siriusscan--sirius/docker-compose.yaml

# SiriusScan Base Docker Compose Configuration
# This is the base configuration that works for most environments.
# Standard startup pulls published images for the full stack.
# Use with: docker compose up -d
#
# Runtime API URL contract (single source of truth in .env):
# - SIRIUS_API_URL: server-side base URL for sirius-api (Docker DNS, e.g. http://sirius-api:9001).
#   Used by sirius-ui (server), sirius-engine preflight, and app-scanner persistence.
# - NEXT_PUBLIC_SIRIUS_API_URL: browser-facing API URL (host port, e.g. http://localhost:9001).
# - API_BASE_URL on sirius-engine: must match SIRIUS_API_URL (set from the same compose value below).
# - SIRIUS_API_KEY_FILE: compose mounts ./secrets/sirius_api_key.txt at /run/secrets/sirius_api_key.

name: sirius

services:
  sirius-rabbitmq:
    image: ghcr.io/siriusscan/sirius-rabbitmq:${IMAGE_TAG:-latest}
    pull_policy: ${SIRIUS_IMAGE_PULL_POLICY:-always}
    restart: unless-stopped
    container_name: sirius-rabbitmq
    hostname: sirius-rabbitmq
    environment:
      VALKEY_HOST: ${VALKEY_HOST:-sirius-valkey}
      VALKEY_PORT: ${VALKEY_PORT:-6379}
    ports:
      - "5672:5672"
      - "15672:15672"
    volumes:
      - ./rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
      - rabbitmq_data:/var/lib/rabbitmq
    healthcheck:
      test: ["CMD", "rabbitmqctl", "status"]
      interval: 30s
      timeout: 15s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"
        reservations:
          memory: 256M
          cpus: "0.25"

  sirius-postgres:
    image: ghcr.io/siriusscan/sirius-postgres:${IMAGE_TAG:-latest}
    pull_policy: ${SIRIUS_IMAGE_PULL_POLICY:-always}
    restart: unless-stopped
    container_name: sirius-postgres
    hostname: sirius-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required. Run installer first using docker compose -f docker-compose.installer.yaml run --rm sirius-installer}
      POSTGRES_DB: ${POSTGRES_DB:-sirius}
      VALKEY_HOST: ${VALKEY_HOST:-sirius-valkey}
      VALKEY_PORT: ${VALKEY_PORT:-6379}
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "/usr/local/bin/pg-healthcheck.sh"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "0.5"
        reservations:
          memory: 512M
          cpus: "0.25"

  sirius-valkey:
    image: ghcr.io/siriusscan/sirius-valkey:${IMAGE_TAG:-latest}
    pull_policy: ${SIRIUS_IMAGE_PULL_POLICY:-always}
    restart: unless-stopped
    container_name: sirius-valkey
    hostname: sirius-valkey
    environment:
      VALKEY_HOST: ${VALKEY_HOST:-sirius-valkey}
      VALKEY_PORT: ${VALKEY_PORT:-6379}
    ports:
      - "6379:6379"
    volumes:
      - valkey_data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: "0.25"
        reservations:
          memory: 128M
          cpus: "0.1"

  sirius-ui:
    # Runtime contract:
    # - release mode: IMAGE_TAG=<tag> + SIRIUS_IMAGE_PULL_POLICY=always
    # - source mode: add docker-compose.build.yaml with --build
    image: ghcr.io/siriusscan/sirius-ui:${IMAGE_TAG:-latest}
    pull_policy: ${SIRIUS_IMAGE_PULL_POLICY:-always}
    container_name: sirius-ui
    hostname: sirius-ui
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - SKIP_ENV_VALIDATION=${SKIP_ENV_VALIDATION:-1}
      - DATABASE_URL=${DATABASE_URL:?DATABASE_URL is required. Run installer first using docker compose -f docker-compose.installer.yaml run --rm sirius-installer}
      # UI auth settings
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET:?NEXTAUTH_SECRET is required for sirius-ui. Run installer first using docker compose -f docker-compose.installer.yaml run --rm sirius-installer}
      - NEXTAUTH_URL=${NEXTAUTH_URL:-http://localhost:3000}
      - INITIAL_ADMIN_PASSWORD=${INITIAL_ADMIN_PASSWORD:?INITIAL_ADMIN_PASSWORD is required for sirius-ui. Run installer first using docker compose -f docker-compose.installer.yaml run --rm sirius-installer}
      - SIRIUS_API_URL=${SIRIUS_API_URL:-http://sirius-api:9001}
      - NEXT_PUBLIC_SIRIUS_API_URL=${NEXT_PUBLIC_SIRIUS_API_URL:-http://localhost:9001}
      - DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID:-dummy_client_id}
      - DISCORD_CLIENT_SECRET=${DISCORD_CLIENT_SECRET:-dummy_client_secret}
      # Internal API auth: file-backed secret mount only
      - SIRIUS_API_KEY_FILE=${SIRIUS_API_KEY_FILE:-/run/secrets/sirius_api_key}
    secrets:
      - sirius_api_key
    depends_on:
      sirius-postgres:
        condition: service_healthy
      sirius-api:
        condition: service_healthy
      sirius-rabbitmq:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3000/"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: "2"
        reservations:
          memory: 512M
          cpus: "0.5"

  sirius-api:
    image: ghcr.io/siriusscan/sirius-api:${IMAGE_TAG:-latest}
    pull_policy: ${SIRIUS_IMAGE_PULL_POLICY:-always}
    container_name: sirius-api
    hostname: sirius-api
    restart: unless-stopped
    ports:
      - "9001:9001"
    environment:
      - GO_ENV=${GO_ENV:-production}
      - API_PORT=${API_PORT:-9001}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-*}
      - POSTGRES_HOST=${POSTGRES_HOST:-sirius-postgres}
      - POSTGRES_USER=${POSTGRES_USER:-postgres}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required for sirius-api. Run installer first using docker compose -f docker-compose.installer.yaml run --rm sirius-installer}
      - POSTGRES_DB=${POSTGRES_DB:-sirius}
      - POSTGRES_PORT=${POSTGRES_PORT:-5432}
      - VALKEY_HOST=${VALKEY_HOST:-sirius-valkey}
      - VALKEY_PORT=${VALKEY_PORT:-6379}
      - RABBITMQ_URL=${RABBITMQ_URL:-amqp://guest:guest@sirius-rabbitmq:5672/}
      - LOG_LEVEL=${LOG_LEVEL:-error}
      - SIRIUS_API_KEY_FILE=${SIRIUS_API_KEY_FILE:-/run/secrets/sirius_api_key}
    secrets:
      - sirius_api_key
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "1.0"
        reservations:
          memory: 256M
          cpus: "0.25"
    depends_on:
      sirius-postgres:
        condition: service_healthy
      sirius-rabbitmq:
        condition: service_healthy
      sirius-valkey:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:9001/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  sirius-engine:
    image: ghcr.io/siriusscan/sirius-engine:${IMAGE_TAG:-latest}
    pull_policy: ${SIRIUS_IMAGE_PULL_POLICY:-always}
    container_name: sirius-engine
    hostname: sirius-engine
    restart: unless-stopped
    cap_add:
      - NET_RAW
    ports:
      - "5174:5174"
      - "50051:50051" # Agent gRPC
    environment:
      - GO_ENV=${GO_ENV:-production}
      - ENGINE_MAIN_PORT=${ENGINE_MAIN_PORT:-5174}
      - GRPC_AGENT_PORT=${GRPC_AGENT_PORT:-50051}
      - POSTGRES_HOST=${POSTGRES_HOST:-sirius-postgres}
      - POSTGRES_USER=${POSTGRES_USER:-postgres}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required for sirius-engine. Run installer first using docker compose -f docker-compose.installer.yaml run --rm sirius-installer}
      - POSTGRES_DB=${POSTGRES_DB:-sirius}
      - POSTGRES_PORT=${POSTGRES_PORT:-5432}
      - VALKEY_HOST=${VALKEY_HOST:-sirius-valkey}
      - VALKEY_PORT=${VALKEY_PORT:-6379}
      - RABBITMQ_URL=${RABBITMQ_URL:-amqp://guest:guest@sirius-rabbitmq:5672/}
      - SIRIUS_API_URL=${SIRIUS_API_URL:-http://sirius-api:9001}
      # Agent/scanner legacy name; always mirror SIRIUS_API_URL to avoid URL/key drift
      - API_BASE_URL=${SIRIUS_API_URL:-http://sirius-api:9001}
      - AGENT_ID=${AGENT_ID:-sirius-engine}
      - HOST_ID=${HOST_ID:-sirius-engine}
      - ENABLE_SCRIPTING=${ENABLE_SCRIPTING:-true}
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - SIRIUS_API_KEY_FILE=${SIRIUS_API_KEY_FILE:-/run/secrets/sirius_api_key}
    secrets:
      - sirius_api_key
    depends_on:
      sirius-rabbitmq:
        condition: service_healthy
      sirius-postgres:
        condition: service_healthy
      sirius-valkey:
        condition: service_healthy
      sirius-api:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "bash",
          "-lc",
          "command -v psql >/dev/null && command -v curl >/dev/null && [ -r \"${SIRIUS_API_KEY_FILE:-}\" ] && echo > /dev/tcp/127.0.0.1/50051",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: "1.0"
        reservations:
          memory: 1G
          cpus: "0.5"

volumes:
  postgres_data:
    driver: local
  valkey_data:
    driver: local
  rabbitmq_data:
    driver: local

secrets:
  sirius_api_key:
    file: ./secrets/sirius_api_key.txt

networks:
  default:
    name: sirius
    driver: bridge