Assistant/deploy/docker-compose.prod.yml

name: assistant
services:
  postgres:
    build:
      context: ..
      dockerfile: deploy/images/postgres.Dockerfile
      args: { SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" }
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: ${POSTGRES_SUPERUSER}
      POSTGRES_PASSWORD: ${POSTGRES_SUPERUSER_PASSWORD}
      CONTINUITY_DB_PASSWORD: ${CONTINUITY_DB_PASSWORD}
      IDENTITY_DB_PASSWORD: ${IDENTITY_DB_PASSWORD}
      AUTHORITY_DB_PASSWORD: ${AUTHORITY_DB_PASSWORD}
      SITUATION_DB_PASSWORD: ${SITUATION_DB_PASSWORD}
      WORK_DB_PASSWORD: ${WORK_DB_PASSWORD}
      CAPABILITY_DB_PASSWORD: ${CAPABILITY_DB_PASSWORD}
      COMMIT_DB_PASSWORD: ${COMMIT_DB_PASSWORD}
      EPISTEMICS_DB_PASSWORD_FILE: /run/secrets/epistemics_db_password
      INTERACTION_DB_PASSWORD_FILE: /run/secrets/interaction_db_password
    volumes:
      - assistant_pg:/var/lib/postgresql
      - assistant_core_secrets:/run/secrets:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_SUPERUSER} -d ${POSTGRES_DB:-assistant}"]
      interval: 10s
      timeout: 5s
      retries: 20

  nats:
    image: nats:2-alpine
    restart: unless-stopped
    command: ["-js", "-m", "8222"]
    volumes: ["assistant_nats:/data"]

  notification-receiver:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: notification-receiver, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8085"
      RECEIPT_DIRECTORY: /var/lib/notification-receiver
      RECEIVER_WRITE_TOKEN_FILE: /run/notification-writer/token
      RECEIVER_READ_TOKEN_FILE: /run/notification-reader/token
    ports: ["${NOTIFICATION_RECEIVER_PORT:-18081}:8085"]
    volumes:
      - assistant_notification_receipts:/var/lib/notification-receiver
      - assistant_notification_writer_secret:/run/notification-writer:ro
      - assistant_notification_reader_secret:/run/notification-reader:ro
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8085/healthz >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

  core-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: core-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8080"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: situation_role
      POSTGRES_PASSWORD: ${SITUATION_DB_PASSWORD}
      IDENTITY_POSTGRES_USER: identity_role
      IDENTITY_POSTGRES_PASSWORD: ${IDENTITY_DB_PASSWORD}
      CREATOR_BOOTSTRAP_TOKEN_FILE: /run/secrets/creator_bootstrap_token
      CREATOR_SESSION_SIGNING_KEY_FILE: /run/secrets/creator_session_signing_key
      CREATOR_USERNAME: ${CREATOR_USERNAME}
      CREATOR_PASSWORD_FILE: /run/secrets/creator_password
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
      CAPABILITY_POSTGRES_USER: capability_role
      CAPABILITY_POSTGRES_PASSWORD: ${CAPABILITY_DB_PASSWORD}
      EPISTEMICS_POSTGRES_USER: epistemics_role
      EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
      EPISTEMICS_POSTGRES_PASSWORD_FILE: /run/secrets/epistemics_db_password
      INTERACTION_POSTGRES_USER: interaction_role
      INTERACTION_POSTGRES_CREDENTIAL_REF: credential://domovoy/interaction/db-password/v1
      INTERACTION_POSTGRES_PASSWORD_FILE: /run/secrets/interaction_db_password
      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  continuity-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: continuity-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8081"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: continuity_role
      POSTGRES_PASSWORD: ${CONTINUITY_DB_PASSWORD}
      CORE_RUNTIME_URL: http://core-runtime:8080
      COMMIT_EXECUTOR_TOKEN: ${COMMIT_EXECUTOR_TOKEN}

  commit-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: commit-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8082"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: commit_role
      POSTGRES_PASSWORD: ${COMMIT_DB_PASSWORD}
      AUTHORITY_POSTGRES_USER: authority_role
      AUTHORITY_POSTGRES_PASSWORD: ${AUTHORITY_DB_PASSWORD}
      CORE_RUNTIME_URL: http://core-runtime:8080
      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
      COMMIT_EXECUTOR_TOKEN: ${COMMIT_EXECUTOR_TOKEN}
      NOTIFICATION_WRITE_TOKEN_FILE: /run/notification-writer/token
      NOTIFICATION_WRITE_SECRET_REF: domovoy-notification-write-v1
    # External mutation credentials belong here only via Portainer/Docker secrets/env injection.
    depends_on: [core-runtime, continuity-runtime, notification-receiver]
    volumes:
      - assistant_notification_writer_secret:/run/notification-writer:ro

  cognitive-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: cognitive-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8083"
      CORE_RUNTIME_URL: http://core-runtime:8080
      LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1
      LOCAL_GPU_PROVIDER_URL: http://192.168.220.91:11434
      COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
      COGNITIVE_ALLOW_CANARY: "true"
    depends_on: [core-runtime]

  creator-web:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: creator-web, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8084"
      CORE_RUNTIME_URL: http://core-runtime:8080
      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
      COMMIT_RUNTIME_URL: http://commit-runtime:8082
      COGNITIVE_RUNTIME_URL: http://cognitive-worker:8083
    ports: ["${CREATOR_WEB_PORT:-18080}:8084"]
    depends_on: [core-runtime, continuity-runtime, commit-runtime, cognitive-worker]
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8084/healthz >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

volumes:
  assistant_pg:
  assistant_nats:
  assistant_core_secrets:
    external: true
  assistant_notification_receipts:
  assistant_notification_writer_secret:
    external: true
  assistant_notification_reader_secret:
    external: true