docker-compose.yml

# Before running docker compose --profile postgres up for the first time,
# first copy the env.example file to .env and fill in the values.
# `cp env.example .env`
# (edit values as needed)
#
# Then, build and run with:
# `docker compose --profile postgres build`
# `docker compose --profile postgres up`
#
# Subsequently you should only need to run:
# `docker compose --profile postgres up`
#
# Force a full re-build with no cache from previous builds:
# `docker compose --profile postgres build --no-cache`
# `docker compose --profile postgres up`
#
# If you only changed the .env file, you can do a quick rebuild:
# `docker compose --profile postgres up --force-recreate`
#
# To stop, press CTRL+C (if not running in --detach mode), or run:
# `docker compose --profile postgres down`
#
# omit the --profile postgres flag to run without the postgres service,
# such as when using postgres on your host machine, or a remote server.
# (by default, the Makefile will include --profile postgres, unless POSTGRES_DOCKER=false in your env)

services:
  coordinator-idle:
    profiles: [coordinator-idle]
    image: polis/coordinator-idle:local
    build:
      context: .
      dockerfile: coordinator-rs/deploy/Dockerfile
    entrypoint: [/usr/local/bin/coordinator-idle]
    read_only: true
    user: "10001:10001"
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    environment:
      DATABASE_URL: ${COORDINATOR_DATABASE_URL:-postgresql://polis_coordinator_observer_login@postgres:5432/polisdb?sslmode=verify-full}
      COORDINATOR_DB_HOST_ALLOWLIST: ${COORDINATOR_DB_HOST_ALLOWLIST:-postgres}
      COORDINATOR_DB_PASSWORD_FILE: /run/coordinator/password
      COORDINATOR_DB_CA_BUNDLE: /etc/polis/local-ca.pem
      COORDINATOR_MODE: inactive
      COORDINATOR_WRITER_ENABLED: "false"
      P026_RESERVATION_BYTES: "0"
    volumes:
      - type: bind
        source: ${COORDINATOR_PASSWORD_FILE:-./.coordinator/password}
        target: /run/coordinator/password
        read_only: true
        bind: {create_host_path: false}
      - type: bind
        source: ${COORDINATOR_CA_FILE:-./.coordinator/ca.pem}
        target: /etc/polis/local-ca.pem
        read_only: true
        bind: {create_host_path: false}
    networks: [polis-net]
    restart: "no"

  client-participation-alpha:
    build:
      context: ./client-participation-alpha
      dockerfile: Dockerfile
      args:
        - PUBLIC_SERVICE_URL=${PUBLIC_SERVICE_URL}
        - PUBLIC_AUTH_NAMESPACE=${AUTH_NAMESPACE}
        - OIDC_CACHE_KEY_PREFIX=${OIDC_CACHE_KEY_PREFIX}
        - OIDC_CACHE_KEY_ID_TOKEN_SUFFIX=${OIDC_CACHE_KEY_ID_TOKEN_SUFFIX}
    container_name: client-participation-alpha
    restart: unless-stopped
    networks:
      - "polis-net"
    ports:
      - "4321:4321"
    environment:
      - PUBLIC_SERVICE_URL=${PUBLIC_SERVICE_URL}
      - PUBLIC_AUTH_NAMESPACE=${AUTH_NAMESPACE}
      - INTERNAL_SERVICE_URL=${INTERNAL_SERVICE_URL}
      - PUBLIC_OIDC_CACHE_KEY_PREFIX=${OIDC_CACHE_KEY_PREFIX}
      - PUBLIC_OIDC_CACHE_KEY_ID_TOKEN_SUFFIX=${OIDC_CACHE_KEY_ID_TOKEN_SUFFIX}
    depends_on:
      - "server"

  server:
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - DATABASE_SSL=${DATABASE_SSL}
      - AWS_LOG_GROUP_NAME=${AWS_LOG_GROUP_NAME}
      # Operations pages (docs/configuration.md). Forwarded by name so the
      # switch is visible in `docker compose config`; off unless set to true.
      - OPS_ENABLED=${OPS_ENABLED:-false}
      - OPS_EMAIL_DOMAINS=${OPS_EMAIL_DOMAINS:-}
      - OPS_MIN_VOTERS_FOR_TEXT=${OPS_MIN_VOTERS_FOR_TEXT:-}
      - SIMPLE_ANALYTICS_API_KEY=${SIMPLE_ANALYTICS_API_KEY:-}
      - SIMPLE_ANALYTICS_HOSTNAME=${SIMPLE_ANALYTICS_HOSTNAME:-}
      - OPS_DATA_SOURCE=${OPS_DATA_SOURCE:-}
      - OPS_COST_EXPLORER=${OPS_COST_EXPLORER:-}
    env_file:
      - ${SERVER_ENV_FILE:-.env}
    image: 050917022930.dkr.ecr.us-east-1.amazonaws.com/polis/server:latest
    build:
      context: ./server
      dockerfile: Dockerfile
      target: prod
      args:
        NODE_ENV: production
    labels:
      polis_tag: ${TAG:-dev}
    networks:
      - "polis-net"
    # Scale the server container to a given number of instances.
    scale: 1
    volumes:
      # Persist logs to a volume, so they can be accessed after the container is stopped.
      - server-logs:/app/logs
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"

  delphi:
    image: 050917022930.dkr.ecr.us-east-1.amazonaws.com/polis/delphi:latest
    build:
      context: ./delphi
      additional_contexts:
        queue-rs: ./queue-rs  # the polis-jobs stage (delphi/Dockerfile)
      target: final
    labels:
      polis_tag: ${TAG:-dev}
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - DELPHI_RESULT_BACKEND=${DELPHI_RESULT_BACKEND:-dynamodb}
      - DELPHI_RESULT_ENV=${DELPHI_RESULT_ENV:-}
      - DELPHI_RESULT_SCOPE=${DELPHI_RESULT_SCOPE:-}
      - QUEUE_DATABASE_URL=${QUEUE_DATABASE_URL:-}
      - QUEUE_ENV=${DELPHI_RESULT_ENV:-}
      - POLIS_JOBS_TRANSPORT=${POLIS_JOBS_TRANSPORT:-tls}
      - POLIS_JOBS_CA_FILE=${POLIS_JOBS_CA_FILE:-}
      - POLIS_JOBS_HOST_ALLOWLIST=${POLIS_JOBS_HOST_ALLOWLIST:-}
      - POLIS_JOBS_WORKER_CLASS=delphi
      - POLIS_JOBS_STAGES=delphi_full_pipeline,delphi_narrative
      - POLIS_JOBS_JOURNAL_DIR=/app/data/queue-journal
      - POLIS_JOBS_WORK_DIR=/app/data/queue-work
      - LOG_LEVEL=${DELPHI_LOG_LEVEL:-INFO}
      - DELPHI_DEV_OR_PROD=${DELPHI_DEV_OR_PROD:-prod}
      # The report pipeline reads math_main/math_ptptstats scoped by math_env, so
      # delphi must read the SAME label the server serves: the shared MATH_ENV
      # (`python` = math-python's rows; `prod` = the rows the retired Clojure
      # engine left behind, no longer updated). The writer does not follow it:
      # math-python writes ${MATH_PYTHON_ENV}.
      - MATH_ENV=${MATH_ENV:-prod}
      # DynamoDB connection settings for local mode (will be overridden in prod)
      - DYNAMODB_ENDPOINT=${DYNAMODB_ENDPOINT}
      - POLL_INTERVAL=${POLL_INTERVAL:-2}
      # LLM selection. The service has no env_file, so a key that is not listed
      # here never reaches the container, whatever .env or the deployment env
      # document sets. tests/test_compose_math_env.py checks every key the
      # Delphi code reads for provider/model selection is forwarded.
      # Topic-naming provider: anthropic (Batch API) or ollama.
      - LLM_PROVIDER=${LLM_PROVIDER:-anthropic}
      # Topic-naming model; falls back to ANTHROPIC_MODEL, then a Haiku default.
      - ANTHROPIC_TOPIC_MODEL=${ANTHROPIC_TOPIC_MODEL:-}
      # Per-layer wait for an Anthropic topic-naming batch, in seconds.
      - TOPIC_BATCH_MAX_WAIT_SECONDS=${TOPIC_BATCH_MAX_WAIT_SECONDS:-1800}
      # Local embedding model for the UMAP narrative pipeline.
      - SENTENCE_TRANSFORMER_MODEL=${SENTENCE_TRANSFORMER_MODEL:-all-MiniLM-L6-v2}
      # Ollama connection (used only when LLM_PROVIDER=ollama)
      - OLLAMA_HOST=${OLLAMA_HOST:-}
      - OLLAMA_ENDPOINT=${OLLAMA_ENDPOINT:-}
      - OLLAMA_MODEL=${OLLAMA_MODEL:-}
      # AWS credentials. Declared ONCE: this single pair is shared by every AWS
      # client in the delphi container (DynamoDB and the S3/MinIO clients), so a
      # second declaration would silently win and swap one service's identity for
      # the other's. Locally example.env sets the MinIO pair; in prod the real
      # values come from the deployment env document. Bare pass-through entries
      # omit missing keys so the SDK can resolve the instance role.
      - AWS_REGION=${AWS_REGION:-us-east-1}
      - AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY
      # S3 storage for visualization files
      - AWS_S3_ENDPOINT=${AWS_S3_ENDPOINT}
      - AWS_S3_BUCKET_NAME=${AWS_S3_BUCKET_NAME:-polis-delphi}
      # API keys for LLM services
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - ANTHROPIC_MODEL=${ANTHROPIC_MODEL:-}
      # PostgreSQL connection details for scripts that use them directly
      - DATABASE_HOST=${POSTGRES_HOST}
      - DATABASE_PORT=${POSTGRES_PORT}
      - DATABASE_NAME=${POSTGRES_DB}
      - DATABASE_USER=${POSTGRES_USER:-christian}
      - DATABASE_PASSWORD=${POSTGRES_PASSWORD:-polis123}
      - DATABASE_SSL_MODE=${DATABASE_SSL_MODE:-disable}
      - INSTANCE_SIZE=${INSTANCE_SIZE:-default}
      - AWS_LOG_GROUP_NAME=${AWS_LOG_GROUP_NAME}
      # The image starts the job poller under ddtrace-run only when this is
      # `true`. Off by default: with no Datadog agent listening, the tracer only
      # logs failed sends. Set it (with an agent) to turn tracing back on.
      - DD_TRACE_ENABLED=${DD_TRACE_ENABLED:-false}
    volumes:
      - delphi-queue-state:/app/data
    networks:
      - "polis-net"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    deploy:
      resources:
        limits:
          memory: ${DELPHI_CONTAINER_MEMORY:-16g}
          cpus: ${DELPHI_CONTAINER_CPUS:-2}
    restart: unless-stopped

  # Python math poller — the math engine (it replaced the retired Clojure
  # `math` container).  Profile-gated so it only runs when explicitly requested
  # (`--profile math-python`, or by naming it on the `up` line as the deploy
  # hook does).  Reuses the delphi build target and overrides the command to
  # run the poller CLI.  Writes under its own math_env (`python`), the label
  # production's readers serve (MATH_ENV=python).
  # See delphi/docs/MATH_POLLER_DESIGN.md §4.
  math-python:
    image: 050917022930.dkr.ecr.us-east-1.amazonaws.com/polis/delphi:latest
    build:
      context: ./delphi
      additional_contexts:
        queue-rs: ./queue-rs  # the polis-jobs stage (delphi/Dockerfile)
      target: final
    labels:
      polis_tag: ${TAG:-dev}
    command: ["python", "scripts/math_poller.py"]
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - DATABASE_SSL_MODE=${DATABASE_SSL_MODE:-disable}
      - POSTGRES_CONNECT_TIMEOUT=${POSTGRES_CONNECT_TIMEOUT:-30}
      - LOG_LEVEL=${DELPHI_LOG_LEVEL:-INFO}
      # The label math-python writes (`python`); independent of the readers'
      # MATH_ENV.
      - MATH_ENV=${MATH_PYTHON_ENV:-python}
      # Startup refuses MATH_ENV=prod (the served namespace) unless this is 1.
      - MATH_POLLER_ALLOW_SERVED_ENV=${MATH_POLLER_ALLOW_SERVED_ENV:-}
      # Poll cadences (ms) and boot window (days).
      - POLL_VOTE_INTERVAL_MS=${POLL_VOTE_INTERVAL_MS:-1000}
      - POLL_MOD_INTERVAL_MS=${POLL_MOD_INTERVAL_MS:-1000}
      - POLL_FROM_DAYS_AGO=${POLL_FROM_DAYS_AGO:-10}
      # Optional zid allow/block lists (comma-separated).
      - POLL_ALLOWLIST=${POLL_ALLOWLIST:-}
      - POLL_BLOCKLIST=${POLL_BLOCKLIST:-}
      # Per-zid serialized workers; concurrency across zids.
      - MATH_WORKER_POOL_SIZE=${MATH_WORKER_POOL_SIZE:-4}
      # Error dump dir + retry cap (dump -> retry -> park circuit breaker).
      - MATH_POLLER_DUMP_DIR=${MATH_POLLER_DUMP_DIR:-scratch/errorconv}
      - MATH_POLLER_RETRY_CAP=${MATH_POLLER_RETRY_CAP:-1}
      # LRU conv-cache cap. FINITE by default (200) — an unbounded cache is not
      # acceptable for a long shadow soak (P-019 M4). Set 0 ONLY to opt into
      # unlimited; negative is rejected at startup. Tune from measured churn.
      - MATH_CONV_CACHE_CAP=${MATH_CONV_CACHE_CAP:-200}
      # Shared memory admission (delphi/polismath/poller/admission.py): every
      # computation, live or backfill, reserves its estimated memory before it
      # loads, against the container limit read from the cgroup (the
      # deploy.resources limit below) minus this headroom fraction. The live
      # cache is bounded in retained bytes (MATH_CONV_CACHE_MB, default 30% of
      # the budget) as well as by count. The poller refuses to start when the
      # limit is unknown. Model coefficients: MATH_POLLER_MEM_* (the local
      # measurement, with the per-cell and vote-row terms and the per-job
      # floor recalibrated against every recorded production attempt, P-073
      # §2.1; 116, 413 and 0 restore the previous model). Changing any of them re-arms the
      # backfill gate (its calibration binding includes the model).
      - MATH_POLLER_MEMORY_HEADROOM=${MATH_POLLER_MEMORY_HEADROOM:-0.15}
      - MATH_CONV_CACHE_MB=${MATH_CONV_CACHE_MB:-}
      - MATH_POLLER_MEM_PER_MCELL_MB=${MATH_POLLER_MEM_PER_MCELL_MB:-133}
      - MATH_POLLER_MEM_PER_VOTE_ROW_BYTES=${MATH_POLLER_MEM_PER_VOTE_ROW_BYTES:-1000}
      - MATH_POLLER_MEM_JOB_FLOOR_MB=${MATH_POLLER_MEM_JOB_FLOOR_MB:-64}
      - MATH_POLLER_MEM_SAFETY=${MATH_POLLER_MEM_SAFETY:-1.15}
      # Parked-zid reconciler cadence (ms): recover failed-then-quiet zids from
      # authoritative history without waiting for a new vote (P-019 M1).
      - MATH_POLLER_RECONCILE_INTERVAL_MS=${MATH_POLLER_RECONCILE_INTERVAL_MS:-60000}
      # zid-sharding across PROCESSES (one shard = one process; threads do not
      # parallelise this workload). Default unsharded. Set a UNIQUE index per
      # replica before scaling out, or the shards duplicate every computation.
      - POLL_SHARD_INDEX=${POLL_SHARD_INDEX:-0}
      - POLL_SHARD_COUNT=${POLL_SHARD_COUNT:-1}
      # Single-threaded BLAS/OpenMP for the math engine only, matching the
      # coordinator and probe box, so PCA results do not depend on thread count.
      # Set here, not in delphi/Dockerfile: that image also runs the report
      # pipeline (torch, UMAP, embeddings), which should keep its threads.
      - OMP_NUM_THREADS=1
      - OPENBLAS_NUM_THREADS=1
      - MKL_NUM_THREADS=1
      # Pre-switch backfill (P-070, delphi/polismath/poller/backfill.py): OFF
      # unless MATH_BACKFILL=1. When on, the admitted poller also rebuilds, one
      # at a time and below live work, every conversation that has a
      # MATH_BACKFILL_SOURCE_ENV (prod) row but no coherent row under its own
      # label. SIGUSR1 approves the gate after the N largest; SIGUSR2 pauses or
      # resumes. Every setting and its default: cost-reduction plan P-070 and
      # BackfillConfig. Every BackfillConfig setting is forwarded (except
      # MATH_BACKFILL_STATE_PATH, fixed to the mounted
      # /app/backfill-state/state.json), so a value set in the env file
      # reaches the container.
      - MATH_BACKFILL=${MATH_BACKFILL:-0}
      - MATH_BACKFILL_SOURCE_ENV=${MATH_BACKFILL_SOURCE_ENV:-prod}
      - MATH_BACKFILL_CONCURRENCY=${MATH_BACKFILL_CONCURRENCY:-1}
      - MATH_BACKFILL_LARGE_THRESHOLD=${MATH_BACKFILL_LARGE_THRESHOLD:-2000}
      - MATH_BACKFILL_GATE_AFTER_LARGEST=${MATH_BACKFILL_GATE_AFTER_LARGEST:-10}
      - MATH_BACKFILL_GATE_APPROVED=${MATH_BACKFILL_GATE_APPROVED:-0}
      - MATH_BACKFILL_MEMORY_CEILING_MB=${MATH_BACKFILL_MEMORY_CEILING_MB:-0}
      - MATH_BACKFILL_MIN_INTERVAL_S=${MATH_BACKFILL_MIN_INTERVAL_S:-3}
      - MATH_BACKFILL_LARGE_SLEEP_S=${MATH_BACKFILL_LARGE_SLEEP_S:-30}
      - MATH_BACKFILL_DUTY_CYCLE=${MATH_BACKFILL_DUTY_CYCLE:-0.5}
      - MATH_BACKFILL_MAX_VOTES_PER_MIN=${MATH_BACKFILL_MAX_VOTES_PER_MIN:-2000000}
      - MATH_BACKFILL_PAUSE_POLL_MS=${MATH_BACKFILL_PAUSE_POLL_MS:-1000}
      # These mirror BackfillConfig's env mapping (_ENV_NAMES); defaults match the code.
      - MATH_BACKFILL_MAX_VOTES=${MATH_BACKFILL_MAX_VOTES:-10000000}
      - MATH_BACKFILL_TELEMETRY_STALE_S=${MATH_BACKFILL_TELEMETRY_STALE_S:-60}
      - MATH_BACKFILL_PAGE_SIZE=${MATH_BACKFILL_PAGE_SIZE:-50}
      - MATH_BACKFILL_RESWEEP_S=${MATH_BACKFILL_RESWEEP_S:-300}
      - MATH_BACKFILL_STALE_GRACE_S=${MATH_BACKFILL_STALE_GRACE_S:-3600}
      - MATH_BACKFILL_REVALIDATE_S=${MATH_BACKFILL_REVALIDATE_S:-3600}
      - MATH_BACKFILL_MAX_ATTEMPTS=${MATH_BACKFILL_MAX_ATTEMPTS:-5}
      - MATH_BACKFILL_RETRY_BASE_S=${MATH_BACKFILL_RETRY_BASE_S:-60}
      - MATH_BACKFILL_RETRY_CAP_S=${MATH_BACKFILL_RETRY_CAP_S:-21600}
      - MATH_BACKFILL_REFUSAL_BACKOFF_S=${MATH_BACKFILL_REFUSAL_BACKOFF_S:-1800}
      - MATH_BACKFILL_SUMMARY_EVERY=${MATH_BACKFILL_SUMMARY_EVERY:-25}
      - MATH_BACKFILL_QUERY_TIMEOUT_MS=${MATH_BACKFILL_QUERY_TIMEOUT_MS:-30000}
      # How a source row that claims a later vote than the votes table holds
      # is treated: unresolved (excluded, counted, blocks COMPLETE) until a
      # ruling is encoded as accept_input.
      - MATH_BACKFILL_SOURCE_AHEAD_RULING=${MATH_BACKFILL_SOURCE_AHEAD_RULING:-unresolved}
      - MATH_BACKFILL_STATE_PATH=/app/backfill-state/state.json
      # Readiness/liveness lines (P-072, polismath/poller/readiness.py): one
      # `math_poller readiness/1` line per interval; the CDK log metric filters
      # (cdk/mathPollerAlarms.ts) alarm on a missing holder heartbeat and on
      # stale discovery. Identity for the collector's record: the deploy hook
      # writes the source commit and the EC2 instance id into .env (only a
      # digest of the instance id is logged). Without an instance id the
      # poller refuses to start unless MATH_POLLER_ALLOW_HOSTNAME_IDENTITY=1
      # (local runs only). The alert-test nonce is set only for a recorded
      # alert test, then removed.
      - MATH_POLLER_READINESS_INTERVAL_S=${MATH_POLLER_READINESS_INTERVAL_S:-60}
      - MATH_POLLER_DISCOVERY_STALE_S=${MATH_POLLER_DISCOVERY_STALE_S:-600}
      - MATH_POLLER_READINESS_ALERT_TEST=${MATH_POLLER_READINESS_ALERT_TEST:-}
      - MATH_POLLER_READINESS_ALERT_TEST_SILENCE_S=${MATH_POLLER_READINESS_ALERT_TEST_SILENCE_S:-0}
      - MATH_POLLER_SOURCE_COMMIT=${MATH_POLLER_SOURCE_COMMIT:-}
      - MATH_POLLER_INSTANCE_ID=${MATH_POLLER_INSTANCE_ID:-}
      - MATH_POLLER_ALLOW_HOSTNAME_IDENTITY=${MATH_POLLER_ALLOW_HOSTNAME_IDENTITY:-}
      - MATH_POLLER_IMAGE_DIGEST=${MATH_POLLER_IMAGE_DIGEST:-}
      # Large memory class (P-073, delphi/docs/MATH_POLLER_DESIGN.md §7-§8).
      # Everything here is OFF by default: with MATH_CAPACITY_ROUTING unset the
      # poller computes and publishes exactly as before. A key not listed here
      # never reaches the container (the service has no env_file), so every
      # MATH_CAPACITY_* setting the code reads is forwarded; the forwarding is
      # pinned by tests/test_compose_math_env.py. This service is always the
      # small class: the class is fixed here, not read from the env file (the
      # large class runs only as a queue child on the large box, never as a
      # resident poller).
      - MATH_CAPACITY_CLASS=small
      - MATH_CAPACITY_ROUTING=${MATH_CAPACITY_ROUTING:-0}
      - MATH_CAPACITY_ROUTE_FRACTION=${MATH_CAPACITY_ROUTE_FRACTION:-0.9}
      - MATH_CAPACITY_KEEP_FRACTION=${MATH_CAPACITY_KEEP_FRACTION:-0.7}
      - MATH_CAPACITY_RESIZE_S=${MATH_CAPACITY_RESIZE_S:-3600}
      - MATH_CAPACITY_STATE_PATH=${MATH_CAPACITY_STATE_PATH:-}
      - MATH_CAPACITY_LARGE_BUDGET_MB=${MATH_CAPACITY_LARGE_BUDGET_MB:-}
      - MATH_CAPACITY_PROMOTE=${MATH_CAPACITY_PROMOTE:-0}
      - MATH_CAPACITY_RESTAGE=${MATH_CAPACITY_RESTAGE:-}
      # The staged label, a literal: the label the small poller promotes from
      # is always the one the queue child writes (its MATH_ENV on the large
      # box), and no env document can point the hand-off at a served label.
      - MATH_CAPACITY_STAGED_LABEL=python-large
      # The Postgres job queue (P-073 r2): with routing on, an oversized
      # conversation becomes one math_rebuild job of worker class large,
      # inserted through the queue's SQL functions over this second DSN (a
      # login that is a member of polis_queue_executor; never the broad
      # DATABASE_URL login) in this queue env namespace. Unset: routed
      # conversations are not enqueued (logged at start).
      - MATH_CAPACITY_QUEUE_DSN=${MATH_CAPACITY_QUEUE_DSN:-}
      - MATH_CAPACITY_QUEUE_ENV=${MATH_CAPACITY_QUEUE_ENV:-}
    volumes:
      # Backfill retry/gate/pause/report state across restarts on this host.
      # The database stays the progress record; losing this only re-arms the
      # gate and resets backoff. `docker-compose down` keeps named volumes.
      - math-backfill-state:/app/backfill-state
    networks:
      - "polis-net"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    # Hard memory backstop (mirrors the delphi service). The in-memory conv cache
    # is LRU-bounded by MATH_CONV_CACHE_CAP (finite 200 by default, P-019 M4);
    # this limit is the hard backstop below which the cap should keep the working
    # set. Set MATH_CONV_CACHE_CAP=0 to opt into an unbounded cache (not advised
    # for a long soak).
    deploy:
      resources:
        limits:
          memory: ${DELPHI_POLLER_CONTAINER_MEMORY:-16g}
    restart: unless-stopped
    profiles:
      - math-python

  postgres:
    restart: always
    build:
      context: ./server
      # Dockerfile-db (default): migrations-based initialization
      # Dockerfile-pdb: production dump restoration (requires prodclone.dump)
      dockerfile: Dockerfile-${DB_INIT_MODE:-db}
      additional_contexts:
        queue-rs: ./queue-rs
    labels:
      polis_tag: ${TAG:-dev}
    environment:
      - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_USER=${POSTGRES_USER}
    networks:
      - "polis-net"
    volumes:
      # Use separate volumes for different initialization modes to allow clean switching
      - ${POSTGRES_VOLUME:-postgres_data}:/var/lib/postgresql/data
      # Mount dump file only when using prodclone mode (DB_INIT_MODE=pdb)
      - ./prodclone.dump:/docker-entrypoint-initdb.d/prodclone.dump
    profiles:
      - postgres

  nginx-proxy:
    image: docker.io/compdem/polis-nginx-proxy:${TAG:-dev}
    build:
      context: ./file-server
      dockerfile: nginx.Dockerfile
    labels:
      polis_tag: ${TAG:-dev}
    environment:
      - API_SERVER_PORT=${API_SERVER_PORT:-5000}
      # Comma-separated routes polis-api serves instead of Node (today only
      # "pca2"). Unset: every request goes to Node, as before. Set it only
      # with the polis-api service running (`--profile rust-api`).
      - RUST_API_ROUTES=${RUST_API_ROUTES:-}
      - RUST_API_UPSTREAM=${RUST_API_UPSTREAM:-polis-api:5100}
    depends_on:
      - "client-participation-alpha"
      - "server"
    networks:
      - "polis-net"
    ports:
      - ${HTTP_PORT:-80}:80
      - ${HTTPS_PORT:-443}:443

  # Rust process serving GET /api/v3/math/pca2 (queue-rs/polis-api/README.md).
  # Off unless started with `--profile rust-api`; nginx-proxy sends it traffic
  # only when RUST_API_ROUTES names the route. It reads the server's env file
  # so MATH_ENV, DEV_MODE, NODE_ENV and the domain settings match Node's.
  polis-api:
    profiles: [rust-api]
    image: polis/polis-api:local
    build:
      context: ./queue-rs
      dockerfile: polis-api/Dockerfile
      args:
        # NODE_ENV reaches this process exactly as it reaches `server`: the
        # image default (production, as the server's prod target), then the
        # shared env file.
        NODE_ENV: production
    env_file:
      - ${SERVER_ENV_FILE:-.env}
    environment:
      # Empty: READ_ONLY_DATABASE_URL, else DATABASE_URL, from the env file,
      # which is how Node picks the database for this route.
      - POLIS_API_DATABASE_URL=${POLIS_API_DATABASE_URL:-}
      # The dev Postgres container has no TLS; anywhere else use tls with
      # POLIS_API_DB_CA_FILE and POLIS_API_DB_HOST_ALLOWLIST.
      - POLIS_API_DB_TRANSPORT=${POLIS_API_DB_TRANSPORT:-docker-internal}
      - POLIS_API_DB_PLAIN_HOSTS=${POLIS_API_DB_PLAIN_HOSTS:-postgres}
      - POLIS_API_LISTEN=0.0.0.0:5100
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    networks:
      - "polis-net"
    restart: unless-stopped

  file-server:
    image: docker.io/compdem/polis-file-server:${TAG:-dev}
    build:
      context: ./
      dockerfile: file-server/Dockerfile
      args:
        ADMIN_UIDS: ${ADMIN_UIDS}
        AUTH_AUDIENCE: ${AUTH_AUDIENCE}
        AUTH_CLIENT_ID: ${AUTH_CLIENT_ID}
        AUTH_ISSUER: ${AUTH_ISSUER}
        AUTH_NAMESPACE: ${AUTH_NAMESPACE}
        DD_APPLICATION_ID: ${DD_APPLICATION_ID}
        DD_CLIENT_TOKEN: ${DD_CLIENT_TOKEN}
        DD_SITE: ${DD_SITE}
        EMBED_SERVICE_HOSTNAME: ${EMBED_SERVICE_HOSTNAME}
        GA_TRACKING_ID: ${GA_TRACKING_ID}
        GIT_HASH: "${GIT_HASH:-placeholder}"
        NODE_ENV: production
        OIDC_CACHE_KEY_ID_TOKEN_SUFFIX: ${OIDC_CACHE_KEY_ID_TOKEN_SUFFIX}
        OIDC_CACHE_KEY_PREFIX: ${OIDC_CACHE_KEY_PREFIX}
    labels:
      polis_tag: ${TAG:-dev}
    environment:
      - PORT=${STATIC_FILES_PORT:-8080}
    networks:
      - "polis-net"

  dynamodb:
    image: amazon/dynamodb-local:latest
    container_name: polis-dynamodb-local
    ports:
      - "8000:8000"
    networks:
      - "polis-net"
    # Persistent storage instead of in-memory
    command: "-jar DynamoDBLocal.jar -sharedDb -dbPath /home/dynamodblocal/data"
    volumes:
      - dynamodb-data:/home/dynamodblocal/data
    environment:
      - JAVA_OPTS=-Xmx1G
    user: root
    labels:
      polis_tag: ${TAG:-dev}
    profiles:
      - local-services
  
  ses-local:
    image: dasprid/aws-ses-v2-local:latest
    container_name: polis-ses-local
    ports:
      - "8005:8005"
    networks:
      - "polis-net"
    environment:
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-ses-local-key}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-ses-local-secret}
      - AWS_REGION=${AWS_REGION:-us-east-1}
      - AWS_SES_V2_LOCAL_DISABLE_AUTH=true
    labels:
      polis_tag: ${TAG:-dev}
    profiles:
      - local-services

  # Ollama for LLM processing
  ollama:
    image: ollama/ollama:latest
    container_name: ollama
    ports:
      - "11434:11434"
    volumes:
      - ollama-models:/root/.ollama
    networks:
      - "polis-net"
    # Run ollama server
    command: serve
    restart: unless-stopped
    
  import-worker:
    build:
      context: ./server
      dockerfile: Dockerfile
      target: dev
    image: polis-server:dev
    container_name: polis-import-worker
    command: npx ts-node src/workers/start-import-worker.ts
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - NODE_ENV=development
      - AWS_REGION=us-east-1
      - AWS_ACCESS_KEY_ID=minioadmin
      - AWS_SECRET_ACCESS_KEY=minioadmin
      - SQS_QUEUE_URL=http://localstack:4566/000000000000/import-jobs-queue
      - AWS_S3_ENDPOINT=http://minio:9000
      - AWS_S3_BUCKET_NAME=${AWS_S3_BUCKET_NAME:-polis-delphi}
      - SERVER_LOG_LEVEL=info
    restart: on-failure:5
    networks:
      - "polis-net"
    depends_on:
      - localstack
      - minio
    volumes:
      - ./server:/app
      - /app/node_modules
    profiles:
      - local-services

  # SQS
  localstack:
    image: localstack/localstack
    ports:
      - "4566:4566"
    environment:
      - SERVICES=sqs
      - DOCKER_HOST=unix:///var/run/docker.sock
    volumes:
      - "./bin/localstack-init:/etc/localstack/init/ready.d" 
    networks:
      - "polis-net" 
    profiles:
      - local-services

  # MinIO S3-compatible storage
  minio:
    # MinIO's own quay.io and Docker Hub images refuse anonymous pulls (seen
    # 2026-09-24). This is Bitnami's frozen legacy build of MinIO
    # RELEASE.2025-07-23, pinned by digest; it bundles mc and a shell.
    image: docker.io/bitnamilegacy/minio:2025.7.23-debian-12-r5@sha256:6dabb4a2088c9a79908de3bc05f4586c23ad2182c8908e7e3acbf61c1467fb20
    # Root, as the upstream image ran, so existing minio_data volumes stay
    # writable at /data.
    user: "0:0"
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio_data:/data
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
      # Setup for auto-bucket creation with public read access
      MINIO_BROWSER_REDIRECT_URL: http://localhost:9001
      MINIO_DOMAIN: localhost
      # Allow public policy to be set
      MINIO_BROWSER: "on"
    command: server /data --console-address ":9001"
    networks:
      - "polis-net"
    profiles:
      - local-services

networks:
  polis-net:

volumes:
  delphi-queue-state:

  math-backfill-state:
    labels:
      polis_tag: ${TAG:-dev}
  postgres_data:
    labels:
      polis_tag: ${TAG:-dev}
  prodclone_data:
    labels:
      polis_tag: ${TAG:-dev}
  server-logs:
    labels:
      polis_tag: ${TAG:-dev}
  dynamodb-data:
    labels:
      polis_tag: ${TAG:-dev}
  ollama-models:
    labels:
      polis_tag: ${TAG:-dev}
  minio_data:
    labels:
      polis_tag: ${TAG:-dev}