docker-compose.yml

# AxonFlow Local Development Environment (Community Edition)
# Fast feedback loop for testing changes locally before deploying to AWS
#
# Usage:
#   docker compose up -d                    # Start all Community services
#   docker compose logs -f axonflow-agent   # Follow agent logs
#   docker compose down -v                  # Stop and remove volumes
#
# For Enterprise features (Bedrock, Customer Portal, etc.):
#   See docker-compose.enterprise.yml
#
# Services:
#   - PostgreSQL: localhost:5432
#   - Redis: localhost:6379
#   - Agent: localhost:8080
#   - Orchestrator: localhost:8081
#   - Prometheus: localhost:9090
#   - Grafana: localhost:3000 (admin/grafana_localdev456)

services:
  # PostgreSQL Database - Core platform storage
  postgres:
    image: postgres:15-alpine
    container_name: axonflow-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: axonflow
      POSTGRES_PASSWORD: localdev123
      POSTGRES_DB: axonflow
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U axonflow -d axonflow"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - axonflow-network

  # Redis - Rate limiting and caching
  redis:
    image: redis:7-alpine
    container_name: axonflow-redis
    restart: unless-stopped
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - axonflow-network

  # AxonFlow Agent - Runs migrations and handles MCP queries
  axonflow-agent:
    build:
      context: .
      dockerfile: platform/agent/Dockerfile
      args:
        EDITION: community
    container_name: axonflow-agent
    restart: unless-stopped
    environment:
      # ============================================================
      # CORE CONFIGURATION (most users only need to set these)
      # ============================================================

      # LLM Provider API Keys - set at least one to enable AI features
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      GOOGLE_API_KEY: ${GOOGLE_API_KEY:-}

      # Azure OpenAI - use instead of/alongside OpenAI for Azure-hosted models
      AZURE_OPENAI_ENDPOINT: ${AZURE_OPENAI_ENDPOINT:-}
      AZURE_OPENAI_API_KEY: ${AZURE_OPENAI_API_KEY:-}
      AZURE_OPENAI_DEPLOYMENT_NAME: ${AZURE_OPENAI_DEPLOYMENT_NAME:-}

      # Service ports and mode
      PORT: 8080
      DEPLOYMENT_MODE: ${DEPLOYMENT_MODE:-community}
      AXONFLOW_LICENSE_KEY: ${AXONFLOW_LICENSE_KEY:-}
      AXONFLOW_VERSION: "${AXONFLOW_VERSION:-4.8.0}"

      # Media governance (v4.5.0+) - set to "true" to enable in Community mode
      MEDIA_GOVERNANCE_ENABLED: ${MEDIA_GOVERNANCE_ENABLED:-}

      # ============================================================
      # ADVANCED CONFIGURATION (defaults work for most use cases)
      # ============================================================

      # Database
      DATABASE_HOST: postgres
      DATABASE_PORT: 5432
      DATABASE_NAME: axonflow
      DATABASE_USER: axonflow
      DATABASE_PASSWORD: localdev123
      DATABASE_SSLMODE: disable

      # Internal services (Orchestrator/Portal URLs auto-discovered via Docker service names)
      REDIS_URL: redis://redis:6379
      DATABASE_URL: postgres://axonflow:localdev123@postgres:5432/axonflow?sslmode=disable

      # Ollama (for local/air-gapped LLM deployments)
      OLLAMA_ENDPOINT: ${OLLAMA_ENDPOINT:-}
      OLLAMA_MODEL: ${OLLAMA_MODEL:-}

      # LLM routing (multi-provider setups)
      DEFAULT_LLM_PROVIDER: ${DEFAULT_LLM_PROVIDER:-}
      LLM_ROUTING_STRATEGY: ${LLM_ROUTING_STRATEGY:-weighted}
      PROVIDER_WEIGHTS: ${PROVIDER_WEIGHTS:-}

      # MCP Policy Features (Issue #966, #968)
      # Dynamic policy evaluation is opt-in - enable via MCP_DYNAMIC_POLICIES_ENABLED=true
      MCP_DYNAMIC_POLICIES_ENABLED: ${MCP_DYNAMIC_POLICIES_ENABLED:-false}
      MCP_DYNAMIC_POLICIES_CONNECTORS: ${MCP_DYNAMIC_POLICIES_CONNECTORS:-}

      # Security scanning - detection actions (Issue #891)
      # Philosophy: Block high-confidence threats, warn on heuristics, redact PII
      SQLI_SCANNER_MODE: ${SQLI_SCANNER_MODE:-basic}
      # SQLI_ACTION: block|warn|log (default: block - high confidence attacks)
      SQLI_ACTION: ${SQLI_ACTION:-block}
      # PII_ACTION: block|warn|redact|log (default: redact - preserves UX)
      PII_ACTION: ${PII_ACTION:-redact}
      # SENSITIVE_DATA_ACTION: block|warn|log (default: warn - may have false positives)
      SENSITIVE_DATA_ACTION: ${SENSITIVE_DATA_ACTION:-warn}
      # HIGH_RISK_ACTION: block|warn|log (default: warn - composite score needs tuning)
      HIGH_RISK_ACTION: ${HIGH_RISK_ACTION:-warn}
      # DANGEROUS_QUERY_ACTION: block|warn|log (default: block - DROP/TRUNCATE)
      DANGEROUS_QUERY_ACTION: ${DANGEROUS_QUERY_ACTION:-block}
      # Deprecated: use SQLI_ACTION instead
      # SQLI_BLOCK_MODE: ${SQLI_BLOCK_MODE:-block}

      # Per-mode policy overrides (take precedence over global *_ACTION vars)
      # MCP mode
      MCP_STATIC_POLICIES_ENABLED: ${MCP_STATIC_POLICIES_ENABLED:-true}
      MCP_PII_ACTION: ${MCP_PII_ACTION:-}
      MCP_SQLI_ACTION: ${MCP_SQLI_ACTION:-}
      MCP_DANGEROUS_QUERY_ACTION: ${MCP_DANGEROUS_QUERY_ACTION:-}
      MCP_STATIC_POLICIES_SKIP_CATEGORIES: ${MCP_STATIC_POLICIES_SKIP_CATEGORIES:-}
      # Gateway mode
      GATEWAY_STATIC_POLICIES_ENABLED: ${GATEWAY_STATIC_POLICIES_ENABLED:-true}
      GATEWAY_PII_ACTION: ${GATEWAY_PII_ACTION:-}
      GATEWAY_SQLI_ACTION: ${GATEWAY_SQLI_ACTION:-}
      GATEWAY_DANGEROUS_QUERY_ACTION: ${GATEWAY_DANGEROUS_QUERY_ACTION:-}

      # Exfiltration detection (Issue #966)
      # MCP_MAX_ROWS_PER_QUERY: Maximum rows allowed per query (default: 10000)
      MCP_MAX_ROWS_PER_QUERY: ${MCP_MAX_ROWS_PER_QUERY:-10000}
      # MCP_MAX_BYTES_PER_QUERY: Maximum response size in bytes (default: 10MB)
      MCP_MAX_BYTES_PER_QUERY: ${MCP_MAX_BYTES_PER_QUERY:-10485760}

      # Authentication
      # JWT_SECRET: Secret for signing/validating user tokens
      # Generate tokens using: scripts/generate-jwt.sh
      JWT_SECRET: ${JWT_SECRET:-axonflow-local-dev-jwt-secret-do-not-use-in-production}

      # Internal service auth (orchestrator-to-agent HMAC token signing)
      # When set, agent validates HMAC-signed tokens from orchestrator.
      # When unset, falls back to hardcoded token (acceptable for development).
      AXONFLOW_INTERNAL_SERVICE_SECRET: ${AXONFLOW_INTERNAL_SERVICE_SECRET:-}

      # Misc
      ORG_ID: local-dev-org
      ENVIRONMENT: development
      LOG_LEVEL: debug
      GOOGLE_MODEL: ${GOOGLE_MODEL:-}
      GRAFANA_PASSWORD: grafana_localdev456
      AZURE_OPENAI_API_VERSION: ${AZURE_OPENAI_API_VERSION:-2024-08-01-preview}
    ports:
      - "8080:8080"
    volumes:
      # MCP connector configuration (enables postgres connector for demos)
      - ./config/axonflow.yaml:/app/config/axonflow.yaml:ro
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    networks:
      - axonflow-network

  # AxonFlow Orchestrator - LLM routing and policy enforcement
  axonflow-orchestrator:
    build:
      context: .
      dockerfile: platform/orchestrator/Dockerfile
      args:
        EDITION: community
    container_name: axonflow-orchestrator
    restart: unless-stopped
    environment:
      # ============================================================
      # CORE CONFIGURATION (most users only need to set these)
      # ============================================================

      # LLM Provider API Keys - set at least one to enable AI features
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      GOOGLE_API_KEY: ${GOOGLE_API_KEY:-}

      # Azure OpenAI - use instead of/alongside OpenAI for Azure-hosted models
      AZURE_OPENAI_ENDPOINT: ${AZURE_OPENAI_ENDPOINT:-}
      AZURE_OPENAI_API_KEY: ${AZURE_OPENAI_API_KEY:-}
      AZURE_OPENAI_DEPLOYMENT_NAME: ${AZURE_OPENAI_DEPLOYMENT_NAME:-}

      # Service ports and mode
      PORT: 8081
      DEPLOYMENT_MODE: ${DEPLOYMENT_MODE:-community}
      AXONFLOW_LICENSE_KEY: ${AXONFLOW_LICENSE_KEY:-}
      AXONFLOW_VERSION: "${AXONFLOW_VERSION:-4.8.0}"

      # Media governance (v4.5.0+) - set to "true" to enable in Community mode
      MEDIA_GOVERNANCE_ENABLED: ${MEDIA_GOVERNANCE_ENABLED:-}

      # ============================================================
      # ADVANCED CONFIGURATION (defaults work for most use cases)
      # ============================================================

      # Database
      DATABASE_HOST: postgres
      DATABASE_PORT: 5432
      DATABASE_NAME: axonflow
      DATABASE_USER: axonflow
      DATABASE_PASSWORD: localdev123
      DATABASE_SSLMODE: disable

      # Internal services
      AGENT_MCP_ENDPOINT: http://axonflow-agent:8080
      REDIS_URL: redis://redis:6379

      # Internal service auth (orchestrator-to-agent HMAC token signing)
      # Must match the agent's AXONFLOW_INTERNAL_SERVICE_SECRET value.
      AXONFLOW_INTERNAL_SERVICE_SECRET: ${AXONFLOW_INTERNAL_SERVICE_SECRET:-}

      # Model overrides (optional - providers use sensible defaults)
      OPENAI_MODEL: ${OPENAI_MODEL:-}
      ANTHROPIC_MODEL: ${ANTHROPIC_MODEL:-}
      GOOGLE_MODEL: ${GOOGLE_MODEL:-}
      AZURE_OPENAI_API_VERSION: ${AZURE_OPENAI_API_VERSION:-2024-08-01-preview}

      # Ollama (for local/air-gapped LLM deployments)
      OLLAMA_ENDPOINT: ${OLLAMA_ENDPOINT:-}
      OLLAMA_MODEL: ${OLLAMA_MODEL:-}
      LOCAL_LLM_ENDPOINT: ${LOCAL_LLM_ENDPOINT:-}

      # LLM routing (multi-provider setups)
      DEFAULT_LLM_PROVIDER: ${DEFAULT_LLM_PROVIDER:-}
      LLM_ROUTING_STRATEGY: ${LLM_ROUTING_STRATEGY:-weighted}
      PROVIDER_WEIGHTS: ${PROVIDER_WEIGHTS:-}

      # Misc
      ORG_ID: local-dev-org
      LOG_LEVEL: debug
    ports:
      - "8081:8081"
    depends_on:
      axonflow-agent:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8081/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    networks:
      - axonflow-network

  # Prometheus - Metrics collection
  prometheus:
    image: prom/prometheus:v2.48.0
    container_name: axonflow-prometheus
    restart: unless-stopped
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=15d'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
    volumes:
      - ./config/prometheus-local.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    ports:
      - "9090:9090"
    networks:
      - axonflow-network
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:9090/-/healthy || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3

  # Grafana - Metrics visualization
  # Login: admin / grafana_localdev456
  grafana:
    image: grafana/grafana:10.2.2
    container_name: axonflow-grafana
    restart: unless-stopped
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: grafana_localdev456
      GF_DATABASE_TYPE: postgres
      GF_DATABASE_HOST: postgres:5432
      GF_DATABASE_NAME: grafana
      GF_DATABASE_USER: grafana
      GF_DATABASE_PASSWORD: grafana_localdev456
      GF_DATABASE_SSL_MODE: disable
      GF_SERVER_ROOT_URL: http://localhost:3000
      GF_INSTALL_PLUGINS: ""
    ports:
      - "3000:3000"
    depends_on:
      axonflow-agent:
        condition: service_healthy
      prometheus:
        condition: service_healthy
    volumes:
      - grafana-data:/var/lib/grafana
      - ./config/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
      - ./config/grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./config/grafana/dashboards:/var/lib/grafana/dashboards:ro
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3000/api/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    networks:
      - axonflow-network

volumes:
  postgres-data:
    driver: local
  prometheus-data:
    driver: local
  grafana-data:
    driver: local

networks:
  axonflow-network:
    driver: bridge