docker-compose.yml

# Main orchestration file for Vigil Guard
# This file starts all services in the correct order

name: vigil-guard

networks:
  vigil-net:
    driver: bridge
    name: vigil-net

services:
  # ============================================
  # MONITORING STACK (Start first)
  # ============================================
  clickhouse:
    image: clickhouse/clickhouse-server:25.10.1@sha256:24fdba661a4414a67cdfa323807fa57d9c62ab0e815b1d1a4d443caf49092f24
    container_name: vigil-clickhouse
    ports:
      - "${CLICKHOUSE_HTTP_PORT:-8123}:8123"
      - "${CLICKHOUSE_TCP_PORT:-9000}:9000"
    environment:
      CLICKHOUSE_DB: ${CLICKHOUSE_DB:-n8n_logs}
      CLICKHOUSE_USER: ${CLICKHOUSE_USER:-admin}
      CLICKHOUSE_PASSWORD: "${CLICKHOUSE_PASSWORD:?ERROR - CLICKHOUSE_PASSWORD must be set in .env file}"
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: ${CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT:-1}
      # Note: Init scripts run automatically on first start with empty volume
      # Volume cleanup in install.sh ensures clean initialization with new password
    volumes:
      - ./vigil_data/clickhouse:/var/lib/clickhouse
      - ./services/monitoring/sql/01-create-tables-v2.sql:/docker-entrypoint-initdb.d/01-create-tables-v2.sql:ro
      - ./services/monitoring/sql/02-semantic-embeddings-v2.sql:/docker-entrypoint-initdb.d/02-semantic-embeddings-v2.sql:ro
      - ./services/monitoring/sql/03-false-positives-views.sql:/docker-entrypoint-initdb.d/03-false-positives-views.sql:ro
    networks:
      vigil-net:
        aliases:
          - clickhouse
    restart: unless-stopped
    healthcheck:
      # Verify ClickHouse server is ready to accept queries
      # Note: Table creation via /docker-entrypoint-initdb.d/ happens after server starts
      # install.sh verifies table existence separately
      test: ["CMD-SHELL", "clickhouse-client --query 'SELECT 1' || exit 1"]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s

  grafana:
    image: grafana/grafana:12.2.1@sha256:35c41e0fd0295f5d0ee5db7e780cf33506abfaf47686196f825364889dee878b
    container_name: vigil-grafana
    user: "${GRAFANA_UID:-472}:${GRAFANA_GID:-472}"  # Default Grafana user, override in .env for macOS
    environment:
      GF_INSTALL_PLUGINS: ${GF_INSTALL_PLUGINS:-vertamedia-clickhouse-datasource}
      GF_SECURITY_ADMIN_USER: ${GF_SECURITY_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: "${GF_SECURITY_ADMIN_PASSWORD:?ERROR - GF_SECURITY_ADMIN_PASSWORD must be set in .env file}"
      GF_SECURITY_ALLOW_EMBEDDING: ${GF_SECURITY_ALLOW_EMBEDDING:-true}
      GF_SECURITY_COOKIE_SAMESITE: ${GF_SECURITY_COOKIE_SAMESITE:-none}
      GF_SECURITY_COOKIE_SECURE: ${GF_SECURITY_COOKIE_SECURE:-false}
      # Disable CSP for iframe embedding (localhost only, not production)
      GF_SECURITY_CONTENT_SECURITY_POLICY: ${GF_SECURITY_CONTENT_SECURITY_POLICY:-false}
      # Anonymous access required for iframe embeds in Web UI (restricted to Viewer role, read-only)
      # Web UI itself is protected by JWT authentication - this only affects embedded dashboards
      GF_AUTH_ANONYMOUS_ENABLED: ${GF_AUTH_ANONYMOUS_ENABLED:-true}
      GF_AUTH_ANONYMOUS_ORG_ROLE: ${GF_AUTH_ANONYMOUS_ORG_ROLE:-Viewer}
      GF_SERVER_ROOT_URL: ${GF_SERVER_ROOT_URL:-http://localhost/grafana}
    ports:
      - "${GF_SERVER_HTTP_PORT:-3001}:3000"
    volumes:
      - ./services/monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./vigil_data/grafana:/var/lib/grafana
    networks:
      vigil-net:
        aliases:
          - grafana
    restart: unless-stopped
    depends_on:
      clickhouse:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3000/api/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ============================================
  # WORKFLOW ENGINE
  # ============================================
  n8n:
    image: n8nio/n8n:1.121.3@sha256:0a65e6e5995c19e0cf7e83d6b08ffa6c1898e8a53ff1658e6e7b22e68576c673
    container_name: vigil-n8n
    user: "node"
    working_dir: /home/node
    restart: unless-stopped
    environment:
      - TZ=${TZ:-UTC}
      - GENERIC_TIMEZONE=${TZ:-UTC}
      - N8N_HOST=${N8N_HOST:-localhost}
      - NODE_ENV=${NODE_ENV:-production}
      - N8N_RELEASE_TYPE=${N8N_RELEASE_TYPE:-stable}
      - NODE_FUNCTION_ALLOW_EXTERNAL=axios
    ports:
      - "${N8N_PORT:-5678}:5678"
    volumes:
      - ./vigil_data/n8n:/home/node/.n8n
      - ./services/workflow/config:/home/node/config:ro
      - ./services/workflow/workflows:/home/node/workflows:ro
    networks:
      vigil-net:
        aliases:
          - n8n
    depends_on:
      clickhouse:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "localhost:5678/healthz"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ============================================
  # WEB UI (Configuration Panel)
  # ============================================
  web-ui-backend:
    build:
      context: .
      dockerfile: ./services/web-ui/backend/Dockerfile
    container_name: vigil-web-ui-backend
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - PORT=8787
      - TARGET_DIR=${TARGET_DIR:-/config}
      - CORS_ORIGIN=${CORS_ORIGIN:-http://localhost:*}
      - JWT_SECRET=${JWT_SECRET:?ERROR - JWT_SECRET must be set in .env file (min 32 characters)}
      - SESSION_SECRET=${SESSION_SECRET:?ERROR - SESSION_SECRET must be set in .env file}
      - WEB_UI_ADMIN_PASSWORD=${WEB_UI_ADMIN_PASSWORD:?ERROR - WEB_UI_ADMIN_PASSWORD must be set in .env file (run ./install.sh)}
      - JWT_EXPIRES_IN=${JWT_EXPIRES_IN:-24h}
      - DATABASE_PATH=/app/data/users.db
      - CLICKHOUSE_HOST=${CLICKHOUSE_HOST:-vigil-clickhouse}
      - CLICKHOUSE_PORT=${CLICKHOUSE_HTTP_PORT:-8123}
      - CLICKHOUSE_USER=${CLICKHOUSE_USER:-admin}
      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:?ERROR - CLICKHOUSE_PASSWORD must be set in .env file}
      - CLICKHOUSE_DATABASE=${CLICKHOUSE_DB:-n8n_logs}
      - HEURISTICS_SERVICE_URL=${HEURISTICS_SERVICE_URL:-http://vigil-heuristics:5005}
      - SEMANTIC_SERVICE_URL=${SEMANTIC_SERVICE_URL:-http://vigil-semantic-service:5006}
      - PROMPT_GUARD_URL=${PROMPT_GUARD_URL:-http://vigil-prompt-guard-api:8000}
    ports:
      - "${BACKEND_PORT:-8787}:8787"
    volumes:
      - ./services/workflow/config:/config:rw
      - ./vigil_data/web-ui:/app/data
    networks:
      vigil-net:
        aliases:
          - web-ui-backend
    restart: unless-stopped
    depends_on:
      clickhouse:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8787/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  web-ui-frontend:
    build:
      context: .
      dockerfile: ./services/web-ui/frontend/Dockerfile
      args:
        VITE_DOCS_REF: ${DOCS_REF:-704b404b1ce0ac8298d8f548d8b385d318f4744b}
        VITE_GRAFANA_ORIGIN: http://localhost/grafana
    container_name: vigil-web-ui-frontend
    ports:
      - "${FRONTEND_PORT:-5173}:80"
    networks:
      vigil-net:
        aliases:
          - web-ui-frontend
    restart: unless-stopped
    depends_on:
      - web-ui-backend
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:80/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 5s

  # ============================================
  # PROMPT GUARD API
  # ============================================
  prompt-guard-api:
    build: ./prompt-guard-api
    container_name: vigil-prompt-guard-api
    ports:
      - "${PROMPT_GUARD_PORT:-8000}:8000"
    volumes:
      - ./vigil_data/prompt-guard-cache:/root/.cache/huggingface
      - ./Llama-Prompt-Guard-2-86M:/app/model:ro
    networks:
      - vigil-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ============================================
  # PRESIDIO PII DETECTION API
  # ============================================
  presidio-pii-api:
    build: ./services/presidio-pii-api
    container_name: vigil-presidio-pii
    image: vigil-presidio-pii:1.6.11
    environment:
      - PII_DETECTION_MODE=${PII_DETECTION_MODE:-balanced}
      - PII_CONTEXT_ENHANCEMENT=${PII_CONTEXT_ENHANCEMENT:-true}
    ports:
      - "${PRESIDIO_PORT:-5001}:5001"
    networks:
      vigil-net:
        aliases:
          - presidio-pii-api
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # ============================================
  # SEMANTIC SERVICE (Branch B - Vector Similarity)
  # ============================================
  semantic-service:
    build:
      context: ./services/semantic-service
      target: production
    container_name: vigil-semantic-service
    image: vigil-semantic-service:1.0.0
    environment:
      - NODE_ENV=production
      - PORT=5006
      - HOST=0.0.0.0
      - LOG_LEVEL=info
      - CLICKHOUSE_HOST=vigil-clickhouse
      - CLICKHOUSE_PORT=8123
      - CLICKHOUSE_DATABASE=${CLICKHOUSE_DB:-n8n_logs}
      - CLICKHOUSE_USER=${CLICKHOUSE_USER:-admin}
      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:?ERROR - CLICKHOUSE_PASSWORD must be set in .env file}
      - SEARCH_TOP_K=5
      - THRESHOLD_LOW=40
      - THRESHOLD_MEDIUM=70
      - RATE_LIMIT_MAX=1000
      - CLICKHOUSE_TIMEOUT=10000
    ports:
      - "${SEMANTIC_SERVICE_PORT:-5006}:5006"
    volumes:
      # Persist model cache (avoid re-download)
      - ./vigil_data/semantic-models:/app/models
      # Pre-generated embeddings (loaded at startup)
      - ./services/semantic-service/data:/app/data:ro
    networks:
      vigil-net:
        aliases:
          - semantic-service
    restart: unless-stopped
    depends_on:
      clickhouse:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:5006/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    # Resource reservations (guaranteed minimum, no upper limits)
    deploy:
      resources:
        reservations:
          cpus: '1'
          memory: 512M

  # ============================================
  # HEURISTICS SERVICE (Branch A - Pattern Detection)
  # ============================================
  heuristics-service:
    build: ./services/heuristics-service
    container_name: vigil-heuristics
    image: vigil-heuristics:2.1.0
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - LOG_LEVEL=${HEURISTICS_LOG_LEVEL:-info}
      - PORT=5005
      # Detection weights (must sum to 1.0)
      - WEIGHT_OBFUSCATION=${WEIGHT_OBFUSCATION:-0.30}
      - WEIGHT_STRUCTURE=${WEIGHT_STRUCTURE:-0.25}
      - WEIGHT_WHISPER=${WEIGHT_WHISPER:-0.30}
      - WEIGHT_ENTROPY=${WEIGHT_ENTROPY:-0.15}
      # Thresholds
      - THRESHOLD_LOW_MAX=${THRESHOLD_LOW_MAX:-39}
      - THRESHOLD_MEDIUM_MAX=${THRESHOLD_MEDIUM_MAX:-69}
      # Performance
      - TARGET_LATENCY_MS=${TARGET_LATENCY_MS:-50}
      - CIRCUIT_BREAKER_ENABLED=${CIRCUIT_BREAKER_ENABLED:-true}
    ports:
      - "${HEURISTICS_PORT:-5005}:5005"
    volumes:
      # Patterns directory (extracted from Roadmap)
      - ./services/heuristics-service/patterns:/app/patterns:ro
    networks:
      vigil-net:
        aliases:
          - heuristics-service
    restart: unless-stopped
    mem_limit: 256m
    cpus: "0.5"
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:5005/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # ============================================
  # LANGUAGE DETECTION SERVICE
  # ============================================
  language-detector:
    build: ./services/language-detector
    container_name: vigil-language-detector
    image: vigil-language-detector:1.0.1
    ports:
      - "5002:5002"
    networks:
      vigil-net:
        aliases:
          - language-detector
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:5002/health')"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s

  # ============================================
  # REVERSE PROXY (Main entry point)
  # ============================================
  caddy:
    image: caddy:2-alpine@sha256:953131cfea8e12bfe1c631a36308e9660e4389f0c3dfb3be957044d3ac92d446
    container_name: vigil-caddy
    restart: unless-stopped
    ports:
      - "${CADDY_HTTP_PORT:-80}:80"
      - "${CADDY_HTTPS_PORT:-443}:443"
    networks:
      - vigil-net
    volumes:
      - ./services/proxy/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./vigil_data/caddy-data:/data
      - ./vigil_data/caddy-config:/config
    depends_on:
      - n8n
      - web-ui-frontend
      - grafana
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:80/ui/"]
      interval: 30s
      timeout: 10s
      retries: 3