# Bifrost self-host v1 (#67). Two services — the control-plane API and the portal
# (nginx, proxying /api → api). SQLite by default (single-box, air-gap friendly);
# flip to the bundled Postgres with `--profile postgres` + BIFROST_DB.
#
#   cd deploy && docker compose up --build         # SQLite, air-gap
#   open http://localhost:8080
#
# Secrets/config come from the environment (or a deploy/.env file) — never baked
# into the image.
name: bifrost

services:
  api:
    build:
      context: ..
      dockerfile: deploy/docker/api.Dockerfile
    environment:
      BIFROST_API_ADDR: 0.0.0.0:8080
      # SQLite file on the data volume; set to postgres://… for the server profile.
      BIFROST_DB: ${BIFROST_DB:-sqlite:/data/bifrost.db}
      # Air-gap by default: only in-network (is_local) providers are used — public
      # APIs blocked, a private cloud-LLM endpoint allowed. Runtime-toggleable in
      # the portal (#190) unless BIFROST_AIR_GAP_LOCK=1 forces it on permanently.
      BIFROST_AIR_GAP: ${BIFROST_AIR_GAP:-1}
      BIFROST_AIR_GAP_LOCK: ${BIFROST_AIR_GAP_LOCK:-}
      # LLM cost control (#104), both opt-in. Token budget caps total tokens per
      # conversion job; concurrency caps in-flight calls to frontier providers.
      BIFROST_TOKEN_BUDGET: ${BIFROST_TOKEN_BUDGET:-}
      BIFROST_LLM_MAX_CONCURRENCY: ${BIFROST_LLM_MAX_CONCURRENCY:-}
      # External-call resilience (#106). Retries/backoff default to 3 attempts /
      # 200ms base; override per source (BIFROST_ADO/JENKINS/GITLAB/LLM_RETRY_*).
      # Importer subprocess wall-clock cap (seconds, default 600).
      BIFROST_IMPORTER_TIMEOUT_SECS: ${BIFROST_IMPORTER_TIMEOUT_SECS:-}
      BIFROST_LLM_RETRY_ATTEMPTS: ${BIFROST_LLM_RETRY_ATTEMPTS:-}
      # HMAC signing key for attestation export (#62/#63). Set in production.
      BIFROST_SIGNING_KEY: ${BIFROST_SIGNING_KEY:-}
      BIFROST_SIGNING_KEY_ID: ${BIFROST_SIGNING_KEY_ID:-}
      # Portal SSO (#65): set BIFROST_AUTH=entra to require Entra ID tokens.
      BIFROST_AUTH: ${BIFROST_AUTH:-}
      BIFROST_ENTRA_TENANT_ID: ${BIFROST_ENTRA_TENANT_ID:-}
      BIFROST_ENTRA_AUDIENCE: ${BIFROST_ENTRA_AUDIENCE:-}
      # ADO auth (#20): a service principal (Entra) is used when AZURE_* is set,
      # else the AZDO_PAT. Pass these in via the environment / a .env file.
      AZURE_TENANT_ID: ${AZURE_TENANT_ID:-}
      AZURE_CLIENT_ID: ${AZURE_CLIENT_ID:-}
      AZURE_CLIENT_SECRET: ${AZURE_CLIENT_SECRET:-}
      # Azure OpenAI LLM provider (enterprise Azure): endpoint + deployment +
      # api-key or Entra token. AZURE_OPENAI_PRIVATE=1 marks a private endpoint
      # air-gap-eligible. Activated when AZURE_OPENAI_ENDPOINT is set.
      AZURE_OPENAI_ENDPOINT: ${AZURE_OPENAI_ENDPOINT:-}
      AZURE_OPENAI_DEPLOYMENT: ${AZURE_OPENAI_DEPLOYMENT:-}
      AZURE_OPENAI_API_KEY: ${AZURE_OPENAI_API_KEY:-}
      AZURE_OPENAI_TOKEN: ${AZURE_OPENAI_TOKEN:-}
      AZURE_OPENAI_API_VERSION: ${AZURE_OPENAI_API_VERSION:-}
      AZURE_OPENAI_PRIVATE: ${AZURE_OPENAI_PRIVATE:-}
      # GCP Vertex AI (Gemini on Vertex): project + OAuth token (workload identity
      # / gcloud). VERTEX_PRIVATE=1 marks a PSC/VPC-SC endpoint air-gap-eligible.
      # Activated when VERTEX_PROJECT + VERTEX_TOKEN are set.
      VERTEX_PROJECT: ${VERTEX_PROJECT:-}
      VERTEX_TOKEN: ${VERTEX_TOKEN:-}
      VERTEX_LOCATION: ${VERTEX_LOCATION:-}
      VERTEX_MODEL: ${VERTEX_MODEL:-}
      VERTEX_PRIVATE: ${VERTEX_PRIVATE:-}
      # AWS Bedrock (#188): use a Bedrock OpenAI-compatible gateway via the
      # BIFROST_OPENAI_* vars above (point BIFROST_OPENAI_BASE_URL at the gateway).
      RUST_LOG: ${RUST_LOG:-bifrost_api=info,tower_http=info}
      # Observability (#105): set BIFROST_LOG_JSON=1 for structured JSON logs
      # (for log pipelines). Prometheus metrics are always at GET /metrics.
      BIFROST_LOG_JSON: ${BIFROST_LOG_JSON:-}
    volumes:
      - bifrost-data:/data
    expose:
      - "8080"
    restart: unless-stopped

  portal:
    build:
      context: ..
      dockerfile: deploy/docker/portal.Dockerfile
    depends_on:
      - api
    ports:
      - "${BIFROST_PORTAL_PORT:-8080}:80"
    restart: unless-stopped

  # Server mode: `docker compose --profile postgres up --build` and set
  # BIFROST_DB=postgres://bifrost:bifrost@postgres:5432/bifrost
  postgres:
    image: postgres:17-alpine
    profiles:
      - postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-bifrost}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-bifrost}
      POSTGRES_DB: ${POSTGRES_DB:-bifrost}
    volumes:
      - bifrost-pg:/var/lib/postgresql/data
    expose:
      - "5432"
    restart: unless-stopped

volumes:
  bifrost-data:
  bifrost-pg: