story/deploy/server/compose.override.yaml

x-server-backend-environment: &server-backend-environment
  APP_ENV: local
  LOG_LEVEL: info
  DATABASE_URL: postgres://voice:${POSTGRES_PASSWORD}@postgres:5432/voice_platform?sslmode=disable
  REDIS_ADDR: redis:6379
  REDIS_PASSWORD: ${REDIS_PASSWORD}
  REDIS_DB: "0"
  AUTH_ISSUER_URL: ${PUBLIC_ORIGIN}/realms/voice-local
  AUTH_JWKS_URL: http://keycloak:8080/realms/voice-local/protocol/openid-connect/certs
  AUTH_AUDIENCE: voice-platform-web
  OTEL_EXPORTER_OTLP_ENDPOINT: ""
  OBJECT_STORE_ENDPOINT: minio:9000
  OBJECT_STORE_PUBLIC_ENDPOINT: ${PUBLIC_HOST}
  OBJECT_STORE_ACCESS_KEY: ${MINIO_ACCESS_KEY}
  OBJECT_STORE_SECRET_KEY: ${MINIO_SECRET_KEY}
  OBJECT_STORE_EXPORT_BUCKET: private-exports
  OBJECT_STORE_REGION: us-east-1
  OBJECT_STORE_SECURE: "false"
  OBJECT_STORE_PUBLIC_SECURE: "true"
  CURSOR_SIGNING_SECRET: ${CURSOR_SIGNING_SECRET}
  SHARE_TOKEN_SIGNING_SECRET: ${SHARE_TOKEN_SIGNING_SECRET}
  EMBEDDING_PROVIDER: local
  VOICE_PROVIDER: mock

services:
  otel-collector:
    ports: !reset []

  prometheus:
    ports: !reset []

  grafana:
    ports: !reset []

  postgres:
    ports: !reset []
    environment:
      POSTGRES_DB: voice_platform
      POSTGRES_USER: voice
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    restart: unless-stopped

  redis:
    ports: !reset []
    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD}"]
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
    restart: unless-stopped

  minio:
    ports: !reset []
    environment:
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY}
    restart: unless-stopped

  keycloak:
    ports: !reset []
    command: ["start-dev", "--import-realm"]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN_USERNAME}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
      KC_HOSTNAME: ${PUBLIC_ORIGIN}
      KC_HTTP_ENABLED: "true"
      KC_PROXY_HEADERS: xforwarded
      JAVA_OPTS_KC_HEAP: -Xms128m -Xmx384m
    volumes:
      - ./deploy/keycloak:/opt/keycloak/data/import:ro
      - keycloak-data:/opt/keycloak/data
    restart: unless-stopped

  migrate:
    command:
      - -path=/migrations
      - -database=postgres://voice:${POSTGRES_PASSWORD}@postgres:5432/voice_platform?sslmode=disable
      - up

  seed:
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD}
    command:
      - sh
      - -ec
      - |
        sed "s#http://localhost:58180/realms/voice-local#${PUBLIC_ORIGIN}/realms/voice-local#g" /fixtures/local_seed.sql |
          psql -h postgres -U voice -d voice_platform -v ON_ERROR_STOP=1

  api:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      <<: *server-backend-environment
      HTTP_ADDR: 0.0.0.0:8080
      DEVICE_LOCAL_SECRET: ${DEVICE_LOCAL_SECRET}
      RTC_TOKEN_SIGNING_SECRET: ${RTC_TOKEN_SIGNING_SECRET}
      RTC_TOKEN_ISSUER: local
      RTC_APP_ID: local-public-rtc-app
    restart: unless-stopped

  callbacks:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      <<: *server-backend-environment
      HTTP_ADDR: 0.0.0.0:8081
      PROVIDER_CALLBACK_SECRET: ${PROVIDER_CALLBACK_SECRET}
      PLATFORM_HEALTH_CALLBACK_SECRET: ${PLATFORM_HEALTH_CALLBACK_SECRET}
      RATE_LIMIT_RPS: "1000"
      RATE_LIMIT_BURST: "1500"
    restart: unless-stopped

  worker:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      <<: *server-backend-environment
      HTTP_ADDR: 0.0.0.0:8082
      MOCK_PROVIDER_BASE_URL: http://mock-provider:8083
      MOCK_PROVIDER_API_KEY: ${MOCK_PROVIDER_API_KEY}
      ALERT_WEBHOOK_URL: http://mock-alert-receiver:8084/webhooks/alerts
      ALERT_WEBHOOK_SECRET: ${ALERT_WEBHOOK_SECRET}
      CONTENT_GENERATOR: local
      CONTENT_SAFETY_PROVIDER: local
    restart: unless-stopped

  mock-provider:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      HTTP_ADDR: 0.0.0.0:8083
      MOCK_PROVIDER_API_KEY: ${MOCK_PROVIDER_API_KEY}
      MOCK_PROVIDER_CALLBACK_URL: http://callbacks:8081/callbacks/v1/vertc/voice-chat
      PROVIDER_CALLBACK_SECRET: ${PROVIDER_CALLBACK_SECRET}
      MOCK_PROVIDER_START_DELAY: 100ms
      MOCK_PROVIDER_DUPLICATE_CALLBACKS: "2"
    restart: unless-stopped

  mock-alert-receiver:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      HTTP_ADDR: 0.0.0.0:8084
      ALERT_WEBHOOK_SECRET: ${ALERT_WEBHOOK_SECRET}
    restart: unless-stopped

  web:
    image: data-terminal-cloud-web:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      WEB_OIDC_AUTHORITY: ${PUBLIC_ORIGIN}/realms/voice-local
      WEB_OIDC_CLIENT_ID: voice-platform-web
    restart: unless-stopped

  gateway:
    image: nginx:1.30-alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./deploy/server/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
    depends_on:
      - api
      - callbacks
      - keycloak
      - minio
      - web
    restart: unless-stopped

volumes:
  keycloak-data: