# Vallorix — self-hosted deployment (by Inferix)
# Run your own private, sovereign compliance platform. Evidence never leaves your walls.
#
# Quick start:
#   1) ./generate-secrets.sh          # creates .env + secrets/ (one time)
#   2) docker compose up -d           # or: podman compose up -d
#   3) open http://localhost:8090     # (or your VALLORIX_BASE_URL)
#
# All secrets come from ./.env and ./secrets/ — nothing sensitive is committed here.
services:
  vallorix:
    # Obtain the image one of two ways (see README.md):
    #   docker load -i vallorix-<version>.tar.gz     # offline / air-gapped
    #   docker pull ghcr.io/inferix/vallorix:latest  # once you have registry access
    image: "${VALLORIX_IMAGE:-ghcr.io/inferix/vallorix:latest}"
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    # The OAuth2 signing key is a multi-line PEM, so it is mounted as a file and
    # exported into the env before the stock entrypoint runs (env can't hold multi-line).
    entrypoint: ["/bin/sh","-c","export PROBOD_OAUTH2_SERVER_SIGNING_KEY=\"$$(cat /run/secrets/oauth2_signing_key.pem)\"; exec /usr/local/bin/entrypoint.sh"]
    environment:
      # --- core secrets (from .env; generate-secrets.sh fills these) ---
      PROBOD_ENCRYPTION_KEY: "${PROBOD_ENCRYPTION_KEY:?run ./generate-secrets.sh first}"
      PROBOD_AUTH_COOKIE_SECRET: "${PROBOD_AUTH_COOKIE_SECRET:?}"
      PROBOD_AUTH_PASSWORD_PEPPER: "${PROBOD_AUTH_PASSWORD_PEPPER:?}"
      PROBOD_TRUST_AUTH_TOKEN_SECRET: "${PROBOD_TRUST_AUTH_TOKEN_SECRET:?}"
      # --- public URL / CORS ---
      PROBOD_BASE_URL: "${VALLORIX_BASE_URL:-http://localhost:8090}"
      PROBOD_API_ADDR: ":8080"
      PROBOD_API_CORS_ALLOWED_ORIGINS: "${VALLORIX_BASE_URL:-http://localhost:8090}"
      # --- database ---
      PROBOD_PG_ADDR: "postgres:5432"
      PROBOD_PG_USERNAME: "postgres"
      PROBOD_PG_PASSWORD: "${POSTGRES_PASSWORD:?}"
      PROBOD_PG_DATABASE: "probod"
      PROBOD_PG_POOL_SIZE: "50"
      # --- object storage (internal seaweedfs S3; not exposed outside the compose net) ---
      PROBOD_AWS_REGION: "us-east-1"
      PROBOD_AWS_BUCKET: "probod"
      PROBOD_AWS_ACCESS_KEY_ID: "${S3_ACCESS_KEY:?}"
      PROBOD_AWS_SECRET_ACCESS_KEY: "${S3_SECRET_KEY:?}"
      PROBOD_AWS_ENDPOINT: "http://seaweedfs:8333"
      PROBOD_AWS_USE_PATH_STYLE: "true"
      # --- email (optional; leave SMTP_ADDR empty to disable outbound mail) ---
      PROBOD_SMTP_ADDR: "${VALLORIX_SMTP_ADDR:-}"
      PROBOD_SMTP_TLS_REQUIRED: "${VALLORIX_SMTP_TLS:-false}"
      PROBOD_MAILER_SENDER_NAME: "${VALLORIX_MAIL_FROM_NAME:-Vallorix}"
      PROBOD_MAILER_SENDER_EMAIL: "${VALLORIX_MAIL_FROM_EMAIL:-no-reply@example.com}"
      # --- AI copilot (any OpenAI-compatible endpoint; defaults to a local Ollama) ---
      # probod requires an LLM provider to start. For a local, private model run Ollama
      # on the host (ollama serve; ollama pull llama3) — the key value is ignored by Ollama.
      PROBOD_OPENAI_API_KEY: "${VALLORIX_LLM_API_KEY:-ollama}"
      PROBOD_OPENAI_BASE_URL: "${VALLORIX_LLM_BASE_URL:-http://host.docker.internal:11434/v1}"
      PROBOD_AGENT_DEFAULT_PROVIDER: "openai"
      PROBOD_AGENT_DEFAULT_MODEL_NAME: "${VALLORIX_LLM_MODEL:-llama3:latest}"
      # --- headless browser (PDF/report rendering) ---
      PROBOD_CHROME_DP_ADDR: "chrome:9222"
    ports:
      - "${VALLORIX_BIND:-127.0.0.1:8090}:8080"
    volumes:
      - "vallorix-data:/data"
      - "./secrets/oauth2_signing_key.pem:/run/secrets/oauth2_signing_key.pem:ro"
    depends_on:
      postgres: { condition: service_healthy }
      seaweedfs: { condition: service_started }
      chrome: { condition: service_started }

  postgres:
    image: "postgres:16"
    restart: unless-stopped
    shm_size: "512m"
    command: postgres -c max_connections=200
    volumes:
      - "./compose/postgres:/docker-entrypoint-initdb.d:ro"
      - "vallorix-postgres-data:/var/lib/postgresql/data:rw"
    environment:
      POSTGRES_USER: "postgres"
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?}"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 10

  seaweedfs:
    image: "chrislusf/seaweedfs:latest"
    restart: unless-stopped
    command: server -s3 -s3.config=/etc/seaweedfs/s3.json -s3.port=8333 -volume.max=100 -master.volumeSizeLimitMB=1024 -dir=/data
    volumes:
      - "./compose/seaweedfs/s3.json:/etc/seaweedfs/s3.json:ro"
      - "vallorix-seaweedfs-data:/data:rw"

  chrome:
    image: "chromedp/headless-shell:latest"
    restart: unless-stopped
    command: ["--headless","--disable-gpu","--disable-dev-shm-usage","--hide-scrollbars","--mute-audio","--no-default-browser-check","--no-first-run","--disable-extensions","--remote-debugging-address=0.0.0.0","--remote-debugging-port=9222"]

volumes:
  vallorix-data:
  vallorix-postgres-data:
  vallorix-seaweedfs-data:
