docker-compose.yml

# Portage Engine local control-plane stack.
#
# Package builders are deliberately absent. Builds run only in disposable
# native Gentoo roots/VMs; this Compose project hosts the control plane and its
# local development dependencies.
#
# All published ports bind to 127.0.0.1 and can be overridden with
# .env.compose (copy .env.compose.example). Run scripts/check-compose-ports.sh
# before starting when other local stacks are active.

x-default-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "3"

services:
  postgres:
    image: postgres:18.4-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${PORTAGE_POSTGRES_DB:-portage_engine}
      POSTGRES_USER: ${PORTAGE_POSTGRES_USER:-portage}
      POSTGRES_PASSWORD: ${PORTAGE_POSTGRES_PASSWORD:-portage-postgres-local}
      PORTAGE_POSTGRES_APP_USER: ${PORTAGE_POSTGRES_APP_USER:-portage_app}
      PORTAGE_POSTGRES_APP_PASSWORD: ${PORTAGE_POSTGRES_APP_PASSWORD:-portage-app-local}
      PORTAGE_POSTGRES_SIGNER_PASSWORD: ${PORTAGE_POSTGRES_SIGNER_PASSWORD:-portage-signer-local}
      PORTAGE_POSTGRES_ACTUATOR_PASSWORD: ${PORTAGE_POSTGRES_ACTUATOR_PASSWORD:-portage-actuator-local}
      OTEL_POSTGRES_PASSWORD: ${PORTAGE_OTEL_POSTGRES_PASSWORD:-portage-otel-local}
    ports:
      - "127.0.0.1:${PORTAGE_POSTGRES_PORT:-25432}:5432"
    volumes:
      # PostgreSQL 18 uses a major-version-specific PGDATA below this path.
      - postgres-data:/var/lib/postgresql
      - ./deploy/postgres/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\"",
        ]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s
    networks:
      - portage-net
    logging: *default-logging

  redis:
    image: redis:8.8.0-alpine
    restart: unless-stopped
    command:
      - redis-server
      - --appendonly
      - "yes"
      - --appendfsync
      - everysec
      - --requirepass
      - ${PORTAGE_REDIS_PASSWORD:-portage-redis-local}
    environment:
      REDIS_PASSWORD: ${PORTAGE_REDIS_PASSWORD:-portage-redis-local}
    ports:
      - "127.0.0.1:${PORTAGE_REDIS_PORT:-26379}:6379"
    volumes:
      - redis-data:/data
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "redis-cli --no-auth-warning -a \"$${REDIS_PASSWORD}\" ping | grep PONG",
        ]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 5s
    networks:
      - portage-net
    logging: *default-logging

  loki:
    image: grafana/loki:3.7.2
    restart: unless-stopped
    command: ["-config.file=/etc/loki/local-config.yaml"]
    ports:
      - "127.0.0.1:${PORTAGE_LOKI_PORT:-23100}:3100"
    volumes:
      - ./deploy/observability/loki.yaml:/etc/loki/local-config.yaml:ro
      - loki-data:/loki
    networks:
      - portage-net
    logging: *default-logging

  tempo:
    image: grafana/tempo:2.10.5
    restart: unless-stopped
    command: ["-config.file=/etc/tempo/tempo.yaml"]
    ports:
      - "127.0.0.1:${PORTAGE_TEMPO_PORT:-23200}:3200"
    volumes:
      - ./deploy/observability/tempo.yaml:/etc/tempo/tempo.yaml:ro
      - tempo-data:/var/tempo
    networks:
      - portage-net
    logging: *default-logging

  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.153.0
    restart: unless-stopped
    command:
      - --config=/etc/otelcol-contrib/config.yaml
      - --feature-gates=receiver.postgresql.separateSchemaAttr
    environment:
      POSTGRES_USER: portage_otel
      POSTGRES_PASSWORD: ${PORTAGE_OTEL_POSTGRES_PASSWORD:-portage-otel-local}
      POSTGRES_DB: ${PORTAGE_POSTGRES_DB:-portage_engine}
      REDIS_PASSWORD: ${PORTAGE_REDIS_PASSWORD:-portage-redis-local}
    ports:
      - "127.0.0.1:${PORTAGE_OTLP_GRPC_PORT:-24317}:4317"
      - "127.0.0.1:${PORTAGE_OTLP_HTTP_PORT:-24318}:4318"
      - "127.0.0.1:${PORTAGE_OTEL_HEALTH_PORT:-23133}:13133"
    volumes:
      - ./deploy/observability/otel-collector.yaml:/etc/otelcol-contrib/config.yaml:ro
      - portage-logs:/var/log/portage-engine:ro
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      loki:
        condition: service_started
      tempo:
        condition: service_started
    networks:
      - portage-net
    logging: *default-logging

  prometheus:
    image: prom/prometheus:v3.11.2
    restart: unless-stopped
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=7d
      - --web.enable-lifecycle
    ports:
      - "127.0.0.1:${PORTAGE_PROMETHEUS_PORT:-29090}:9090"
    volumes:
      - ./deploy/observability/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    depends_on:
      otel-collector:
        condition: service_started
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -q --spider http://127.0.0.1:9090/-/ready || exit 1",
        ]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s
    networks:
      - portage-net
    logging: *default-logging

  grafana:
    image: grafana/grafana:13.1.0
    restart: unless-stopped
    environment:
      GF_SECURITY_ADMIN_USER: ${PORTAGE_GRAFANA_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${PORTAGE_GRAFANA_PASSWORD:-portage-grafana-local}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      GF_ANALYTICS_REPORTING_ENABLED: "false"
      GF_ANALYTICS_CHECK_FOR_UPDATES: "false"
      GF_ANALYTICS_CHECK_FOR_PLUGIN_UPDATES: "false"
      GF_PLUGINS_PREINSTALL_DISABLED: "true"
      GF_PLUGINS_PLUGIN_ADMIN_ENABLED: "false"
    ports:
      - "127.0.0.1:${PORTAGE_GRAFANA_PORT:-23000}:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./deploy/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
      - ./deploy/grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./deploy/grafana/portage-engine-dashboard.json:/var/lib/grafana/dashboards/portage-engine-dashboard.json:ro
    depends_on:
      prometheus:
        condition: service_healthy
      loki:
        condition: service_started
      tempo:
        condition: service_started
    networks:
      - portage-net
    logging: *default-logging

  portage-migrate:
    image: portage-engine-control-plane:local
    build:
      context: .
    command: ["/usr/local/bin/portage-migrate", "-config", "/nonexistent.conf", "up"]
    environment:
      DATABASE_ENABLED: "true"
      PGHOST: postgres
      PGPORT: "5432"
      PGDATABASE: ${PORTAGE_POSTGRES_DB:-portage_engine}
      PGUSER: ${PORTAGE_POSTGRES_USER:-portage}
      PGPASSWORD: ${PORTAGE_POSTGRES_PASSWORD:-portage-postgres-local}
      # The Compose bridge is private to this host. Shared/remote deployments
      # keep the application default (verify-full) and provide a trusted CA.
      PGSSLMODE: disable
    depends_on:
      portage-db-bootstrap:
        condition: service_completed_successfully
    networks:
      - portage-net
    logging: *default-logging

  # Init scripts run only for a new PostgreSQL volume. This repeatable bootstrap
  # also creates/repairs the least-privilege signer role on upgraded volumes.
  portage-db-bootstrap:
    image: postgres:18.4-alpine
    restart: "no"
    environment:
      PGHOST: postgres
      PGPORT: "5432"
      PGDATABASE: ${PORTAGE_POSTGRES_DB:-portage_engine}
      PGUSER: ${PORTAGE_POSTGRES_USER:-portage}
      PGPASSWORD: ${PORTAGE_POSTGRES_PASSWORD:-portage-postgres-local}
      SIGNER_PASSWORD: ${PORTAGE_POSTGRES_SIGNER_PASSWORD:-portage-signer-local}
      ACTUATOR_PASSWORD: ${PORTAGE_POSTGRES_ACTUATOR_PASSWORD:-portage-actuator-local}
    command:
      - /bin/sh
      - -ec
      - |
        psql --set=ON_ERROR_STOP=1 --set=signer_password="$${SIGNER_PASSWORD}" --set=actuator_password="$${ACTUATOR_PASSWORD}" <<'EOSQL'
        SELECT format('CREATE ROLE portage_signer LOGIN PASSWORD %L', :'signer_password')
        WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'portage_signer')
        \gexec
        SELECT format('ALTER ROLE portage_signer LOGIN PASSWORD %L', :'signer_password')
        \gexec
        SELECT format('CREATE ROLE portage_actuator LOGIN PASSWORD %L', :'actuator_password')
        WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'portage_actuator')
        \gexec
        SELECT format('ALTER ROLE portage_actuator LOGIN PASSWORD %L', :'actuator_password')
        \gexec
        SELECT format('GRANT CONNECT ON DATABASE %I TO portage_signer', current_database())
        \gexec
        GRANT USAGE ON SCHEMA public TO portage_signer;
        SELECT 'GRANT SELECT, UPDATE ON signing_tasks TO portage_signer'
        WHERE to_regclass('public.signing_tasks') IS NOT NULL
        \gexec
        SELECT 'GRANT SELECT ON build_jobs, build_attempts, worker_leases, workers, artifacts, goose_db_version TO portage_signer'
        WHERE to_regclass('public.signing_tasks') IS NOT NULL
        \gexec
        SELECT format('GRANT CONNECT ON DATABASE %I TO portage_actuator', current_database())
        \gexec
        GRANT USAGE ON SCHEMA public TO portage_actuator;
        SELECT 'GRANT SELECT ON scheduler_capacity_pool_state, workers, worker_leases, phase_work_items, goose_db_version TO portage_actuator'
        WHERE to_regclass('public.scheduler_capacity_actions') IS NOT NULL
        \gexec
        SELECT 'GRANT UPDATE (desired_state, updated_at) ON workers TO portage_actuator'
        WHERE to_regclass('public.scheduler_capacity_actions') IS NOT NULL
        \gexec
        SELECT 'GRANT SELECT, INSERT, UPDATE, DELETE ON scheduler_capacity_actions, scheduler_capacity_instances TO portage_actuator'
        WHERE to_regclass('public.scheduler_capacity_actions') IS NOT NULL
        \gexec
        EOSQL
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - portage-net
    logging: *default-logging

  # Opt-in only: this daemon can create/delete PVE VMs. It has no listener,
  # uses a dedicated database role, and accepts credentials only from env.
  portage-capacity-actuator:
    profiles: ["capacity-actuator"]
    image: portage-engine-control-plane:local
    build:
      context: .
    restart: unless-stopped
    command:
      - /usr/local/bin/portage-capacity-actuator
      - -config
      - /etc/portage-engine/capacity-actuator.json
      - -server-config
      - /nonexistent.conf
    environment:
      DATABASE_ENABLED: "true"
      DATABASE_REQUIRED: "true"
      PGHOST: postgres
      PGPORT: "5432"
      PGDATABASE: ${PORTAGE_POSTGRES_DB:-portage_engine}
      PGUSER: portage_actuator
      PGPASSWORD: ${PORTAGE_POSTGRES_ACTUATOR_PASSWORD:-portage-actuator-local}
      PGSSLMODE: disable
      CLOUD_PVE_TOKEN_ID: ${PORTAGE_CAPACITY_PVE_TOKEN_ID:-}
      CLOUD_PVE_TOKEN_SECRET: ${PORTAGE_CAPACITY_PVE_TOKEN_SECRET:-}
      CLOUD_PVE_USERNAME: ${PORTAGE_CAPACITY_PVE_USERNAME:-}
      CLOUD_PVE_PASSWORD: ${PORTAGE_CAPACITY_PVE_PASSWORD:-}
    volumes:
      - ${PORTAGE_CAPACITY_CONFIG_PATH:-./configs/capacity-actuator.example.json}:/etc/portage-engine/capacity-actuator.json:ro
      - capacity-terraform:/var/lib/portage-engine/capacity-terraform
    depends_on:
      portage-migrate:
        condition: service_completed_successfully
    networks:
      - portage-net
    logging: *default-logging

  portage-server:
    image: portage-engine-control-plane:local
    build:
      context: .
    restart: unless-stopped
    command: >
      bash -o pipefail -c "portage-server -config /nonexistent.conf 2>&1 |
      rotating-log-tee /var/log/portage-engine/server.log"
    environment:
      DATA_DIR: /var/lib/portage-engine/server
      CONTROL_PLANE_ID: compose-primary
      BINPKG_PATH: /var/lib/portage-engine/binpkgs
      STORAGE_LOCAL_DIR: /var/lib/portage-engine/binpkgs
      METRICS_ENABLED: "true"
      DATABASE_ENABLED: "true"
      DATABASE_REQUIRED: "true"
      PGHOST: postgres
      PGPORT: "5432"
      PGDATABASE: ${PORTAGE_POSTGRES_DB:-portage_engine}
      PGUSER: ${PORTAGE_POSTGRES_APP_USER:-portage_app}
      PGPASSWORD: ${PORTAGE_POSTGRES_APP_PASSWORD:-portage-app-local}
      PGSSLMODE: disable
      REDIS_HOST: redis
      REDIS_PORT: "6379"
      REDIS_PASSWORD: ${PORTAGE_REDIS_PASSWORD:-portage-redis-local}
      REDIS_ENABLED: "true"
      REDIS_REQUIRED: "false"
      REDIS_KEY_PREFIX: portage-engine-local
      RATE_LIMIT_PER_MINUTE: ${PORTAGE_RATE_LIMIT_PER_MINUTE:-120}
      RATE_LIMIT_BURST: ${PORTAGE_RATE_LIMIT_BURST:-30}
      CLOUD_DEFAULT_PROVIDER: ${PORTAGE_CLOUD_DEFAULT_PROVIDER:-gcp}
      OTEL_SERVICE_NAME: portage-server
      OTEL_RESOURCE_ATTRIBUTES: deployment.environment.name=local,service.namespace=portage-engine
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_EXPORTER_OTLP_PROTOCOL: http/protobuf
      GPG_ENABLED: "true"
      GPG_PUBLIC_KEY_PATH: /var/lib/portage-engine/signing/public.asc
      SIGNER_WAIT_TIMEOUT_SECONDS: "600"
      AUTH_MODE: ${PORTAGE_AUTH_MODE:-legacy}
      AUTH_PROVIDERS_PATH: ${PORTAGE_AUTH_PROVIDERS_PATH:-}
      AUTH_ADMIN_IDENTITIES: ${PORTAGE_AUTH_ADMIN_IDENTITIES:-}
      PORTAGE_AUTHENTIK_CLIENT_SECRET: ${PORTAGE_AUTHENTIK_CLIENT_SECRET:-}
      PORTAGE_GOOGLE_CLIENT_SECRET: ${PORTAGE_GOOGLE_CLIENT_SECRET:-}
      PORTAGE_GITHUB_CLIENT_SECRET: ${PORTAGE_GITHUB_CLIENT_SECRET:-}
      API_KEY: ${PORTAGE_API_KEY:-}
      STEP_UP_API_KEY: ${PORTAGE_STEP_UP_API_KEY:-}
      OIDC_ISSUER_URL: ${PORTAGE_OIDC_ISSUER_URL:-}
      OIDC_AUDIENCE: ${PORTAGE_OIDC_AUDIENCE:-}
      OIDC_ADMIN_SUBJECTS: ${PORTAGE_OIDC_ADMIN_SUBJECTS:-}
      OIDC_ALLOW_INSECURE_HTTP: ${PORTAGE_OIDC_ALLOW_INSECURE_HTTP:-false}
      OIDC_SESSION_IDLE_MINUTES: ${PORTAGE_OIDC_SESSION_IDLE_MINUTES:-60}
      OIDC_SESSION_MAX_MINUTES: ${PORTAGE_OIDC_SESSION_MAX_MINUTES:-720}
      OIDC_STEP_UP_MAX_AGE_MINUTES: ${PORTAGE_OIDC_STEP_UP_MAX_AGE_MINUTES:-10}
      OIDC_STEP_UP_AMR_VALUES: ${PORTAGE_OIDC_STEP_UP_AMR_VALUES:-}
      OIDC_STEP_UP_ACR_VALUES: ${PORTAGE_OIDC_STEP_UP_ACR_VALUES:-}
      WORKER_GATEWAY_ENABLED: ${PORTAGE_WORKER_GATEWAY_ENABLED:-false}
      WORKER_GATEWAY_PORT: "9443"
      WORKER_GATEWAY_ADVERTISE_URL: ${PORTAGE_WORKER_GATEWAY_ADVERTISE_URL:-}
      WORKER_GATEWAY_TLS_CERT: /run/worker-pki/server.crt
      WORKER_GATEWAY_TLS_KEY: /run/worker-pki/server.key
      WORKER_GATEWAY_SERVER_CA: /run/worker-pki/ca.crt
      WORKER_GATEWAY_CLIENT_CA: /run/worker-pki/ca.crt
      WORKER_GATEWAY_ISSUER_ID: ${PORTAGE_WORKER_GATEWAY_ISSUER_ID:-compose-local}
      WORKER_GATEWAY_ISSUER_PROVIDER: ${PORTAGE_WORKER_GATEWAY_ISSUER_PROVIDER:-file}
      WORKER_GATEWAY_ISSUER_CERT: /run/worker-pki/ca.crt
      WORKER_GATEWAY_ISSUER_KEY: /run/worker-pki/ca.key
      WORKER_GATEWAY_VAULT_ADDRESS: ${PORTAGE_WORKER_GATEWAY_VAULT_ADDRESS:-}
      WORKER_GATEWAY_VAULT_MOUNT: ${PORTAGE_WORKER_GATEWAY_VAULT_MOUNT:-pki}
      WORKER_GATEWAY_VAULT_ROLE: ${PORTAGE_WORKER_GATEWAY_VAULT_ROLE:-portage-worker}
      WORKER_GATEWAY_VAULT_TOKEN_FILE: ${PORTAGE_WORKER_GATEWAY_VAULT_TOKEN_FILE:-/run/worker-secrets/vault-token}
      WORKER_GATEWAY_VAULT_NAMESPACE: ${PORTAGE_WORKER_GATEWAY_VAULT_NAMESPACE:-}
      WORKER_GATEWAY_VAULT_SERVER_CA: ${PORTAGE_WORKER_GATEWAY_VAULT_SERVER_CA:-}
      WORKER_GATEWAY_VAULT_TIMEOUT_SECONDS: ${PORTAGE_WORKER_GATEWAY_VAULT_TIMEOUT_SECONDS:-15}
      PHASE_EXECUTOR_MODE: ${PORTAGE_PHASE_EXECUTOR_MODE:-shadow}
      EXECUTOR_ZONES: ${PORTAGE_EXECUTOR_ZONES:-default}
      EXECUTOR_CAPABILITIES: ${PORTAGE_EXECUTOR_CAPABILITIES:-}
      WORKER_CERTIFICATE_TTL_MINUTES: ${PORTAGE_WORKER_CERTIFICATE_TTL_MINUTES:-180}
      SCHEDULER_AUTOSCALE_MODE: ${PORTAGE_SCHEDULER_AUTOSCALE_MODE:-observe}
      SCHEDULER_AUTOSCALE_MIN_SLOTS: ${PORTAGE_SCHEDULER_AUTOSCALE_MIN_SLOTS:-1}
      SCHEDULER_AUTOSCALE_MAX_SLOTS: ${PORTAGE_SCHEDULER_AUTOSCALE_MAX_SLOTS:-64}
      SCHEDULER_AUTOSCALE_PROVIDER_MAX_SLOTS: ${PORTAGE_SCHEDULER_AUTOSCALE_PROVIDER_MAX_SLOTS:-pve:64}
      SCHEDULER_AUTOSCALE_TARGET_READY_PER_SLOT: ${PORTAGE_SCHEDULER_AUTOSCALE_TARGET_READY_PER_SLOT:-2}
      SCHEDULER_AUTOSCALE_COOLDOWN_SECONDS: ${PORTAGE_SCHEDULER_AUTOSCALE_COOLDOWN_SECONDS:-60}
      SCHEDULER_AUTOSCALE_SCALE_DOWN_SECONDS: ${PORTAGE_SCHEDULER_AUTOSCALE_SCALE_DOWN_SECONDS:-600}
      SCHEDULER_AUTOSCALE_INTERVAL_SECONDS: ${PORTAGE_SCHEDULER_AUTOSCALE_INTERVAL_SECONDS:-15}
    ports:
      - "127.0.0.1:${PORTAGE_SERVER_PORT:-18080}:8080"
      # mTLS makes this safe to expose to the builder VLAN when explicitly
      # enabled. Keep the default loopback bind for local-only development.
      - "${PORTAGE_WORKER_GATEWAY_BIND:-127.0.0.1}:${PORTAGE_WORKER_GATEWAY_PORT:-19444}:9443"
    volumes:
      - portage-logs:/var/log/portage-engine
      - portage-state:/var/lib/portage-engine
      - ./configs:/etc/portage-engine/configs:ro
      - ${PORTAGE_WORKER_PKI_DIR:-./.local/worker-pki}:/run/worker-pki:ro
      - ${PORTAGE_WORKER_SECRETS_DIR:-./.local/worker-secrets}:/run/worker-secrets:ro
    depends_on:
      portage-migrate:
        condition: service_completed_successfully
      portage-signer:
        condition: service_started
      redis:
        condition: service_healthy
      otel-collector:
        condition: service_started
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "bash -ec 'exec 3<>/dev/tcp/127.0.0.1/8080'",
        ]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 30s
    networks:
      - portage-net
    logging: *default-logging

  portage-signer:
    image: portage-engine-control-plane:local
    build:
      context: .
    restart: unless-stopped
    command:
      - /usr/local/bin/portage-signer
      - -config
      - /nonexistent.conf
    environment:
      BINPKG_PATH: /var/lib/portage-engine/binpkgs
      DATABASE_ENABLED: "true"
      DATABASE_REQUIRED: "true"
      PGHOST: postgres
      PGPORT: "5432"
      PGDATABASE: ${PORTAGE_POSTGRES_DB:-portage_engine}
      PGUSER: portage_signer
      PGPASSWORD: ${PORTAGE_POSTGRES_SIGNER_PASSWORD:-portage-signer-local}
      PGSSLMODE: disable
      GPG_ENABLED: "true"
      GPG_KEY_ID: ${PORTAGE_SIGNER_GPG_KEY_ID:-}
      GPG_AUTO_CREATE: ${PORTAGE_SIGNER_GPG_AUTO_CREATE:-true}
      GPG_KEY_NAME: Portage Engine Isolated Signer
      GPG_KEY_EMAIL: signer@portage-engine.local
      GPG_HOME: /var/lib/portage-signer/gpg
      GPG_PUBLIC_KEY_PATH: /var/lib/portage-engine/signing/public.asc
    volumes:
      - portage-state:/var/lib/portage-engine
      - portage-signer-key:/var/lib/portage-signer
    depends_on:
      portage-migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD-SHELL", "kill -0 1"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s
    networks:
      - portage-net
    logging: *default-logging

  portage-dashboard:
    image: portage-engine-control-plane:local
    build:
      context: .
    restart: unless-stopped
    command: >
      bash -o pipefail -c "portage-dashboard -config /nonexistent.conf 2>&1 |
      rotating-log-tee /var/log/portage-engine/dashboard.log"
    environment:
      SERVER_URL: http://portage-server:8080
      SERVER_API_KEY: ${PORTAGE_API_KEY:-}
      SERVER_STEP_UP_API_KEY: ${PORTAGE_STEP_UP_API_KEY:-}
      AUTH_ENABLED: "true"
      JWT_SECRET: ${PORTAGE_DASHBOARD_JWT_SECRET:-compose-demo-jwt-secret-0123456789abcdef}
      ADMIN_USER: ${PORTAGE_DASHBOARD_USER:-admin}
      ADMIN_PASSWORD: ${PORTAGE_DASHBOARD_PASSWORD:-portage-demo}
      ALLOW_ANONYMOUS: "false"
      COOKIE_SECURE: ${PORTAGE_DASHBOARD_COOKIE_SECURE:-false}
      AUTH_PROVIDERS_PATH: ${PORTAGE_AUTH_PROVIDERS_PATH:-}
      PORTAGE_AUTHENTIK_CLIENT_SECRET: ${PORTAGE_AUTHENTIK_CLIENT_SECRET:-}
      PORTAGE_GOOGLE_CLIENT_SECRET: ${PORTAGE_GOOGLE_CLIENT_SECRET:-}
      PORTAGE_GITHUB_CLIENT_SECRET: ${PORTAGE_GITHUB_CLIENT_SECRET:-}
      OIDC_ENABLED: ${PORTAGE_DASHBOARD_OIDC_ENABLED:-false}
      OIDC_ISSUER_URL: ${PORTAGE_OIDC_ISSUER_URL:-}
      # Legacy single-OIDC compatibility.
      OIDC_CLIENT_ID: ${PORTAGE_DASHBOARD_OIDC_CLIENT_ID:-}
      OIDC_CLIENT_SECRET: ${PORTAGE_DASHBOARD_OIDC_CLIENT_SECRET:-}
      OIDC_REDIRECT_URL: ${PORTAGE_DASHBOARD_OIDC_REDIRECT_URL:-}
      OIDC_ALLOW_INSECURE_HTTP: ${PORTAGE_OIDC_ALLOW_INSECURE_HTTP:-false}
      OTEL_SERVICE_NAME: portage-dashboard
      OTEL_RESOURCE_ATTRIBUTES: deployment.environment.name=local,service.namespace=portage-engine
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      OTEL_EXPORTER_OTLP_PROTOCOL: http/protobuf
    ports:
      - "127.0.0.1:${PORTAGE_DASHBOARD_PORT:-18081}:8081"
    volumes:
      - portage-logs:/var/log/portage-engine
      - ./configs:/etc/portage-engine/configs:ro
    depends_on:
      portage-server:
        condition: service_healthy
    networks:
      - portage-net
    logging: *default-logging

networks:
  portage-net:
    driver: bridge

volumes:
  postgres-data:
  redis-data:
  loki-data:
  tempo-data:
  prometheus-data:
  grafana-data:
  portage-logs:
  portage-state:
  portage-signer-key:
  capacity-terraform:
  gomod-cache:
  gobuild-cache: