docker-compose.lite.yml

# SPDX-License-Identifier: Apache-2.0
# Copyright 2025-2026 The Phantex Authors
#
# Phantex — Lite Mode (~2 GB RAM)
#
# Minimal deployment for quick evaluation on resource-constrained machines.
# Runs the full event pipeline (sensors → gateway → Kafka → rules → alerts →
# dashboard) without analytics (ClickHouse), investigation graphs (Neo4j),
# or ML-based detection (4 ML workers). Rule-based detection still works.
#
# Usage:
#   docker compose -f docker-compose.lite.yml up -d
#   ./quickstart.sh --lite
#
# Services (9):
#   postgres, kafka, redis, kafka-init,
#   phantex-backend, phantex-gateway, phantex-storage-writer,
#   phantex-rule-engine, phantex-trust-engine, phantex-dashboard
#
# What's disabled vs full mode:
#   - ClickHouse (event analytics / OCSF queries)
#   - Neo4j (investigation graph visualization)
#   - 4 ML workers (behavioral baseline, inference, features, content analysis)
#   - Kafka UI (dev tool)
#
# To upgrade to full mode later:
#   docker compose -f docker-compose.dev.yml up -d

services:
  # ── PostgreSQL ────────────────────────────────────────────────────────────
  postgres:
    image: postgres:16-alpine
    container_name: phantex-postgres
    restart: unless-stopped
    networks:
      - backend
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-phantex}
      POSTGRES_USER: ${POSTGRES_USER:-phantex_admin}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-phantex-dev-password}
      POSTGRES_INITDB_ARGS: "--data-checksums"
    ports:
      - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
    volumes:
      - phantex-pg-data:/var/lib/postgresql/data
      - ./backend/migrations:/docker-entrypoint-initdb.d:ro
    command:
      - "postgres"
      - "-c"
      - "shared_preload_libraries=pg_stat_statements"
      - "-c"
      - "log_statement=ddl"
      - "-c"
      - "log_min_duration_statement=500"
      - "-c"
      - "max_connections=50"
      - "-c"
      - "shared_buffers=64MB"
    deploy:
      resources:
        limits:
          memory: 256m
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-phantex_admin} -d ${POSTGRES_DB:-phantex}"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 10s

  # ── Kafka (KRaft — no Zookeeper) ──────────────────────────────────────────
  kafka:
    image: apache/kafka:3.7.0
    container_name: phantex-kafka
    hostname: kafka
    restart: unless-stopped
    networks:
      - messaging
    ports:
      - "127.0.0.1:${KAFKA_PORT:-9092}:29092"
      - "127.0.0.1:9093:9093"
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_LISTENERS: INTERNAL://0.0.0.0:9092,HOST://0.0.0.0:29092,CONTROLLER://0.0.0.0:9093
      KAFKA_ADVERTISED_LISTENERS: INTERNAL://kafka:9092,HOST://localhost:9092
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: INTERNAL:PLAINTEXT,HOST:PLAINTEXT,CONTROLLER:PLAINTEXT
      KAFKA_INTER_BROKER_LISTENER_NAME: INTERNAL
      KAFKA_CLUSTER_ID: phantex-dev-cluster-001
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_LOG_RETENTION_HOURS: 168
      KAFKA_NUM_PARTITIONS: 3
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "false"
      # Lite: reduce heap to save RAM
      KAFKA_HEAP_OPTS: "-Xmx384m -Xms384m"
    volumes:
      - phantex-kafka-data:/var/lib/kafka/data
    deploy:
      resources:
        limits:
          memory: 512m
    healthcheck:
      test: ["CMD-SHELL", "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092 > /dev/null 2>&1"]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s

  # ── Redis ─────────────────────────────────────────────────────────────────
  redis:
    image: redis:7-alpine
    container_name: phantex-redis
    restart: unless-stopped
    networks:
      - backend
    ports:
      - "127.0.0.1:${REDIS_PORT:-6379}:6379"
    volumes:
      - phantex-redis-data:/data
    command: ["redis-server", "--maxmemory", "64mb", "--maxmemory-policy", "allkeys-lru", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD:-phantex-dev-redis-pw}"]
    deploy:
      resources:
        limits:
          memory: 96m
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-phantex-dev-redis-pw}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s

  # ── Kafka Topic Init ──────────────────────────────────────────────────────
  kafka-init:
    image: apache/kafka:3.7.0
    container_name: phantex-kafka-init
    networks:
      - messaging
    depends_on:
      kafka:
        condition: service_healthy
    restart: "no"
    entrypoint: ["/bin/bash", "-c"]
    command:
      - |
        echo "Creating Phantex Kafka topics..."
        /opt/kafka/bin/kafka-topics.sh --bootstrap-server kafka:9092 --create --if-not-exists --topic phantex.events.a0000000-0000-0000-0000-000000000001 --partitions 3 --replication-factor 1
        /opt/kafka/bin/kafka-topics.sh --bootstrap-server kafka:9092 --create --if-not-exists --topic phantex.alerts.a0000000-0000-0000-0000-000000000001 --partitions 3 --replication-factor 1
        echo "Topics created successfully."

