# VaultTrace — docker-compose.yml
# One-command deploy: docker-compose up
#
# FORGESYNAPSE LTD (Company No. 16692140). All Rights Reserved.
# Registered Office: Unit A, 82 James Carter Road, Mildenhall, IP28 7DE, UK.

version: "3.9"

services:

  vaulttrace:
    build:
      context: ..
      dockerfile: docker/Dockerfile
    image: forgesynapse/vaulttrace:0.1.0
    container_name: vaulttrace

    environment:
      # Core configuration
      - VAULTTRACE_LEDGER_PATH=/app/vault/.vaultdb
      - VAULTTRACE_KEYS_DIR=/app/.vaulttrace/keys
      - VAULTTRACE_INSTANCE_ID=${VAULTTRACE_INSTANCE_ID:-vaulttrace-prod-01}
      - VAULTTRACE_ORGANIZATION_ID=${VAULTTRACE_ORGANIZATION_ID:-}
      - VAULTTRACE_OPERATOR_ID=${VAULTTRACE_OPERATOR_ID:-}
      - VAULTTRACE_LOG_LEVEL=${VAULTTRACE_LOG_LEVEL:-INFO}
      - VAULTTRACE_FAIL_OPEN=${VAULTTRACE_FAIL_OPEN:-true}
      - VAULTTRACE_DATA_RESIDENCY=${VAULTTRACE_DATA_RESIDENCY:-eu-west-1}

      # Governance
      - VAULTTRACE_APPROVED_MODELS=${VAULTTRACE_APPROVED_MODELS:-}
      - VAULTTRACE_MAX_TOTAL_TOKENS=${VAULTTRACE_MAX_TOTAL_TOKENS:-0}
      - VAULTTRACE_MIN_RETENTION_DAYS=${VAULTTRACE_MIN_RETENTION_DAYS:-180}

      # LLM Provider API Keys (from .env file)
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - XAI_API_KEY=${XAI_API_KEY:-}
      - GOOGLE_API_KEY=${GOOGLE_API_KEY:-}

      # Compliance report settings
      - VAULTTRACE_ORG_LEGAL_NAME=${VAULTTRACE_ORG_LEGAL_NAME:-}
      - VAULTTRACE_ORG_COMPANY_NUMBER=${VAULTTRACE_ORG_COMPANY_NUMBER:-}
      - VAULTTRACE_ORG_ADDRESS=${VAULTTRACE_ORG_ADDRESS:-}
      - VAULTTRACE_ORG_CONTACT_EMAIL=${VAULTTRACE_ORG_CONTACT_EMAIL:-}
      - VAULTTRACE_SYSTEM_NAME=${VAULTTRACE_SYSTEM_NAME:-AI System}

    volumes:
      # Persist the Vault Ledger and generated reports
      - vaulttrace_vault:/app/vault
      # Persist cryptographic keys
      - vaulttrace_keys:/app/.vaulttrace/keys

    restart: unless-stopped

    # Resource limits — VaultTrace is lightweight
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "1.0"

volumes:
  vaulttrace_vault:
    driver: local
    driver_opts:
      type: none
      device: ${VAULTTRACE_VAULT_PATH:-./vault}
      o: bind

  vaulttrace_keys:
    driver: local
    driver_opts:
      type: none
      device: ${VAULTTRACE_KEYS_PATH:-./.vaulttrace/keys}
      o: bind