320 lines
11 KiB
YAML
320 lines
11 KiB
YAML
version: '3.9'
|
|
|
|
services:
|
|
# ============================================================
|
|
# PostgreSQL
|
|
# ============================================================
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-elydora}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-elydora-secret-change-me}
|
|
POSTGRES_DB: ${POSTGRES_DB:-elydora}
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-elydora} -d ${POSTGRES_DB:-elydora}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
# ============================================================
|
|
# Redis
|
|
# ============================================================
|
|
redis:
|
|
image: redis:7-alpine
|
|
restart: unless-stopped
|
|
command: redis-server --appendonly yes
|
|
volumes:
|
|
- redis_data:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
# ============================================================
|
|
# MinIO (S3-compatible object storage)
|
|
# ============================================================
|
|
minio:
|
|
image: minio/minio:latest
|
|
restart: unless-stopped
|
|
command: server /data --console-address ":9001"
|
|
environment:
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER:-elydora}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-elydora-minio-secret-change-me}
|
|
volumes:
|
|
- minio_data:/data
|
|
ports:
|
|
- "9001:9001"
|
|
healthcheck:
|
|
test: ["CMD", "mc", "ready", "local"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
# ============================================================
|
|
# MinIO init — creates the evidence bucket
|
|
# ============================================================
|
|
minio-init:
|
|
image: minio/mc:latest
|
|
depends_on:
|
|
minio:
|
|
condition: service_healthy
|
|
environment:
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER:-elydora}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-elydora-minio-secret-change-me}
|
|
MINIO_BUCKET: ${MINIO_BUCKET:-elydora-evidence}
|
|
entrypoint: >
|
|
/bin/sh -c "
|
|
mc alias set local http://minio:9000 $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD};
|
|
mc mb --ignore-existing local/$${MINIO_BUCKET};
|
|
echo 'MinIO bucket initialized.';
|
|
"
|
|
restart: on-failure
|
|
|
|
# ============================================================
|
|
# DB migrate — runs PostgreSQL migrations
|
|
# ============================================================
|
|
db-migrate:
|
|
image: postgres:16-alpine
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
PGPASSWORD: ${POSTGRES_PASSWORD:-elydora-secret-change-me}
|
|
command: >
|
|
psql -h postgres -U ${POSTGRES_USER:-elydora} -d ${POSTGRES_DB:-elydora} -c "
|
|
CREATE TABLE IF NOT EXISTS schema_versions (
|
|
version BIGINT PRIMARY KEY,
|
|
applied_at BIGINT NOT NULL,
|
|
description TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS organizations (
|
|
org_id TEXT NOT NULL PRIMARY KEY,
|
|
name TEXT NOT NULL,
|
|
created_at BIGINT NOT NULL,
|
|
updated_at BIGINT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
user_id TEXT NOT NULL PRIMARY KEY,
|
|
org_id TEXT NOT NULL REFERENCES organizations (org_id),
|
|
email TEXT NOT NULL UNIQUE,
|
|
password_hash TEXT NOT NULL,
|
|
display_name TEXT NOT NULL,
|
|
role TEXT NOT NULL DEFAULT 'org_owner'
|
|
CHECK (role IN ('org_owner', 'security_admin', 'compliance_auditor', 'readonly_investigator', 'integration_engineer')),
|
|
status TEXT NOT NULL DEFAULT 'active'
|
|
CHECK (status IN ('active', 'suspended')),
|
|
created_at BIGINT NOT NULL,
|
|
updated_at BIGINT NOT NULL
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_users_org_id ON users (org_id);
|
|
CREATE INDEX IF NOT EXISTS idx_users_email ON users (email);
|
|
|
|
CREATE TABLE IF NOT EXISTS agents (
|
|
agent_id TEXT NOT NULL PRIMARY KEY,
|
|
org_id TEXT NOT NULL REFERENCES organizations (org_id),
|
|
display_name TEXT NOT NULL,
|
|
responsible_entity TEXT NOT NULL,
|
|
integration_type TEXT NOT NULL
|
|
CONSTRAINT agents_integration_type_check
|
|
CHECK (integration_type IN (
|
|
'augment', 'claudecode', 'cline', 'codex', 'copilot',
|
|
'cursor', 'droid', 'gemini', 'grok', 'kimi', 'kirocli',
|
|
'kiroide', 'letta', 'opencode', 'qwen', 'enterprise',
|
|
'gui', 'sdk', 'other'
|
|
)),
|
|
status TEXT NOT NULL DEFAULT 'active'
|
|
CHECK (status IN ('active', 'frozen', 'revoked')),
|
|
created_at BIGINT NOT NULL,
|
|
updated_at BIGINT NOT NULL
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_agents_org_id ON agents (org_id);
|
|
|
|
ALTER TABLE agents ALTER COLUMN integration_type DROP DEFAULT;
|
|
ALTER TABLE agents DROP CONSTRAINT IF EXISTS agents_integration_type_check;
|
|
ALTER TABLE agents
|
|
ADD CONSTRAINT agents_integration_type_check
|
|
CHECK (integration_type IN (
|
|
'augment', 'claudecode', 'cline', 'codex', 'copilot',
|
|
'cursor', 'droid', 'gemini', 'grok', 'kimi', 'kirocli',
|
|
'kiroide', 'letta', 'opencode', 'qwen', 'enterprise',
|
|
'gui', 'sdk', 'other'
|
|
));
|
|
|
|
CREATE TABLE IF NOT EXISTS agent_keys (
|
|
kid TEXT NOT NULL PRIMARY KEY,
|
|
agent_id TEXT NOT NULL REFERENCES agents (agent_id),
|
|
public_key TEXT NOT NULL,
|
|
algorithm TEXT NOT NULL DEFAULT 'ed25519'
|
|
CHECK (algorithm = 'ed25519'),
|
|
status TEXT NOT NULL DEFAULT 'active'
|
|
CHECK (status IN ('active', 'retired', 'revoked')),
|
|
created_at BIGINT NOT NULL,
|
|
retired_at BIGINT
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_agent_keys_agent_id ON agent_keys (agent_id);
|
|
|
|
CREATE TABLE IF NOT EXISTS operations (
|
|
operation_id TEXT NOT NULL PRIMARY KEY,
|
|
org_id TEXT NOT NULL,
|
|
agent_id TEXT NOT NULL REFERENCES agents (agent_id),
|
|
seq_no BIGINT NOT NULL,
|
|
operation_type TEXT NOT NULL,
|
|
issued_at BIGINT NOT NULL,
|
|
ttl_ms BIGINT NOT NULL,
|
|
nonce TEXT NOT NULL,
|
|
subject TEXT NOT NULL,
|
|
action TEXT NOT NULL,
|
|
payload_hash TEXT NOT NULL,
|
|
prev_chain_hash TEXT NOT NULL,
|
|
chain_hash TEXT NOT NULL,
|
|
agent_pubkey_kid TEXT NOT NULL,
|
|
signature TEXT NOT NULL,
|
|
r2_payload_key TEXT,
|
|
created_at BIGINT NOT NULL,
|
|
UNIQUE (agent_id, seq_no)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_operations_org_created ON operations (org_id, created_at);
|
|
CREATE INDEX IF NOT EXISTS idx_operations_agent_seq ON operations (agent_id, seq_no);
|
|
CREATE INDEX IF NOT EXISTS idx_operations_type ON operations (operation_type);
|
|
|
|
CREATE TABLE IF NOT EXISTS receipts (
|
|
receipt_id TEXT NOT NULL PRIMARY KEY,
|
|
operation_id TEXT NOT NULL UNIQUE REFERENCES operations (operation_id),
|
|
r2_receipt_key TEXT NOT NULL,
|
|
created_at BIGINT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS epochs (
|
|
epoch_id TEXT NOT NULL PRIMARY KEY,
|
|
org_id TEXT NOT NULL,
|
|
start_time BIGINT NOT NULL,
|
|
end_time BIGINT NOT NULL,
|
|
root_hash TEXT NOT NULL,
|
|
leaf_count BIGINT NOT NULL,
|
|
r2_epoch_key TEXT NOT NULL,
|
|
created_at BIGINT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS admin_events (
|
|
event_id TEXT NOT NULL PRIMARY KEY,
|
|
org_id TEXT NOT NULL,
|
|
actor TEXT NOT NULL,
|
|
action TEXT NOT NULL,
|
|
target_type TEXT NOT NULL,
|
|
target_id TEXT NOT NULL,
|
|
details TEXT,
|
|
created_at BIGINT NOT NULL
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_admin_events_org_created ON admin_events (org_id, created_at);
|
|
|
|
CREATE TABLE IF NOT EXISTS exports (
|
|
export_id TEXT NOT NULL PRIMARY KEY,
|
|
org_id TEXT NOT NULL,
|
|
status TEXT NOT NULL DEFAULT 'queued'
|
|
CHECK (status IN ('queued', 'running', 'done', 'failed')),
|
|
query_params TEXT NOT NULL,
|
|
r2_export_key TEXT,
|
|
created_at BIGINT NOT NULL,
|
|
completed_at BIGINT
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_exports_org_status ON exports (org_id, status);
|
|
|
|
INSERT INTO schema_versions (version, applied_at, description)
|
|
VALUES (1, EXTRACT(EPOCH FROM NOW())::BIGINT * 1000, 'Initial schema')
|
|
ON CONFLICT DO NOTHING;
|
|
|
|
INSERT INTO schema_versions (version, applied_at, description)
|
|
VALUES (2, EXTRACT(EPOCH FROM NOW())::BIGINT * 1000, 'Require supported agent integration type')
|
|
ON CONFLICT DO NOTHING;
|
|
"
|
|
restart: on-failure
|
|
|
|
# ============================================================
|
|
# API server
|
|
# ============================================================
|
|
api:
|
|
build:
|
|
context: ./packages/server
|
|
dockerfile: Dockerfile
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
ports:
|
|
- "${PORT:-8787}:8787"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
minio:
|
|
condition: service_healthy
|
|
db-migrate:
|
|
condition: service_completed_successfully
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://localhost:8787/v1/health || exit 1"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
# ============================================================
|
|
# Worker (queue consumer)
|
|
# ============================================================
|
|
worker:
|
|
build:
|
|
context: ./packages/server
|
|
dockerfile: Dockerfile
|
|
restart: unless-stopped
|
|
command: ["node", "dist/worker.js"]
|
|
env_file: .env
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
|
|
# ============================================================
|
|
# Scheduler (epoch scheduler)
|
|
# ============================================================
|
|
scheduler:
|
|
build:
|
|
context: ./packages/server
|
|
dockerfile: Dockerfile
|
|
restart: unless-stopped
|
|
command: ["node", "dist/scheduler.js"]
|
|
env_file: .env
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
|
|
# ============================================================
|
|
# Console (Next.js frontend)
|
|
# ============================================================
|
|
console:
|
|
build:
|
|
context: .
|
|
dockerfile: packages/console/Dockerfile
|
|
args:
|
|
NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL:-http://localhost:8787}
|
|
restart: unless-stopped
|
|
environment:
|
|
NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL:-http://localhost:8787}
|
|
ports:
|
|
- "3000:3000"
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
|
|
volumes:
|
|
postgres_data:
|
|
redis_data:
|
|
minio_data:
|