docker-compose.yml

# docker-compose.yml — Required for local MOA development.
# Production uses managed Postgres / Neon, not this compose stack.

services:
  postgres:
    build:
      context: .
      dockerfile: docker/postgres/Dockerfile
      args:
        PGVECTOR_REF: v0.8.2
    image: moa-postgres:pg17-pgvector0.8.2-pgaudit
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: moa
      POSTGRES_USER: moa_owner
      POSTGRES_PASSWORD: dev
    command:
      - postgres
      - -c
      - shared_preload_libraries=pgaudit
      - -c
      - wal_level=logical
      - -c
      - max_replication_slots=10
      - -c
      - max_wal_senders=10
      - -c
      - logging_collector=on
      - -c
      - log_destination=stderr,csvlog
      - -c
      - log_directory=/var/log/postgresql
      - -c
      - log_rotation_age=60min
      - -c
      - log_rotation_size=0
      - -c
      - pgaudit.log=write,ddl,role
      - -c
      - pgaudit.log_relation=on
      - -c
      - pgaudit.log_parameter=off
      - -c
      - pgaudit.log_parameter_max_size=0
      - -c
      - pgaudit.log_catalog=off
      - -c
      - pgaudit.log_statement_once=on
    ports:
      - "10040:5432"
    volumes:
      - moa-pg-data:/var/lib/postgresql/data
      - moa-pg-audit:/var/log/postgresql
      - ./docker/postgres/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U moa_owner -d moa"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 10s

  valkey:
    image: valkey/valkey:8-alpine
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-valkey
    restart: unless-stopped
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    ports:
      - "10051:6379"
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20

  openfga-db-init:
    image: postgres:17-alpine
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD:-dev}
    entrypoint:
      - sh
      - -c
      - |
        set -e
        psql -h postgres -U moa_owner -d postgres -tAc \
          "SELECT 1 FROM pg_database WHERE datname='openfga'" \
        | grep -q 1 || \
          psql -h postgres -U moa_owner -d postgres \
          -c "CREATE DATABASE openfga OWNER moa_owner"
        echo "openfga db ready"
    restart: "no"

  openfga-migrate:
    image: openfga/openfga:v1.8.16
    depends_on:
      openfga-db-init:
        condition: service_completed_successfully
    command: ["migrate"]
    environment:
      OPENFGA_DATASTORE_ENGINE: postgres
      OPENFGA_DATASTORE_URI: postgres://moa_owner:${POSTGRES_PASSWORD:-dev}@postgres:5432/openfga?sslmode=disable
    restart: "no"

  openfga:
    image: openfga/openfga:v1.8.16
    depends_on:
      openfga-migrate:
        condition: service_completed_successfully
    command: ["run"]
    environment:
      OPENFGA_DATASTORE_ENGINE: postgres
      OPENFGA_DATASTORE_URI: postgres://moa_owner:${POSTGRES_PASSWORD:-dev}@postgres:5432/openfga?sslmode=disable
      OPENFGA_AUTHN_METHOD: preshared
      OPENFGA_AUTHN_PRESHARED_KEYS: ${MOA_AUTHZ_OPENFGA_PRESHARED_KEY:-localdev-preshared-key-do-not-use-in-prod}
      OPENFGA_LOG_FORMAT: json
      OPENFGA_PLAYGROUND_ENABLED: "true"
    ports:
      - "10030:8080"
      - "10031:8081"
      - "10032:3000"
    healthcheck:
      test: ["CMD", "/openfga", "version"]
      interval: 5s
      timeout: 2s
      retries: 20
    restart: unless-stopped

  rustfs:
    # Pinned by digest alongside rustfs/rc (see rustfs-init) so server and
    # client revisions cannot drift apart.
    image: rustfs/rustfs:latest@sha256:fa19210ac4697c79d7ccca1ec9b0eb91aebacc6691991ffb14014bb3c67e6cc3
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-rustfs
    restart: unless-stopped
    environment:
      RUSTFS_ACCESS_KEY: ${MOA_OBJECT_STORE_ACCESS_KEY_ID:-moaadmin}
      RUSTFS_SECRET_KEY: ${MOA_OBJECT_STORE_SECRET_ACCESS_KEY:-moa-local-dev-secret}
      RUSTFS_REGION: ${MOA_OBJECT_STORE_REGION:-us-east-1}
      RUSTFS_ADDRESS: 0.0.0.0:9000
      RUSTFS_CONSOLE_ADDRESS: 0.0.0.0:9001
      RUSTFS_CONSOLE_ENABLE: "true"
    command: ["/data"]
    ports:
      # Host ports are configurable because 9000/9001 are popular (minio,
      # k3d node ports); in-network consumers always use rustfs:9000.
      - "${MOA_RUSTFS_PORT:-9000}:9000"
      - "${MOA_RUSTFS_CONSOLE_PORT:-9001}:9001"
    volumes:
      - moa-rustfs-data:/data
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:9000/health"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 5s

  rustfs-init:
    # Pinned by digest: `:latest` drifted on CI (fresh pull) to a revision whose
    # init invocation exits 7 while local caches kept a working image — the same
    # unpinned-image failure mode the PII sidecar hit. This digest is the
    # locally-verified working revision.
    image: rustfs/rc:latest@sha256:7e488f0b71de2f5152777cbc8a8dd5b8370d99d3019fbfc7e196bdc6e3fa0285
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-rustfs-init
    restart: "no"
    depends_on:
      rustfs:
        condition: service_healthy
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        set -eu
        until rc alias set --quiet --bucket-lookup path --region "$${MOA_OBJECT_STORE_REGION:-us-east-1}" rustfs http://rustfs:9000 "$${MOA_OBJECT_STORE_ACCESS_KEY_ID:-moaadmin}" "$${MOA_OBJECT_STORE_SECRET_ACCESS_KEY:-moa-local-dev-secret}"; do
          sleep 1
        done
        rc bucket create --ignore-existing --region "$${MOA_OBJECT_STORE_REGION:-us-east-1}" "rustfs/$${MOA_SESSION_ATTACHMENT_BUCKET:-moa-session-attachments}"
        rc bucket create --ignore-existing --region "$${MOA_OBJECT_STORE_REGION:-us-east-1}" "rustfs/$${MOA_SANDBOX_CHECKPOINT_BUCKET:-moa-workspace-checkpoints}"
        rc bucket version info --json "rustfs/$${MOA_SANDBOX_CHECKPOINT_BUCKET:-moa-workspace-checkpoints}" | grep -Eq '"enabled"[[:space:]]*:[[:space:]]*null'
    environment:
      MOA_OBJECT_STORE_ACCESS_KEY_ID: ${MOA_OBJECT_STORE_ACCESS_KEY_ID:-moaadmin}
      MOA_OBJECT_STORE_SECRET_ACCESS_KEY: ${MOA_OBJECT_STORE_SECRET_ACCESS_KEY:-moa-local-dev-secret}
      MOA_SESSION_ATTACHMENT_BUCKET: ${MOA_SESSION_ATTACHMENT_BUCKET:-moa-session-attachments}
      MOA_SANDBOX_CHECKPOINT_BUCKET: ${MOA_SANDBOX_CHECKPOINT_BUCKET:-moa-workspace-checkpoints}
      MOA_OBJECT_STORE_REGION: ${MOA_OBJECT_STORE_REGION:-us-east-1}

  restate:
    image: docker.restate.dev/restatedev/restate:1.7.2
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-restate
    restart: unless-stopped
    command: ["--node-name=restate-dev"]
    environment:
      RESTATE_LOG_FILTER: "warn,restate=info"
      RESTATE_ROCKSDB_TOTAL_MEMORY_SIZE: "1 GiB"
      RESTATE_ADMIN__QUERY_ENGINE__MEMORY_SIZE: "256 MiB"
      RESTATE_BIFROST__RECORD_CACHE_MEMORY_SIZE: "128 MiB"
      DO_NOT_TRACK: "1"
    ports:
      - "10010:8080"
      - "10011:9070"
      - "10012:5122"
    volumes:
      - moa-restate-data:/restate-data
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:9070/health >/dev/null 2>&1 || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 5s

  moa-migrate:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        MOA_ORCHESTRATOR_FEATURES: provider-overrides
    image: moa/orchestrator:dev
    restart: "no"
    depends_on:
      postgres:
        condition: service_healthy
    command: ["migrate"]
    environment:
      MOA_DATABASE_URL: postgres://moa_owner:dev@postgres:5432/moa
      MOA_DATABASE_ADMIN_URL: postgres://moa_owner:dev@postgres:5432/moa
      RUST_LOG: info

  moa-session-status-migrator:
    image: moa/orchestrator:dev
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-session-status-migrator
    restart: "no"
    depends_on:
      moa-migrate:
        condition: service_completed_successfully
      restate:
        condition: service_healthy
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        server_pid=""
        trap '[ -z "$${server_pid}" ] || kill "$${server_pid}" 2>/dev/null || true' EXIT
        /usr/local/bin/moa-orchestrator --port 9080 serve-status-migration &
        server_pid=$$!
        /usr/local/bin/moa-orchestrator wait-status-cutover \
          --database-url "$${MOA_CUTOVER_DATABASE_URL}"
        kill "$${server_pid}"
        wait "$${server_pid}" || true
    environment:
      MOA_CUTOVER_DATABASE_URL: postgres://moa_owner:dev@postgres:5432/moa
    expose:
      - "9080"

  moa-orchestrator:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        MOA_ORCHESTRATOR_FEATURES: provider-overrides
    image: moa/orchestrator:dev
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-orchestrator
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      moa-migrate:
        condition: service_completed_successfully
      moa-session-status-migrator:
        condition: service_started
      valkey:
        condition: service_healthy
      restate:
        condition: service_healthy
      rustfs-init:
        condition: service_completed_successfully
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        /usr/local/bin/moa-orchestrator wait-status-cutover \
          --database-url "$${MOA_DATABASE_URL}"
        # `--port` is required, not cosmetic: the binary defaults to 10020, while
        # restate-bootstrap registers this deployment at `http://moa-orchestrator:9080`
        # and the session-status-migrator serves 9080 explicitly. Without it the
        # registration fails with META0003 connection refused and no handler is ever
        # reachable, even though the container itself looks healthy.
        exec /usr/local/bin/moa-orchestrator --port 9080
    environment:
      HOME: /var/lib/moa
      MOA_DATABASE_URL: postgres://moa_owner:dev@postgres:5432/moa
      MOA_DATABASE_MAX_CONNECTIONS: ${MOA_DATABASE_MAX_CONNECTIONS:-20}
      MOA_DATABASE_BACKGROUND_MAX_CONNECTIONS: ${MOA_DATABASE_BACKGROUND_MAX_CONNECTIONS:-2}
      MOA_DATABASE_CONNECT_TIMEOUT_SECONDS: ${MOA_DATABASE_CONNECT_TIMEOUT_SECONDS:-10}
      MOA_SESSION_DIRECT_TURN_EVENT_APPEND: ${MOA_SESSION_DIRECT_TURN_EVENT_APPEND:-false}
      MOA_RESTATE_INGRESS_URL: http://restate:8080
      MOA_RUNTIME_CACHE_BACKEND: redis
      MOA_RUNTIME_CACHE_REDIS_URL: redis://valkey:6379/0
      MOA_LOCAL_SANDBOX_DIR: /var/lib/moa/sandbox
      MOA_LOCAL_MEMORY_DIR: /var/lib/moa/memory
      MOA_PII_SERVICE_URL: ${MOA_PII_SERVICE_URL:-}
      MOA_OBSERVABILITY_LINEAGE_JOURNAL_PATH: /var/lib/moa/lineage-journal
      MOA_LINEAGE_SINK: postgres
      MOA_CLICKHOUSE_URL: ${MOA_CLICKHOUSE_URL:-}
      MOA_CLICKHOUSE_USER: ${MOA_CLICKHOUSE_USER:-}
      MOA_CLICKHOUSE_PASSWORD: ${MOA_CLICKHOUSE_PASSWORD:-}
      MOA_SKIP_FGA: ${MOA_SKIP_FGA:-}
      MOA_AUTHZ_OPENFGA_URL: http://openfga:8080
      MOA_AUTHZ_OPENFGA_PRESHARED_KEY: ${MOA_AUTHZ_OPENFGA_PRESHARED_KEY:-localdev-preshared-key-do-not-use-in-prod}
      MOA_AUTHZ_OPENFGA_STORE_ID: ${MOA_AUTHZ_OPENFGA_STORE_ID:-}
      MOA_AUTHZ_OPENFGA_MODEL_ID: ${MOA_AUTHZ_OPENFGA_MODEL_ID:-}
      MOA_OBJECT_STORE_ENDPOINT: http://rustfs:9000
      MOA_OBJECT_STORE_CREDENTIAL_MODE: static
      MOA_SESSION_ATTACHMENT_BUCKET: ${MOA_SESSION_ATTACHMENT_BUCKET:-moa-session-attachments}
      MOA_OBJECT_STORE_REGION: ${MOA_OBJECT_STORE_REGION:-us-east-1}
      MOA_OBJECT_STORE_ACCESS_KEY_ID: ${MOA_OBJECT_STORE_ACCESS_KEY_ID:-moaadmin}
      MOA_OBJECT_STORE_SECRET_ACCESS_KEY: ${MOA_OBJECT_STORE_SECRET_ACCESS_KEY:-moa-local-dev-secret}
      MOA_OBJECT_STORE_ALLOW_HTTP: "true"
      MOA_OBJECT_STORE_VIRTUAL_HOSTED_STYLE: "false"
      MOA_SANDBOX_CHECKPOINT_BUCKET: ${MOA_SANDBOX_CHECKPOINT_BUCKET:-moa-workspace-checkpoints}
      MOA_SANDBOX_CHECKPOINT_PREFIX: ${MOA_SANDBOX_CHECKPOINT_PREFIX:-workspace-checkpoints}
      MOA_SANDBOX_WORKSPACE_MODE: disabled
      MOA_PROVIDERS_OVERRIDE: ${MOA_PROVIDERS_OVERRIDE:-}
      # Development-only: the local security profile permits host-local hands.
      # Production deployments select the fail-closed cloud profile instead.
      MOA_SECURITY_PROFILE: local
      # Match multi-replica deployments: Postgres owns shared KMS state and a
      # fixed development-only key file survives container restarts.
      MOA_KMS_PROVIDER: postgres
      MOA_KMS_ROOT_KEY_DIR: /var/run/secrets/moa-kms/root-keys
      MOA_KMS_REQUIRED_GENERATION: primary
      MOA_METRICS_EXPORTER: ${MOA_METRICS_EXPORTER:-prometheus}
      MOA_METRICS_PROMETHEUS_LISTEN: 0.0.0.0:9090
      RUST_LOG: "info,moa_orchestrator=debug"
      MOA_ANTHROPIC_API_KEY: ${MOA_ANTHROPIC_API_KEY:-}
      MOA_OPENAI_API_KEY: ${MOA_OPENAI_API_KEY:-}
      MOA_GOOGLE_API_KEY: ${MOA_GOOGLE_API_KEY:-}
      MOA_COHERE_API_KEY: ${MOA_COHERE_API_KEY:-}
      MOA_ZEROENTROPY_API_KEY: ${MOA_ZEROENTROPY_API_KEY:-}
      # Contact-token signing keys are opt-in via docker-compose.edge.yml:
      # an empty MOA_AUTH_CONTACT_TOKENS_* value counts as "section
      # configured" and hard-fails config loading, so they must not be
      # passed through unconditionally here.
    expose:
      # Private credential ingress. Only service-to-service traffic on the
      # Compose network may reach this listener; it is never host-published.
      - "10023"
    ports:
      # Restate handler port 9080 is internal-only. Use moa-edge on 8080.
      - "10021:9081"
      # SCIM v2 provisioning endpoint.
      - "10022:10022"
      # Prometheus metrics; scraped by moa-loadtest step-latency reports.
      - "10023:9090"
    volumes:
      - ./crates/moa-loadtest/scripts:/loadtest-scripts:ro
      - ./k8s/overlays/local/kms-root-keys:/var/run/secrets/moa-kms/root-keys:ro

  moa-edge:
    build:
      context: .
      dockerfile: crates/moa-edge/Dockerfile
    image: moa/edge:dev
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-edge
    restart: unless-stopped
    depends_on:
      moa-orchestrator:
        condition: service_started
      restate-bootstrap:
        condition: service_completed_successfully
      rustfs-init:
        condition: service_completed_successfully
    environment:
      MOA_EDGE_BIND: 0.0.0.0:8080
      MOA_EDGE_UPSTREAM: http://restate:8080
      MOA_EDGE_INTERNAL_INGRESS_UPSTREAM: http://moa-orchestrator:10023
      # Local development opts into the staged connector-management surface.
      MOA_EDGE_CONNECTOR_MANAGEMENT_ENABLED: "true"
      MOA_DATABASE_URL: postgres://moa_owner:${POSTGRES_PASSWORD:-dev}@postgres:5432/moa?sslmode=disable
      # Without OpenFGA settings the edge has no authz engine and fails every
      # protected direct read (dashboard, analytics, MCP) closed with 503.
      MOA_AUTHZ_OPENFGA_URL: http://openfga:8080
      MOA_AUTHZ_OPENFGA_PRESHARED_KEY: ${MOA_AUTHZ_OPENFGA_PRESHARED_KEY:-localdev-preshared-key-do-not-use-in-prod}
      MOA_AUTHZ_OPENFGA_STORE_ID: ${MOA_AUTHZ_OPENFGA_STORE_ID:-}
      MOA_AUTHZ_OPENFGA_MODEL_ID: ${MOA_AUTHZ_OPENFGA_MODEL_ID:-}
      MOA_OBJECT_STORE_ENDPOINT: http://rustfs:9000
      MOA_SESSION_ATTACHMENT_BUCKET: ${MOA_SESSION_ATTACHMENT_BUCKET:-moa-session-attachments}
      MOA_OBJECT_STORE_REGION: ${MOA_OBJECT_STORE_REGION:-us-east-1}
      MOA_OBJECT_STORE_ACCESS_KEY_ID: ${MOA_OBJECT_STORE_ACCESS_KEY_ID:-moaadmin}
      MOA_OBJECT_STORE_SECRET_ACCESS_KEY: ${MOA_OBJECT_STORE_SECRET_ACCESS_KEY:-moa-local-dev-secret}
      MOA_OBJECT_STORE_ALLOW_HTTP: "true"
      MOA_OBJECT_STORE_VIRTUAL_HOSTED_STYLE: "false"
      MOA_CLICKHOUSE_URL: ${MOA_CLICKHOUSE_URL:-}
      MOA_CLICKHOUSE_USER: ${MOA_CLICKHOUSE_USER:-}
      MOA_CLICKHOUSE_PASSWORD: ${MOA_CLICKHOUSE_PASSWORD:-}
      MOA_METRICS_EXPORTER: ${MOA_METRICS_EXPORTER:-prometheus}
      MOA_METRICS_PROMETHEUS_LISTEN: 0.0.0.0:9090
      RUST_LOG: info,moa_edge=debug
    ports:
      - "10000:8080"
      # Prometheus metrics for the edge layer.
      - "10001:9090"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8080/healthz"]
      interval: 5s
      timeout: 2s
      retries: 12

  restate-bootstrap:
    image: moa/orchestrator:dev
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-restate-bootstrap
    restart: "no"
    depends_on:
      restate:
        condition: service_healthy
      moa-orchestrator:
        condition: service_started
      moa-session-status-migrator:
        condition: service_started
      moa-migrate:
        condition: service_completed_successfully
    environment:
      MOA_BOOTSTRAP_DATABASE_URL: postgres://moa_owner:${POSTGRES_PASSWORD:-dev}@postgres:5432/moa?sslmode=disable
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        exec /usr/local/bin/moa-orchestrator bootstrap \
          --admin-url http://restate:9070 \
          --ingress-url http://restate:8080 \
          --database-url "$${MOA_BOOTSTRAP_DATABASE_URL}" \
          --migration-deployment-uri http://moa-session-status-migrator:9080 \
          --runtime-deployment-uri http://moa-orchestrator:9080

  moa-pii-service:
    build:
      context: .
      dockerfile: services/pii-service/Dockerfile
    image: moa/pii-service:0.1
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-pii-service
    profiles: ["pii"]
    restart: unless-stopped
    environment:
      MODEL: openai/privacy-filter
      DEVICE: cpu
      HF_HUB_DISABLE_XET: "1"
    ports:
      - "10050:8080"
    volumes:
      - moa-pii-hf-cache:/root/.cache/huggingface
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)\""]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 60s

  clickhouse:
    # Optional analytics store for high-volume lineage rows. Start with
    # `docker compose --profile clickhouse up -d`, then set
    # MOA_CLICKHOUSE_URL=http://clickhouse:8123 (plus user/password below)
    # in .env so the orchestrator and edge switch turn_lineage to ClickHouse.
    image: clickhouse/clickhouse-server:25.5
    container_name: ${COMPOSE_PROJECT_NAME:-moa}-clickhouse
    restart: unless-stopped
    profiles: ["clickhouse"]
    environment:
      CLICKHOUSE_DB: moa
      CLICKHOUSE_USER: moa
      CLICKHOUSE_PASSWORD: dev
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    ports:
      - "10061:8123"
    volumes:
      - moa-clickhouse-data:/var/lib/clickhouse
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8123/ping"]
      interval: 5s
      timeout: 3s
      retries: 12

volumes:
  moa-clickhouse-data:
  moa-pg-data:
  moa-pg-audit:
  moa-pii-hf-cache:
  moa-restate-data:
  moa-rustfs-data: