docker-compose.release.yml

name: cordum

services:
  nats:
    image: nats:2.10-alpine
    restart: unless-stopped
    command: ["-c", "/etc/nats/nats.release.conf"]
    # No host port exposure — internal service accessible via Docker network only.
    volumes:
      - ./config/nats.release.conf:/etc/nats/nats.release.conf:ro
      - "${CORDUM_TLS_DIR:?error: CORDUM_TLS_DIR is not set}:/etc/cordum/tls:ro"
      - nats_data:/data
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 4222"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command:
      [
        "redis-server",
        "--appendonly",
        "yes",
        "--port",
        "0",
        "--tls-port",
        "6379",
        "--tls-cert-file",
        "/etc/cordum/tls/server/tls.crt",
        "--tls-key-file",
        "/etc/cordum/tls/server/tls.key",
        "--tls-ca-cert-file",
        "/etc/cordum/tls/ca/ca.crt",
        "--tls-auth-clients",
        "yes",
        "--requirepass",
        "${REDIS_PASSWORD:?error: REDIS_PASSWORD is not set}",
        "--aclfile",
        "/etc/redis/acl.conf",
      ]
    # No host port exposure — internal service accessible via Docker network only.
    volumes:
      - "${CORDUM_TLS_DIR:?error: CORDUM_TLS_DIR is not set}:/etc/cordum/tls:ro"
      - "${CORDUM_REDIS_ACL_FILE:-./config/redis/acl-prod.conf}:/etc/redis/acl.conf:ro"
      - redis_data:/data
    healthcheck:
      test: ["CMD-SHELL", "redis-cli --tls --cacert /etc/cordum/tls/ca/ca.crt --cert /etc/cordum/tls/client/tls.crt --key /etc/cordum/tls/client/tls.key -a \"$REDIS_PASSWORD\" ping | grep -q PONG"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  context-engine:
    image: ghcr.io/cordum-io/cordum/context-engine:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    depends_on:
      redis:
        condition: service_healthy
    environment:
      CORDUM_ENV: production
      REDIS_URL: "rediss://:${REDIS_PASSWORD:?error: REDIS_PASSWORD is not set}@redis:6379"
      REDIS_TLS_CA: /etc/cordum/tls/ca/ca.crt
      REDIS_TLS_CERT: /etc/cordum/tls/client/tls.crt
      REDIS_TLS_KEY: /etc/cordum/tls/client/tls.key
      REDIS_TLS_SERVER_NAME: redis
      CONTEXT_ENGINE_ADDR: ":50070"
      CONTEXT_ENGINE_METRICS_ADDR: ":9094"
      CONTEXT_ENGINE_METRICS_PUBLIC: "true"
      CONTEXT_ENGINE_TLS_CERT: /etc/cordum/tls/server/tls.crt
      CONTEXT_ENGINE_TLS_KEY: /etc/cordum/tls/server/tls.key
    volumes:
      - "${CORDUM_TLS_DIR:?error: CORDUM_TLS_DIR is not set}:/etc/cordum/tls:ro"
    # No host port exposure — internal gRPC service accessible via Docker network only.
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 50070"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  safety-kernel:
    image: ghcr.io/cordum-io/cordum/safety-kernel:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    depends_on:
      nats:
        condition: service_healthy
    environment:
      CORDUM_ENV: production
      NATS_URL: "tls://nats:4222"
      NATS_TLS_CA: /etc/cordum/tls/ca/ca.crt
      NATS_TLS_CERT: /etc/cordum/tls/client/tls.crt
      NATS_TLS_KEY: /etc/cordum/tls/client/tls.key
      NATS_TLS_SERVER_NAME: nats
      REDIS_URL: "rediss://:${REDIS_PASSWORD:?error: REDIS_PASSWORD is not set}@redis:6379"
      REDIS_TLS_CA: /etc/cordum/tls/ca/ca.crt
      REDIS_TLS_CERT: /etc/cordum/tls/client/tls.crt
      REDIS_TLS_KEY: /etc/cordum/tls/client/tls.key
      REDIS_TLS_SERVER_NAME: redis
      SAFETY_KERNEL_ADDR: ":50051"
      SAFETY_POLICY_PATH: /etc/cordum/safety.yaml
      # Policy signing trust store. The legacy SAFETY_POLICY_PUBLIC_KEY
      # is still accepted for one-release migration; prefer the
      # per-key-id form CORDUM_POLICY_PUBLIC_KEY_<ID>=<base64> so key
      # rotation does not require restart. See docs/deployment/policy-signing.md.
      SAFETY_POLICY_PUBLIC_KEY: "${SAFETY_POLICY_PUBLIC_KEY:?error: SAFETY_POLICY_PUBLIC_KEY is not set}"
      SAFETY_POLICY_SIGNATURE: "${SAFETY_POLICY_SIGNATURE:?error: SAFETY_POLICY_SIGNATURE is not set}"
      # Strict mode: off | warn (default) | enforce. Set to enforce
      # once every bundle verifies clean in warn. See policy-signing.md
      # for the staged rollout procedure.
      CORDUM_POLICY_STRICT: "${CORDUM_POLICY_STRICT:-warn}"
      SAFETY_KERNEL_TLS_CERT: /etc/cordum/tls/server/tls.crt
      SAFETY_KERNEL_TLS_KEY: /etc/cordum/tls/server/tls.key
    volumes:
      - ./config/safety.yaml:/etc/cordum/safety.yaml:ro
      - "${CORDUM_TLS_DIR:?error: CORDUM_TLS_DIR is not set}:/etc/cordum/tls:ro"
    # No host port exposure — internal gRPC service accessible via Docker network only.
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 50051"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  scheduler:
    image: ghcr.io/cordum-io/cordum/scheduler:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    depends_on:
      nats:
        condition: service_healthy
      redis:
        condition: service_healthy
      safety-kernel:
        condition: service_healthy
    environment:
      CORDUM_ENV: production
      NATS_URL: "tls://nats:4222"
      NATS_TLS_CA: /etc/cordum/tls/ca/ca.crt
      NATS_TLS_CERT: /etc/cordum/tls/client/tls.crt
      NATS_TLS_KEY: /etc/cordum/tls/client/tls.key
      NATS_TLS_SERVER_NAME: nats
      NATS_USE_JETSTREAM: "1"
      REDIS_URL: "rediss://:${REDIS_PASSWORD:?error: REDIS_PASSWORD is not set}@redis:6379"
      REDIS_TLS_CA: /etc/cordum/tls/ca/ca.crt
      REDIS_TLS_CERT: /etc/cordum/tls/client/tls.crt
      REDIS_TLS_KEY: /etc/cordum/tls/client/tls.key
      REDIS_TLS_SERVER_NAME: redis
      SAFETY_KERNEL_ADDR: "safety-kernel:50051"
      SAFETY_KERNEL_TLS_CA: /etc/cordum/tls/ca/ca.crt
      OUTPUT_POLICY_ENABLED: "${OUTPUT_POLICY_ENABLED:-true}"
      POOL_CONFIG_PATH: /etc/cordum/pools.yaml
      TIMEOUT_CONFIG_PATH: /etc/cordum/timeouts.yaml
      JOB_META_TTL: "168h"
      WORKER_SNAPSHOT_INTERVAL: "5s"
      # Metrics (exposed on Docker network for Prometheus):
      SCHEDULER_METRICS_ADDR: ":9090"
      SCHEDULER_METRICS_PUBLIC: "true"
    volumes:
      - ./config/pools.yaml:/etc/cordum/pools.yaml:ro
      - ./config/timeouts.yaml:/etc/cordum/timeouts.yaml:ro
      - "${CORDUM_TLS_DIR:?error: CORDUM_TLS_DIR is not set}:/etc/cordum/tls:ro"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9090/health"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  api-gateway:
    image: ghcr.io/cordum-io/cordum/api-gateway:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    networks:
      default:
        aliases:
          - cordum-api-gateway
    depends_on:
      nats:
        condition: service_healthy
      redis:
        condition: service_healthy
      scheduler:
        condition: service_healthy
    environment:
      CORDUM_ENV: production
      NATS_URL: "tls://nats:4222"
      NATS_TLS_CA: /etc/cordum/tls/ca/ca.crt
      NATS_TLS_CERT: /etc/cordum/tls/client/tls.crt
      NATS_TLS_KEY: /etc/cordum/tls/client/tls.key
      NATS_TLS_SERVER_NAME: nats
      NATS_USE_JETSTREAM: "1"
      REDIS_URL: "rediss://:${REDIS_PASSWORD:?error: REDIS_PASSWORD is not set}@redis:6379"
      REDIS_TLS_CA: /etc/cordum/tls/ca/ca.crt
      REDIS_TLS_CERT: /etc/cordum/tls/client/tls.crt
      REDIS_TLS_KEY: /etc/cordum/tls/client/tls.key
      REDIS_TLS_SERVER_NAME: redis
      SAFETY_KERNEL_ADDR: "safety-kernel:50051"
      SAFETY_KERNEL_TLS_CA: /etc/cordum/tls/ca/ca.crt
      CONTEXT_ENGINE_ADDR: "context-engine:50070"
      CONTEXT_ENGINE_TLS_CA: /etc/cordum/tls/ca/ca.crt
      CORDUM_API_KEY: "${CORDUM_API_KEY:?error: CORDUM_API_KEY is not set}"
      # Wired so the gateway's startup-side guard refuses to boot in
      # production when this flag is on (release.yml is the production
      # path). Default `false` — never set to `true` in release.
      CORDUM_DASHBOARD_EMBED_API_KEY: "${CORDUM_DASHBOARD_EMBED_API_KEY:-false}"
      TENANT_ID: default
      API_RATE_LIMIT_RPS: "50"
      API_RATE_LIMIT_BURST: "100"
      REDIS_DATA_TTL: "24h"
      JOB_META_TTL: "168h"
      # Metrics (exposed on Docker network for Prometheus):
      GATEWAY_METRICS_ADDR: ":9092"
      GATEWAY_METRICS_PUBLIC: "true"
      GRPC_TLS_CERT: /etc/cordum/tls/server/tls.crt
      GRPC_TLS_KEY: /etc/cordum/tls/server/tls.key
      GATEWAY_HTTP_TLS_CERT: /etc/cordum/tls/server/tls.crt
      GATEWAY_HTTP_TLS_KEY: /etc/cordum/tls/server/tls.key
      # Policy signing. Populate CORDUM_POLICY_SIGNING_KEY (Ed25519 PEM
      # or base64) when CORDUM_POLICY_STRICT is warn or enforce.
      # See docs/deployment/policy-signing.md for key generation and
      # the staged off→warn→enforce rollout.
      CORDUM_POLICY_SIGNING_KEY: "${CORDUM_POLICY_SIGNING_KEY:-}"
      CORDUM_POLICY_SIGNING_KEY_ID: "${CORDUM_POLICY_SIGNING_KEY_ID:-default}"
      CORDUM_POLICY_STRICT: "${CORDUM_POLICY_STRICT:-warn}"
    volumes:
      - "${CORDUM_TLS_DIR:?error: CORDUM_TLS_DIR is not set}:/etc/cordum/tls:ro"
    ports:
      - "8080:8080"
      - "8081:8081"
      # Metrics port (9092) not exposed — use internal Docker network or kubectl port-forward.
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "--no-check-certificate", "https://127.0.0.1:8081/health"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  workflow-engine:
    image: ghcr.io/cordum-io/cordum/workflow-engine:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    depends_on:
      nats:
        condition: service_healthy
      redis:
        condition: service_healthy
      scheduler:
        condition: service_healthy
    environment:
      CORDUM_ENV: production
      NATS_URL: "tls://nats:4222"
      NATS_TLS_CA: /etc/cordum/tls/ca/ca.crt
      NATS_TLS_CERT: /etc/cordum/tls/client/tls.crt
      NATS_TLS_KEY: /etc/cordum/tls/client/tls.key
      NATS_TLS_SERVER_NAME: nats
      NATS_USE_JETSTREAM: "1"
      REDIS_URL: "rediss://:${REDIS_PASSWORD:?error: REDIS_PASSWORD is not set}@redis:6379"
      REDIS_TLS_CA: /etc/cordum/tls/ca/ca.crt
      REDIS_TLS_CERT: /etc/cordum/tls/client/tls.crt
      REDIS_TLS_KEY: /etc/cordum/tls/client/tls.key
      REDIS_TLS_SERVER_NAME: redis
      WORKFLOW_ENGINE_HTTP_ADDR: ":9093"
      WORKFLOW_ENGINE_SCAN_INTERVAL: "5s"
      WORKFLOW_ENGINE_RUN_SCAN_LIMIT: "200"
    volumes:
      - "${CORDUM_TLS_DIR:?error: CORDUM_TLS_DIR is not set}:/etc/cordum/tls:ro"
    # No host port exposure — internal service accessible via Docker network only.
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9093/health"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  dashboard:
    image: ghcr.io/cordum-io/cordum/dashboard:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    depends_on:
      api-gateway:
        condition: service_healthy
    environment:
      CORDUM_API_BASE_URL: "${CORDUM_API_BASE_URL:-}"
      CORDUM_API_KEY: "${CORDUM_API_KEY:-}"
      CORDUM_DASHBOARD_EMBED_API_KEY: "${CORDUM_DASHBOARD_EMBED_API_KEY:-false}"
      CORDUM_TENANT_ID: "${CORDUM_TENANT_ID:-default}"
      CORDUM_PRINCIPAL_ID: "${CORDUM_PRINCIPAL_ID:-}"
      CORDUM_PRINCIPAL_ROLE: "${CORDUM_PRINCIPAL_ROLE:-}"
      # Proxy to gateway over HTTPS in production.
      CORDUM_API_UPSTREAM_SCHEME: https
    volumes:
      - "${CORDUM_TLS_DIR:?error: CORDUM_TLS_DIR is not set}:/etc/cordum/tls:ro"
    ports:
      - "8082:8080"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8080/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

volumes:
  nats_data:
  redis_data: