio/minio:RELEASE.2024-11-07T00-52-20Z
    container_name: admina-minio
    command: server /data --console-address ":9090"
    ports:
      - "127.0.0.1:9090:9090"   # MinIO console (localhost only)
    env_file:
      - .env
    environment:
      - MINIO_ROOT_USER=${MINIO_ACCESS_KEY:-admina}
      - MINIO_ROOT_PASSWORD=${MINIO_SECRET_KEY:-}
    volumes:
      - minio-data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks:
      - admina

  # ═══════════════════════════════════════════════════════
  # CACHE: Redis for session state and rate limiting
  # ═══════════════════════════════════════════════════════
  redis:
    image: redis:7-alpine
    container_name: admina-redis
    # Not exposed to host — internal network only
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - admina

  # ═══════════════════════════════════════════════════════
  # TELEMETRY: OpenTelemetry Collector
  # ═══════════════════════════════════════════════════════
  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.96.0
    container_name: admina-otel-collector
    command: ["--config", "/etc/otel/config.yaml"]
    ports:
      - "127.0.0.1:4317:4317"   # OTLP gRPC (localhost only)
      - "127.0.0.1:4318:4318"   # OTLP HTTP (localhost only)
      - "127.0.0.1:8888:8888"   # Prometheus metrics (localhost only)
      - "127.0.0.1:8889:8889"   # Prometheus exporter (localhost only)
    volumes:
      - ./otel-collector/config.yaml:/etc/otel/config.yaml:ro
    depends_on:
      clickhouse:
        condition: service_healthy
    # No healthcheck: otel/opentelemetry-collector-contrib is distroless and
    # ships only the collector binary (no wget/curl/sh), so a Docker exec
    # probe cannot make an HTTP call against the health_check extension.
    # No other service depends on `service_healthy: otel-collector`, so the
    # container's plain `running` state is sufficient. To enable a real
    # probe, add the `health_check` extension in otel-collector/config.yaml
    # and run a sidecar that curls it.
    healthcheck:
      disable: true
    networks:
      - admina

  # ═══════════════════════════════════════════════════════
  # MONITORING: Grafana dashboards
  # ═══════════════════════════════════════════════════════
  grafana:
    image: grafana/grafana:11.0.0
    container_name: admina-grafana
    ports:
      - "3001:3000"
    env_file:
      - .env
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-}
      - GF_USERS_ALLOW_SIGN_UP=false
    volumes:
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
      - ./grafana/dashboards:/var/lib/grafana/dashboards:ro
      - grafana-data:/var/lib/grafana
    depends_on:
      - otel-collector
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
      interval: 15s
      timeout: 5s
      retries: 5
    networks:
      - admina

  # ═══════════════════════════════════════════════════════
  # MOCK: Simulated MCP Server (for testing)
  # ═══════════════════════════════════════════════════════
  mock-mcp-server:
    build: ./mock-mcp-server
    container_name: admina-mock-mcp
    networks:
      - admina

  # ═══════════════════════════════════════════════════════
  # MOCK: Simulated AI Agent (for demo/testing)
  # ═══════════════════════════════════════════════════════
  mock-agent:
    build: ./mock-agent
    container_name: admina-mock-agent
    environment:
      - PROXY_URL=http://proxy:8080
    depends_on:
      proxy:
        condition: service_healthy
    networks:
      - admina

volumes:
  clickhouse-data:
  minio-data:
  grafana-data:

networks:
  admina:
    driver: bridge