  # ── Backend API ───────────────────────────────────────────────────────────
  phantex-backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
      additional_contexts:
        sdk-src: ./sdk/python
    container_name: phantex-backend
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - frontend
      - backend
      - messaging
    ports:
      - "127.0.0.1:${BACKEND_PORT:-8000}:8000"
    volumes:
      - ./backend/app:/app/app:ro
      - ./backend/engine:/app/engine:ro
      - ./backend/ml:/app/ml:ro
      - ./backend/models:/app/models
      - ./backend/tests:/app/tests:ro
      - ./proto:/app/proto:ro
      - ./verification:/app/verification:ro
      - ./rules:/rules:ro
    environment:
      PHANTEX_ENVIRONMENT: development
      PHANTEX_DEBUG: "true"
      PHANTEX_ML_DEV_MODE: "true"
      PHANTEX_DB_HOST: postgres
      PHANTEX_DB_NAME: ${POSTGRES_DB:-phantex}
      PHANTEX_DB_USER: ${POSTGRES_USER:-phantex_admin}
      PHANTEX_DB_PASSWORD: ${POSTGRES_PASSWORD:-phantex-dev-password}
      PHANTEX_DB_ADMIN_USER: ${POSTGRES_USER:-phantex_admin}
      PHANTEX_DB_ADMIN_PASSWORD: ${POSTGRES_PASSWORD:-phantex-dev-password}
      PHANTEX_JWT_SECRET: ${JWT_SECRET:-phantex-dev-jwt-secret-change-in-production}
      PHANTEX_KAFKA_BOOTSTRAP: kafka:9092
      PHANTEX_REDIS_URL: "redis://:${REDIS_PASSWORD:-phantex-dev-redis-pw}@redis:6379/0"
      # Lite: ClickHouse and Neo4j disabled (empty = off)
      PHANTEX_CLICKHOUSE_HOST: ""
      PHANTEX_NEO4J_URI: ""
      PHANTEX_CORS_ORIGINS: '["http://localhost:3000","http://localhost:5173"]'
      TRUST_ENGINE_ADDR: phantex-trust-engine:50052
      COPILOT_PROVIDER: ${COPILOT_PROVIDER:-local}
      COPILOT_LOCAL_URL: ${COPILOT_LOCAL_URL:-http://host.docker.internal:1234/v1}
      COPILOT_LOCAL_MODEL: ${COPILOT_LOCAL_MODEL:-mistral}
      COPILOT_MAX_TOKENS: "4096"
      COPILOT_TEMPERATURE: "0.3"
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      PHANTEX_INTERNAL_TOKEN: ${PHANTEX_INTERNAL_TOKEN:-phantex-dev-internal-token}
    command: ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload", "--reload-dir", "/app/app", "--proxy-headers", "--forwarded-allow-ips", "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16", "--no-server-header"]
    deploy:
      resources:
        limits:
          memory: 384m
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/healthz')"]
      interval: 15s
      timeout: 5s
      start_period: 15s
      retries: 5

  # ── Gateway (gRPC sensor intake) ──────────────────────────────────────────
  phantex-gateway:
    build:
      context: .
      dockerfile: gateway/Dockerfile
    container_name: phantex-gateway
    restart: unless-stopped
    networks:
      - backend
      - messaging
    ports:
      - "127.0.0.1:${GATEWAY_PORT:-50051}:50051"
    volumes:
      - ./gateway/gateway.yaml:/etc/phantex/gateway.yaml:ro
    environment:
      PHANTEX_KAFKA_BOOTSTRAP: kafka:9092
      PHANTEX_LISTEN_ADDR: "0.0.0.0:50051"
      PHANTEX_BACKEND_URL: http://phantex-backend:8000
      PHANTEX_INTERNAL_TOKEN: ${PHANTEX_INTERNAL_TOKEN:-phantex-dev-internal-token}
    deploy:
      resources:
        limits:
          memory: 128m
    depends_on:
      kafka:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "/usr/local/bin/phantex-gateway", "--version"]
      interval: 15s
      timeout: 5s
      start_period: 10s
      retries: 3

  # ── Storage Writer (Kafka → PG only in lite mode) ────────────────────────
  phantex-storage-writer:
    build:
      context: ./backend
      dockerfile: Dockerfile
      additional_contexts:
        sdk-src: ./sdk/python
    container_name: phantex-storage-writer
    restart: unless-stopped
    networks:
      - backend
      - messaging
    entrypoint: ["python", "-m", "app.main_consumer"]
    volumes:
      - ./proto:/app/proto:ro
    environment:
      PHANTEX_ENVIRONMENT: development
      PHANTEX_ML_DEV_MODE: "true"
      PHANTEX_DB_HOST: postgres
      PHANTEX_DB_NAME: ${POSTGRES_DB:-phantex}
      PHANTEX_DB_USER: ${POSTGRES_USER:-phantex_admin}
      PHANTEX_DB_PASSWORD: ${POSTGRES_PASSWORD:-phantex-dev-password}
      PHANTEX_DB_ADMIN_USER: ${POSTGRES_USER:-phantex_admin}
      PHANTEX_DB_ADMIN_PASSWORD: ${POSTGRES_PASSWORD:-phantex-dev-password}
      PHANTEX_KAFKA_BOOTSTRAP: kafka:9092
      # Lite: ClickHouse and Neo4j disabled
      PHANTEX_CLICKHOUSE_HOST: ""
      PHANTEX_NEO4J_URI: ""
      TRUST_ENGINE_ADDR: phantex-trust-engine:50052
    deploy:
      resources:
        limits:
          memory: 256m
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      phantex-trust-engine:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import os; os.path.exists('/proc/1/status') or exit(1)"]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3

  # ── Dashboard ─────────────────────────────────────────────────────────────
  phantex-dashboard:
    build:
      context: ./dashboard
      dockerfile: Dockerfile
    container_name: phantex-dashboard
    restart: unless-stopped
    networks:
      - frontend
    ports:
      - "127.0.0.1:${DASHBOARD_PORT:-3000}:80"
    deploy:
      resources:
        limits:
          memory: 64m
    depends_on:
      phantex-backend:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO /dev/null http://127.0.0.1:80/"]
      interval: 15s
      timeout: 5s
      start_period: 10s
      retries: 3

  # ── Trust Engine (Rust gRPC) ──────────────────────────────────────────────
  phantex-trust-engine:
    build:
      context: .
      dockerfile: trust-engine/Dockerfile
    container_name: phantex-trust-engine
    restart: unless-stopped
    networks:
      - backend
    ports:
      - "127.0.0.1:${TRUST_ENGINE_PORT:-50052}:50052"
    environment:
      TRUST_ENGINE_GRPC_ADDR: "0.0.0.0:50052"
      TRUST_ENGINE_SNAPSHOT__DIR: /data/snapshots
      RUST_LOG: info
    volumes:
      - phantex-trust-snapshots:/data/snapshots
    deploy:
      resources:
        limits:
          memory: 128m
    healthcheck:
      test: ["CMD-SHELL", "echo ok"]
      interval: 15s
      timeout: 5s
      start_period: 15s
      retries: 3

  # ── Rule Engine (PRL evaluation) ──────────────────────────────────────────
  phantex-rule-engine:
    build:
      context: ./backend
      dockerfile: Dockerfile
      additional_contexts:
        sdk-src: ./sdk/python
    container_name: phantex-rule-engine
    restart: unless-stopped
    networks:
      - backend
      - messaging
    entrypoint: ["python", "-m", "engine.rule_engine"]
    environment:
      PHANTEX_ENVIRONMENT: development
      PHANTEX_DB_HOST: postgres
      PHANTEX_DB_NAME: ${POSTGRES_DB:-phantex}
      PHANTEX_DB_USER: ${POSTGRES_USER:-phantex_admin}
      PHANTEX_DB_PASSWORD: ${POSTGRES_PASSWORD:-phantex-dev-password}
      PHANTEX_DB_ADMIN_USER: ${POSTGRES_USER:-phantex_admin}
      PHANTEX_DB_ADMIN_PASSWORD: ${POSTGRES_PASSWORD:-phantex-dev-password}
      PHANTEX_KAFKA_BOOTSTRAP: kafka:9092
      PHANTEX_REDIS_URL: "redis://:${REDIS_PASSWORD:-phantex-dev-redis-pw}@redis:6379/0"
    depends_on:
      postgres:
        condition: service_healthy
      kafka:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - ./proto:/app/proto:ro
      - ./rules:/app/rules:ro
    deploy:
      resources:
        limits:
          memory: 256m
    healthcheck:
      test: ["CMD", "python", "-c", "import os; os.path.exists('/proc/1/status') or exit(1)"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3

# ── Volumes ─────────────────────────────────────────────────────────────────
volumes:
  phantex-pg-data:
    name: phantex-pg-data
  phantex-kafka-data:
    name: phantex-kafka-data
  phantex-redis-data:
    name: phantex-redis-data
  phantex-trust-snapshots:
    name: phantex-trust-snapshots

# ── Networks ────────────────────────────────────────────────────────────────
networks:
  frontend:
    name: phantex-frontend
  backend:
    name: phantex-backend
  messaging:
    name: phantex-messaging