docker-compose.yml

# Atlas3 frontend + trex WebAPI (single node).
#
#   cp .env.example .env   # then edit AWS_BEARER_TOKEN_BEDROCK
#   docker compose up -d
# UI:   https://localhost/atlas/
#
# trex image pinned by digest; bump via:
#   docker buildx imagetools inspect ghcr.io/ohdsi/trexsql:latest
name: atlas3-trex

# Single trex node: data_node (Local DuckDB pool) + trexas (UI/API) + pgwire.
# pgwire gets an explicit password for psql clients against trex's :5432.
x-swarm-config: &swarm-config
  SWARM_CONFIG: >-
    {"cluster_id":"local","nodes":{
      "trex":{
        "gossip_addr":"trex:4200","data_node":true,
        "extensions":[
          {"name":"flight","config":{"host":"0.0.0.0","port":50051}},
          {"name":"trexas","config":{"host":"0.0.0.0","port":8001,"main_service_path":"/usr/src/core/server","event_worker_path":"/usr/src/core/event","tls_port":8000,"tls_cert_path":"/usr/src/server.crt","tls_key_path":"/usr/src/server.key"}},
          {"name":"pgwire","config":{"host":"0.0.0.0","port":5432,"password":"${POSTGRES_PASSWORD:-mypass}"}}
        ]}
    }}

volumes:
  trex-pgdata:
  atlas3-postgres-data:
  trex-claude-config:
  trex-gh-config:
  atlas3-caddy-data:

services:
  # One-shot: generates ./secrets/{root,derived}.env (trex crypto/JWT keys).
  trex-init:
    image: ${TREX_IMAGE:-ghcr.io/ohdsi/trexsql@sha256:ff693804900450456e2c871d5c2a09b31fc57b754677471e493ff5a099009df9}
    entrypoint: /usr/local/bin/trex-init
    environment:
      TREX_SECRETS_DIR: /shared
    volumes:
      - ./secrets:/shared
    restart: "no"

  # trex's own metadata DB.
  postgres:
    image: postgres:16
    command: ["postgres", "-c", "wal_level=logical", "-c", "max_replication_slots=10", "-c", "max_wal_senders=10"]
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mypass}
      POSTGRES_DB: testdb
    volumes:
      - trex-pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 10

  # Preloaded OHDSI DB the embedded WebAPI talks to (webapi schema, flyway, CDM/vocab).
  atlas3-postgres:
    image: ohdsi/broadsea-atlasdb:2.3.0
    hostname: broadsea-atlasdb
    platform: linux/amd64
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mypass}
    volumes:
      - atlas3-postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 10

  # Single trex node. Hosts the embedded WebAPI on :8080, started by trex itself
  # at boot (see D2E_COMPAT below).
  trex:
    image: ${TREX_IMAGE:-ghcr.io/ohdsi/trexsql@sha256:ff693804900450456e2c871d5c2a09b31fc57b754677471e493ff5a099009df9}
    ports:
      - "8000:8000"   # trexas TLS
      - "8001:8001"   # trexas HTTP
      - "5432:5432"   # pgwire
      - "8080:8080"   # embedded OHDSI WebAPI
    depends_on:
      trex-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      atlas3-postgres:
        condition: service_healthy
    env_file:
      - path: ./secrets/root.env
        required: false
      - path: ./secrets/derived.env
        required: false
      - path: ./.env
        required: false
    volumes:
      - trex-claude-config:/home/node/.claude
      - trex-gh-config:/home/node/.config/gh
      # Pythia agent (ClojureScript) as a mounted Deno function.
      # Served at /plugins/ohdsi/pythia/* on :8001 (@ohdsi is a trusted
      # plugin scope since trex #141). See agent/README.md.
      - ./agent/plugin:/usr/src/plugins-dev/pythia:ro
      # TrexSQL's per-source cache. It lives under /tmp inside the container,
      # which is not persisted, so every `up -d` that recreates trex (an env
      # change is enough) silently discarded it — and rebuilding the EUNOMIA
      # cache is slow enough that the live preview looks broken until it
      # finishes. A bind mount keeps it across recreates; uid 1000 in the
      # container matches the host user, so ownership stays writable.
      - ./trexsql-cache:/tmp/trexsql-cache
    environment:
      <<: *swarm-config
      SWARM_NODE: trex
      # Starts the embedded WebAPI (:8080) during trex's own boot, via
      # d2e-compat block 1 (itself gated by WEBAPI_NATIVE_ENABLED, default on).
      # That start call is only reachable behind this flag; everything else the
      # flag turns on is inert here — the URL middleware only rewrites
      # /d2e-prefixed requests, the legacy trex.db registry migration returns
      # early because no `trex` schema exists, and the source/cache attach
      # blocks find no rows. Without it nothing boots WebAPI, and `restart trex`
      # leaves it down.
      D2E_COMPAT: "true"
      DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD:-mypass}@postgres:5432/testdb
      SCHEMA_DIR: /usr/src/core/schema
      PLUGINS_PATH: /usr/src/plugins
      PLUGINS_DEV_PATH: /usr/src/plugins-dev
      BASE_PATH: /trex
      BETTER_AUTH_URL: http://localhost:8001/trex
      # --- Embedded OHDSI WebAPI (Spring) -> atlas3-postgres ---
      DATASOURCE_DRIVERCLASSNAME: org.postgresql.Driver
      DATASOURCE_URL: jdbc:postgresql://atlas3-postgres:5432/postgres?currentSchema=webapi
      DATASOURCE_USERNAME: postgres
      DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD:-mypass}
      DATASOURCE_OHDSI_SCHEMA: webapi
      SPRING_JPA_PROPERTIES_HIBERNATE_DEFAULT_SCHEMA: webapi
      SPRING_BATCH_REPOSITORY_TABLEPREFIX: webapi.batch_
      FLYWAY_DATASOURCE_USERNAME: postgres
      FLYWAY_DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD:-mypass}
      SPRING_FLYWAY_URL: jdbc:postgresql://atlas3-postgres:5432/postgres?currentSchema=webapi
      SPRING_FLYWAY_USER: postgres
      SPRING_FLYWAY_PASSWORD: ${POSTGRES_PASSWORD:-mypass}
      SPRING_FLYWAY_SCHEMAS: webapi
      SPRING_FLYWAY_TABLE: flyway_schema_history
      SPRING_FLYWAY_BASELINE_VERSION: "3.0.0"
      SPRING_FLYWAY_PLACEHOLDERS_OHDSISCHEMA: webapi
      FLYWAY_BASELINE_VERSION: "3.0.0"
      SECURITY_CORS_ENABLED: "true"
      SECURITY_CORS_ALLOWED_ORIGINS: "http://localhost,https://localhost"
      SECURITY_AUTH_DB_ENABLED: "true"
      SECURITY_AUTH_WINDOWS_ENABLED: "false"
      SECURITY_AUTH_KERBEROS_ENABLED: "false"
      SECURITY_AUTH_OIDC_ENABLED: "false"
      SECURITY_AUTH_OAUTH_FACEBOOK_ENABLED: "false"
      SECURITY_AUTH_OAUTH_GITHUB_ENABLED: "false"
      SECURITY_AUTH_OAUTH_GOOGLE_ENABLED: "false"
      SECURITY_AUTH_LDAP_ENABLED: "false"
      SECURITY_AUTH_AD_ENABLED: "false"
      SECURITY_AUTH_CAS_ENABLED: "false"
      SECURITY_AUTH_OAUTH_CALLBACK_UI: "http://localhost/atlas/#/welcome"
      SECURITY_AUTH_OAUTH_CALLBACK_API: "http://localhost:8080/WebAPI/user/oauth/callback"
      SECURITY_AUTH_DB_DATASOURCE_DRIVER_CLASS_NAME: org.postgresql.Driver
      SECURITY_AUTH_DB_DATASOURCE_URL: jdbc:postgresql://atlas3-postgres:5432/postgres?currentSchema=webapi
      SECURITY_AUTH_DB_DATASOURCE_USERNAME: postgres
      SECURITY_AUTH_DB_DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD:-mypass}
      SECURITY_AUTH_DB_DATASOURCE_SCHEMA: webapi
      TREXSQL_ENABLED: "true"
      # WebAPI/TrexSQL query cache. Must be a path writable by the `node` user
      # (uid 1000). Do NOT override HOME here: the trex node's own Deno runtime
      # caches modules under $HOME/.cache, and pointing HOME at an unwritable
      # mount (e.g. /data) breaks the trexas worker so the node never boots.
      TREXSQL_CACHE_PATH: /tmp/trexsql-cache
      # --- Pythia / trex agents runtime ---
      AWS_REGION: us-east-1
      # BAO_AGENT_MODEL kept as the operator-facing var name; TREX_AGENTS_DEFAULT_MODEL
      # is what the trex agents runtime actually reads. BAO_AGENT_MODEL_SPEC lets an
      # operator supply a fully-qualified `<provider>/<modelId>` spec when the model
      # isn't a plain bedrock-runtime one (see the Luna note below).
      TREX_AGENTS_DEFAULT_MODEL: ${BAO_AGENT_MODEL_SPEC:-bedrock/${BAO_AGENT_MODEL:-minimax.minimax-m2.5}}
      # OpenAI GPT-5.6 (Sol/Terra/Luna) are NOT on bedrock-runtime — they are served
      # only from the separate `bedrock-mantle` endpoint via an OpenAI-compatible
      # Responses API, so `bedrock/...` can't reach them. Point trex's openai-compatible
      # provider at mantle instead and select the model with
      #   BAO_AGENT_MODEL_SPEC=openai/openai.gpt-5.6-luna
      # The Bedrock long-term API key doubles as the OpenAI-style bearer token.
      OPENAI_BASE_URL: ${OPENAI_BASE_URL:-https://bedrock-mantle.${AWS_REGION:-us-east-1}.api.aws/openai/v1}
      OPENAI_API_KEY: ${AWS_BEARER_TOKEN_BEDROCK:-}
      # AWS_BEARER_TOKEN_BEDROCK comes from ./.env via env_file above.
    healthcheck:
      test:
        - CMD-SHELL
        - 'node -e "fetch(''http://localhost:8001/trex/api/ready'').then(r => { if (r.status !== 200) throw new Error(r.status) })"'
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 60s

  # One-shot: after WebAPI is up (so flyway has created the webapi schema), load
  # source/source_daimon rows, auth users, and admin/proxy permissions.
  atlas3-db-init:
    image: postgres:16-alpine
    volumes:
      - ./atlasdb:/scripts:ro
    environment:
      PGHOST: atlas3-postgres
      PGUSER: postgres
      PGPASSWORD: ${POSTGRES_PASSWORD:-mypass}
      PGDATABASE: postgres
    depends_on:
      trex:
        condition: service_healthy
    entrypoint:
      - sh
      - -c
      - |
        # trex reports healthy on :8001 well before the embedded WebAPI is
        # serving on :8080, and these scripts need the flyway-created webapi
        # schema, so wait for WebAPI itself rather than for the container.
        echo "[db-init] waiting for WebAPI"
        for i in $$(seq 1 60); do
          wget -q -O /dev/null "http://trex:8080/WebAPI/info" && break
          sleep 5
        done
        wget -q -O /dev/null "http://trex:8080/WebAPI/info" || { echo "[db-init] WebAPI never came up" >&2; exit 1; }
        for f in /scripts/*.sql; do echo "[db-init] $$f"; psql -v ON_ERROR_STOP=1 -f "$$f"; done
    restart: "no"

  # Atlas3 Caddy/Vite UI, built from third_party/Atlas3. Atlas3 externalized
  # its config (the old VITE_* build args are gone): auth and the Pythia FAB
  # are enabled at runtime via ./atlas-config-local.json, mounted over the
  # image's /srv/atlas/config-local.json. The vendored ./Caddyfile is mounted
  # over the image's copy; WEBAPI_HOST=trex points /WebAPI/* at the node.
  atlas3-frontend:
    # Pinned to a published ATLAS build. ATLAS is an application, not a library
    # (package.json is `private: true`), so there is no npm install of it — the
    # container image is how it ships, and OHDSI/Atlas3 publishes one per commit.
    # Pinning a sha keeps the stack reproducible the same way the trexsql digest
    # does, and drops a 531 MB submodule checkout plus a local build from the
    # loop.
    #
    # The build stanza stays for the case that actually needs the source:
    # changing ATLAS itself. `docker compose build atlas3-frontend` builds from
    # third_party/Atlas3 and shadows the pinned image locally; plain `up -d`
    # pulls the pin. Bump ATLAS_IMAGE (or the default) once a change is merged
    # and published.
    image: ${ATLAS_IMAGE:-ghcr.io/ohdsi/atlas3:sha-75a31d9}
    pull_policy: missing
    build:
      context: ./third_party/Atlas3
      dockerfile: Dockerfile
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./atlas-config-local.json:/srv/atlas/config-local.json:ro
      # Plugin manifest minus the image's undeployed hello-world demo plugin.
      - ./atlas-plugins-local.json:/srv/atlas/config/plugins.json:ro
      - atlas3-caddy-data:/data
      # Pythia micro-frontend (built from this repo's `develop` branch) + the
      # single-spa-vue runtime, served at /atlas/pythia-plugin and /atlas/vendor.
      # Neither ships in the Atlas3 OSS build; see README "Building the Pythia plugin".
      - ./frontend-assets/pythia-plugin:/srv/atlas/plugins/pythia-plugin:ro
      - ./frontend-assets/vendor/single-spa-vue.js:/srv/atlas/vendor/single-spa-vue.js:ro
    environment:
      WEBAPI_HOST: trex
      WEBAPI_PORT: "8080"
      WEBAPI_URL: ${WEBAPI_URL:-https://localhost/WebAPI}
      CADDY_HOSTNAME: ${CADDY_HOSTNAME:-localhost}
      CADDY_TLS_DIRECTIVE: ${CADDY_TLS_DIRECTIVE:-tls internal}
    depends_on:
      atlas3-db-init:
        condition: service_completed_successfully