docker-compose.yml

version: "3.8"

services:
  # FastAPI Gateway Service
  gateway:
    build:
      context: ./services/gateway
      dockerfile: Dockerfile
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql+asyncpg://user:password@db:5432/clestiq_shield
      - DD_ENV=development
      - DD_SERVICE=clestiq-shield-gateway
      - DD_VERSION=1.0.0
      - DD_AGENT_HOST=datadog-agent
      - DD_TRACE_AGENT_PORT=8126
      - DD_DOGSTATSD_SOCKET=/var/run/datadog/dsd.socket
      - DD_LOGS_INJECTION=true
      - DD_PROFILING_ENABLED=true
      - DD_RUNTIME_METRICS_ENABLED=true
      - SENTINEL_SERVICE_URL=http://sentinel:8001
      - TELEMETRY_ENABLED=true
    depends_on:
      - db
      - sentinel
      - datadog-agent
      - redis
    volumes:
      - ./services/gateway/app:/app/app
      - dogstatsd-socket:/var/run/datadog
    labels:
      com.datadoghq.tags.service: "clestiq-shield-gateway"
      com.datadoghq.tags.env: "development"
      com.datadoghq.tags.version: "1.0.0"
    networks:
      - clestiq-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # EagleEye - Auth & Management Service
  eagle-eye:
    build:
      context: ./services/eagle-eye
      dockerfile: Dockerfile
    expose:
      - "8003"
    environment:
      - DATABASE_URL=postgresql+asyncpg://user:password@db:5432/clestiq_shield
      - DD_ENV=development
      - DD_SERVICE=clestiq-shield-eagle-eye
      - DD_VERSION=1.0.0
      - DD_AGENT_HOST=datadog-agent
      - DD_TRACE_AGENT_PORT=8126
      - DD_DOGSTATSD_SOCKET=/var/run/datadog/dsd.socket
      - DD_LOGS_INJECTION=true
      - DD_PROFILING_ENABLED=true
      - DD_RUNTIME_METRICS_ENABLED=true
      - TELEMETRY_ENABLED=true
      - SECRET_KEY=change_this_to_a_strong_secret_key
      - ALGORITHM=HS256
    depends_on:
      - db
      - datadog-agent
    volumes:
      - ./services/eagle-eye/app:/app/app
      - dogstatsd-socket:/var/run/datadog
    labels:
      com.datadoghq.tags.service: "clestiq-shield-eagle-eye"
      com.datadoghq.tags.env: "development"
      com.datadoghq.tags.version: "1.0.0"
    networks:
      - clestiq-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8003/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Sentinel - Input Security Agent (now publicly accessible for testing)
  sentinel:
    build:
      context: ./services/security-agent
      dockerfile: Dockerfile
    expose:
      - "8001"
    environment:
      - DD_ENV=development
      - DD_SERVICE=clestiq-shield-sentinel
      - DD_VERSION=1.0.0
      - DD_AGENT_HOST=datadog-agent
      - DD_TRACE_AGENT_PORT=8126
      - DD_DOGSTATSD_SOCKET=/var/run/datadog/dsd.socket
      - DD_LOGS_INJECTION=true
      - DD_PROFILING_ENABLED=true
      - DD_RUNTIME_METRICS_ENABLED=true
      - GEMINI_API_KEY=${GEMINI_API_KEY}
      - TELEMETRY_ENABLED=true
      # Security Settings (defaults to False - opt-in via request)
      - SECURITY_SANITIZATION_ENABLED=false
      - SECURITY_PII_REDACTION_ENABLED=false
      - SECURITY_XSS_PROTECTION_ENABLED=false
      - SECURITY_SQL_INJECTION_DETECTION_ENABLED=false
      - SECURITY_COMMAND_INJECTION_DETECTION_ENABLED=false
      # TOON Conversion (default False - opt-in via request)
      - TOON_CONVERSION_ENABLED=false
      # LLM Settings (default False - opt-in via request)
      - LLM_FORWARD_ENABLED=false
      - LLM_MODEL_NAME=gemini-3-flash-preview
      - LLM_MAX_TOKENS=8192
      # Guardian Service URL
      - GUARDIAN_SERVICE_URL=http://guardian:8002
    depends_on:
      - datadog-agent
      - guardian
    volumes:
      - ./services/security-agent/app:/app/app
      - dogstatsd-socket:/var/run/datadog
    labels:
      com.datadoghq.tags.service: "clestiq-shield-sentinel"
      com.datadoghq.tags.env: "development"
      com.datadoghq.tags.version: "1.0.0"
    networks:
      - clestiq-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Guardian - Output Validation Agent (internal only)
  guardian:
    build:
      context: ./services/guardian
      dockerfile: Dockerfile
    expose:
      - "8002"
    environment:
      - DD_ENV=development
      - DD_SERVICE=clestiq-shield-guardian
      - DD_VERSION=1.0.0
      - DD_AGENT_HOST=datadog-agent
      - DD_TRACE_AGENT_PORT=8126
      - DD_DOGSTATSD_SOCKET=/var/run/datadog/dsd.socket
      - DD_LOGS_INJECTION=true
      - DD_PROFILING_ENABLED=true
      - DD_RUNTIME_METRICS_ENABLED=true
      - GEMINI_API_KEY=${GEMINI_API_KEY}
      - TELEMETRY_ENABLED=true
      # Moderation Settings
      - DEFAULT_MODERATION_MODE=moderate
      - HARMFUL_CONTENT_THRESHOLD=0.7
      - INAPPROPRIATE_CONTENT_THRESHOLD=0.6
      # PII & TOON (defaults to False - opt-in via request)
      - OUTPUT_PII_DETECTION_ENABLED=false
      - AUTO_CONVERT_TOON_TO_JSON=false
    depends_on:
      - datadog-agent
    volumes:
      - ./services/guardian/app:/app/app
      - dogstatsd-socket:/var/run/datadog
    labels:
      com.datadoghq.tags.service: "clestiq-shield-guardian"
      com.datadoghq.tags.env: "development"
      com.datadoghq.tags.version: "1.0.0"
    networks:
      - clestiq-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8002/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # PostgreSQL Database
  db:
    image: postgres:15-alpine
    environment:
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=password
      - POSTGRES_DB=clestiq_shield
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - clestiq-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d clestiq_shield"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Redis - Rate Limiting & Caching
  redis:
    image: redis:7-alpine
    restart: always
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    networks:
      - clestiq-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    labels:
      com.datadoghq.tags.service: "clestiq-shield-redis"
      com.datadoghq.tags.env: "development"
      com.datadoghq.tags.version: "7.0.0"

  # Datadog Agent
  datadog-agent:
    image: gcr.io/datadoghq/agent:latest
    environment:
      - DD_API_KEY=${DD_API_KEY}
      - DD_SITE=${DD_SITE:-datadoghq.com}
      - DD_ENV=development
      - DD_APM_ENABLED=true
      - DD_APM_NON_LOCAL_TRAFFIC=true
      - DD_LOGS_ENABLED=true
      - DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL=true
      - DD_LOGS_CONFIG_AUTO_MULTI_LINE_DETECTION=true
      - DD_CONTAINER_EXCLUDE="name:datadog-agent"
      - DD_PROFILING_ENABLED=true
      - DD_RUNTIME_METRICS_ENABLED=true
      - DD_DOGSTATSD_SOCKET=/var/run/datadog/dsd.socket
      - DD_DOGSTATSD_NON_LOCAL_TRAFFIC=false
      # Universal Service Monitoring
      - DD_SYSTEM_PROBE_ENABLED=true
      - DD_SYSTEM_PROBE_SERVICE_MONITORING_ENABLED=true
      # Profiling intake
      - DD_PROFILING_AGENTLESS=false
      # Service Monitoring
      - DD_SERVICE_MONITORING_ENABLED=true
      - DD_PROCESS_CONFIG_PROCESS_COLLECTION_ENABLED=true
    ports:
      - "8126:8126" # APM traces
      - "8125:8125/udp" # DogStatsD metrics (fallback)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc/:/host/proc/:ro
      - /sys/fs/cgroup/:/host/sys/fs/cgroup:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /opt/datadog-agent/run:/opt/datadog-agent/run:rw
      - dogstatsd-socket:/var/run/datadog
    cap_add:
      - SYS_ADMIN
      - SYS_RESOURCE
      - SYS_PTRACE
      - NET_ADMIN
      - NET_BROADCAST
      - NET_RAW
      - IPC_LOCK
      - CHOWN
    security_opt:
      - apparmor:unconfined
    networks:
      - clestiq-network
    healthcheck:
      test: ["CMD", "agent", "health"]
      interval: 30s
      timeout: 10s
      retries: 3

networks:
  clestiq-network:
    driver: bridge

volumes:
  postgres_data:
  dogstatsd-socket:
  redis_data: