compose-scenescape.yml

services:
  ntpserver:
    image: docker.io/dockurr/chrony:4.6.1
    environment:
      http_proxy: ${http_proxy}
      https_proxy: ${https_proxy}
      no_proxy: ${no_proxy},.scenescape.intel.com,influxdb2
      HTTP_PROXY: ${http_proxy}
      HTTPS_PROXY: ${https_proxy}
      NO_PROXY: ${no_proxy},.scenescape.intel.com,influxdb2
    networks:
      scenescape:
        aliases:
          - ntpserv
    restart: on-failure:5

  broker:
    image: docker.io/library/eclipse-mosquitto:2.0.21
    environment:
      http_proxy: ${http_proxy}
      https_proxy: ${https_proxy}
      no_proxy: ${no_proxy},.scenescape.intel.com,influxdb2
      HTTP_PROXY: ${http_proxy}
      HTTPS_PROXY: ${https_proxy}
      NO_PROXY: ${no_proxy},.scenescape.intel.com,influxdb2
    volumes:
      - ./${SAMPLE_APP}/src/mosquitto/mosquitto-secure.conf:/mosquitto/config/mosquitto.conf
    secrets:
      - root-cert
      - broker-cert
      - broker-key
    entrypoint: [
        "/bin/sh",
        "-e",
        "-c",
        "cp -r /run/secrets /mosquitto/secrets  && \
        /docker-entrypoint.sh /usr/sbin/mosquitto -c /mosquitto/config/mosquitto.conf",
      ]
    networks:
      scenescape:
        aliases:
          - broker.scenescape.intel.com
    user: "${UID}:${GID}"
    restart: on-failure:5

  node-red:
    image: docker.io/nodered/node-red:4.0
    user: root
    environment:
      TZ: America/Los_Angeles
      http_proxy: ${http_proxy}
      https_proxy: ${https_proxy}
      no_proxy: ${no_proxy},.scenescape.intel.com,influxdb2
      HTTP_PROXY: ${http_proxy}
      HTTPS_PROXY: ${https_proxy}
      NO_PROXY: ${no_proxy},.scenescape.intel.com,influxdb2
    networks:
      - scenescape
    volumes:
      - ./${SAMPLE_APP}/src/node-red/flows.json:/data/flows.json
      - ./${SAMPLE_APP}/src/node-red/flows_cred.json:/tmp/flows_cred.json
      - ./${SAMPLE_APP}/src/node-red/settings.js:/data/settings.js
      - ./${SAMPLE_APP}/src/node-red/install_package.sh:/data/install_package.sh
      - node-red-node-modules:/usr/src/node-red/node_modules
    secrets:
      - influxdb2-admin-token
      - root-cert
      - broker-cert
      - broker-key
    depends_on:
      influxdb2:
        condition: service_started
      broker:
        condition: service_started
    entrypoint: [
        "/bin/bash",
        "-e",
        "-c",
        "cp /tmp/flows_cred.json /data/flows_cred.json && \
        sed -i \"s/<influx-api-token>/$(cat /run/secrets/influxdb2-admin-token)/g\" /data/flows_cred.json && \
        bash /data/install_package.sh && \
        /usr/src/node-red/entrypoint.sh",
      ]
    restart: on-failure:5

  influxdb2:
    image: docker.io/library/influxdb:2.7.11
    ports:
      - "8086:8086"
    environment:
      DOCKER_INFLUXDB_INIT_MODE: setup
      DOCKER_INFLUXDB_INIT_USERNAME_FILE: /run/secrets/influxdb2-admin-username
      DOCKER_INFLUXDB_INIT_PASSWORD_FILE: /run/secrets/influxdb2-admin-password
      DOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE: /run/secrets/influxdb2-admin-token
      DOCKER_INFLUXDB_INIT_ORG: ITM
      DOCKER_INFLUXDB_INIT_BUCKET: SS-Anthem
      DOCKER_INFLUXDB_INIT_RETENTION: 1w
      http_proxy: ${http_proxy}
      https_proxy: ${https_proxy}
      no_proxy: ${no_proxy},.scenescape.intel.com,influxdb2
      HTTP_PROXY: ${http_proxy}
      HTTPS_PROXY: ${https_proxy}
      NO_PROXY: ${no_proxy},.scenescape.intel.com,influxdb2
    secrets:
      - influxdb2-admin-username
      - influxdb2-admin-password
      - influxdb2-admin-token
    volumes:
      - type: volume
        source: influxdb2-data
        target: /var/lib/influxdb2
      - type: volume
        source: influxdb2-config
        target: /etc/influxdb2
    restart: on-failure:5
    networks:
      - scenescape

  grafana:
    image: docker.io/grafana/grafana:11.6.0
    user: root
    volumes:
      - ./${SAMPLE_APP}/src/grafana/data/dashboards/anthem-intersection.json:/tmp/anthem-intersection.json
      - ./${SAMPLE_APP}/src/grafana/dashboards.yml:/tmp/dashboards.yml
      - ./${SAMPLE_APP}/src/grafana/datasources.yml:/tmp/datasources.yml
      - grafana-storage:/var/lib/grafana
    environment:
      http_proxy: ${http_proxy}
      https_proxy: ${https_proxy}
      no_proxy: ${no_proxy},.scenescape.intel.com,influxdb2
      HTTP_PROXY: ${http_proxy}
      HTTPS_PROXY: ${https_proxy}
      NO_PROXY: ${no_proxy},.scenescape.intel.com,influxdb2
      GF_SERVER_ROOT_URL: https://localhost/grafana/
      GF_SERVER_SERVE_FROM_SUB_PATH: true
      GF_PANELS_DISABLE_SANITIZE_HTML: true
      GF_SECURITY_ALLOW_EMBEDDING: true
    restart: on-failure:5
    networks:
      - scenescape
    secrets:
      - influxdb2-admin-token
    depends_on:
      influxdb2:
        condition: service_started
    entrypoint: [
        "/bin/bash",
        "-e",
        "-c",
        "mkdir -p /var/lib/grafana/dashboards && \
        cp /tmp/anthem-intersection.json /var/lib/grafana/dashboards/anthem-intersection.json && \
        mkdir -p /etc/grafana/provisioning/dashboards && \
        cp /tmp/dashboards.yml /etc/grafana/provisioning/dashboards/main.yml && \
        mkdir -p /etc/grafana/provisioning/datasources && \
        cp /tmp/datasources.yml /etc/grafana/provisioning/datasources/datasources.yml && \
        sed -i \"s/<influx-api-token>/$(cat /run/secrets/influxdb2-admin-token)/g\" /etc/grafana/provisioning/datasources/datasources.yml && \
        /run.sh",
      ]

  dlstreamer-pipeline-server:
    image: ${DLSTREAMER_PIPELINE_SERVER_IMAGE}
    networks:
      - scenescape
    privileged: true
    entrypoint: ["./run.sh"]
    devices:
      - "/dev/dri:/dev/dri"
    device_cgroup_rules:
      - "c 189:* rmw"
      - "c 209:* rmw"
      - "a 189:* rwm"
    group_add:
      - "109"
      - "110"
      - "992"
    depends_on:
      - broker
      - ntpserver
    environment:
      - ENABLE_RTSP=true
      - RUN_MODE=EVA
      - GENICAM=Balluff
      - DETECTION_DEVICE=CPU
      - CLASSIFICATION_DEVICE=CPU
      - ADD_UTCTIME_TO_METADATA=true
      - APPEND_PIPELINE_NAME_TO_PUBLISHER_TOPIC=false
      - REST_SERVER_PORT=8080
      - MQTT_HOST=broker.scenescape.intel.com
      - MQTT_PORT=1883
      - http_proxy=${http_proxy}
      - https_proxy=${https_proxy}
      - no_proxy=${no_proxy},.scenescape.intel.com,influxdb2
      - NO_PROXY=${no_proxy},.scenescape.intel.com,influxdb2
      - HTTP_PROXY=${http_proxy}
      - HTTPS_PROXY=${https_proxy}
      # NPU related environment variables
      - ZE_ENABLE_ALT_DRIVERS=libze_intel_npu.so
    volumes:
      - ./${SAMPLE_APP}/src/dlstreamer-pipeline-server/config.json:/home/pipeline-server/config.json
      - ./${SAMPLE_APP}/src/dlstreamer-pipeline-server/user_scripts:/home/pipeline-server/user_scripts
      - ./${SAMPLE_APP}/src/dlstreamer-pipeline-server/videos:/home/pipeline-server/videos
      - ./${SAMPLE_APP}/src/dlstreamer-pipeline-server/models/intersection:/home/pipeline-server/models/object_detection/intersection
      - dlstreamer-pipeline-server-pipeline-root:/var/cache/pipeline_root:uid=1999,gid=1999
      - dlstreamer-pipeline-server-tmp:/tmp
      - "/dev:/dev"
    secrets:
      - source: root-cert
        target: certs/scenescape-ca.pem
    restart: on-failure:5

  pgserver:
    image: postgres:17.6
    env_file:
      - ./${SAMPLE_APP}/src/secrets/pgserver/pgserver.env
    networks:
      - scenescape
    environment:
      POSTGRES_USER: scenescape
      POSTGRES_DB: scenescape
    volumes:
      - pgserver-db:/var/lib/postgresql/data
    ports:
      - "5432:5432"

  web:
    image: intel/scenescape-manager:v2026.0.0-rc1
    init: true
    networks:
      scenescape:
        aliases:
          - web.scenescape.intel.com
    depends_on:
      pgserver:
        condition: service_started
      broker:
        condition: service_started
    environment:
      - http_proxy=${http_proxy}
      - https_proxy=${https_proxy}
      - no_proxy=${no_proxy},.scenescape.intel.com,influxdb2
      - NO_PROXY=${no_proxy},.scenescape.intel.com,influxdb2
      - HTTP_PROXY=${http_proxy}
      - HTTPS_PROXY=${https_proxy}
      - SUPASS=${SUPASS}
      - EXAMPLEDB=/home/scenescape/SceneScape/smart-intersection-ri.tar.bz2
    command: >
      webserver
      --dbhost pgserver
      --dbtype postgres
      --dbport 5432
      --broker broker.scenescape.intel.com
      --brokerauth /run/secrets/browser.auth
      --brokerrootcert /run/secrets/certs/scenescape-ca.pem
    healthcheck:
      test: "curl --insecure -X GET https://web.scenescape.intel.com:443/api/v1/database-ready | grep 'true'"
      interval: 10s
      timeout: 120s
      retries: 10
      start_period: 10s
    cap_add:
      - SYS_ADMIN
    devices:
      - /dev/fuse
    security_opt:
      - apparmor:unconfined
    volumes:
      - pgserver-media:/workspace/media
      - pgserver-migrations:/workspace/migrations
      - ./${SAMPLE_APP}/src/webserver/user_access_config.json:/home/scenescape/SceneScape/user_access_config.json
      - ./${SAMPLE_APP}/src/webserver/smart-intersection-ri.tar.bz2:/home/scenescape/SceneScape/smart-intersection-ri.tar.bz2
    secrets:
      - source: root-cert
        target: certs/scenescape-ca.pem
      - source: web-cert
        target: certs/scenescape-web.crt
      - source: web-key
        target: certs/scenescape-web.key
      - django
      - browser.auth
      - controller.auth
    restart: on-failure:5

  scene:
    image: intel/scenescape-controller:v2026.0.0-rc1
    init: true
    environment:
      - http_proxy=${http_proxy}
      - https_proxy=${https_proxy}
      - no_proxy=${no_proxy},.scenescape.intel.com,influxdb2
      - NO_PROXY=${no_proxy},.scenescape.intel.com,influxdb2
      - HTTP_PROXY=${http_proxy}
      - HTTPS_PROXY=${https_proxy}
      - CONTROLLER_ENABLE_METRICS
      - CONTROLLER_METRICS_ENDPOINT
      - CONTROLLER_METRICS_EXPORT_INTERVAL_S
      - CONTROLLER_ENABLE_TRACING
      - CONTROLLER_TRACING_ENDPOINT
      - CONTROLLER_TRACING_SAMPLE_RATIO
    networks:
      scenescape:
    configs:
      - source: tracker-config
        target: /home/scenescape/SceneScape/tracker-config.json
    depends_on:
      web:
        condition: service_healthy
      broker:
        condition: service_started
      ntpserver:
        condition: service_started
    command: >
      --restauth /run/secrets/controller.auth
      --brokerauth /run/secrets/controller.auth
      --broker broker.scenescape.intel.com
      --ntp ntpserv
    volumes:
      - pgserver-media:/home/scenescape/SceneScape/media
    secrets:
      - source: root-cert
        target: certs/scenescape-ca.pem
      - django
      - controller.auth
    restart: on-failure:5

  nginx:
    image: nginx:1.27-alpine
    container_name: nginx-reverse-proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./${SAMPLE_APP}/src/nginx/nginx.conf:/etc/nginx/nginx.conf:ro"
      - "./${SAMPLE_APP}/src/nginx/ssl:/etc/nginx/ssl:ro"
    networks:
      - scenescape
    depends_on:
      - dlstreamer-pipeline-server
      - grafana
      - node-red
      - influxdb2
      - web
    environment:
      - http_proxy=${http_proxy}
      - https_proxy=${https_proxy}
      - no_proxy=${no_proxy},${HOST_IP}
      - NO_PROXY=${no_proxy},${HOST_IP}
    restart: on-failure:5

networks:
  scenescape:

secrets:
  root-cert:
    file: ./${SAMPLE_APP}/src/secrets/certs/scenescape-ca.pem
  broker-cert:
    file: ./${SAMPLE_APP}/src/secrets/certs/scenescape-broker.crt
  broker-key:
    file: ./${SAMPLE_APP}/src/secrets/certs/scenescape-broker.key
  web-cert:
    file: ./${SAMPLE_APP}/src/secrets/certs/scenescape-web.crt
  web-key:
    file: ./${SAMPLE_APP}/src/secrets/certs/scenescape-web.key
  influxdb2-admin-username:
    file: ./${SAMPLE_APP}/src/secrets/influxdb2/influxdb2-admin-username
  influxdb2-admin-password:
    file: ./${SAMPLE_APP}/src/secrets/influxdb2/influxdb2-admin-password
  influxdb2-admin-token:
    file: ./${SAMPLE_APP}/src/secrets/influxdb2/influxdb2-admin-token
  django:
    file: ./${SAMPLE_APP}/src/secrets/django
  browser.auth:
    file: ./${SAMPLE_APP}/src/secrets/browser.auth
  controller.auth:
    file: ./${SAMPLE_APP}/src/secrets/controller.auth

configs:
  mosquitto-secure:
    file: ./${SAMPLE_APP}/src/mosquitto/mosquitto-secure.conf
  tracker-config:
    # Use this configuration file to run tracking with time-chunking enabled
    # file: ./controller/config/tracker-config-time-chunking.json
    file: ./${SAMPLE_APP}/src/controller/tracker-config.json

volumes:
  dlstreamer-pipeline-server-pipeline-root:
    driver: local
    driver_opts:
      type: tmpfs
      device: tmpfs
  dlstreamer-pipeline-server-tmp:
    driver: local
    driver_opts:
      type: tmpfs
      device: tmpfs
  influxdb2-data:
  influxdb2-config:
  grafana-storage:
  pgserver-db:
  pgserver-migrations:
  pgserver-media:
  node-red-node-modules:
  sample-data: