docker-compose.full.yml

services:

  frontend:
    build:
      context: .
      dockerfile: Dockerfile.frontend
      args:
        VITE_DEFAULT_VIEW: ${VITE_DEFAULT_VIEW:-hud}
    image: frontend:latest
    container_name: sovereign-frontend
    ports:
      - "${FRONTEND_HOST_PORT:-3000}:80"
    environment:
      - NODE_ENV=production
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - sovereign-network
    restart: always

  frontend-admin:
    build:
      context: .
      dockerfile: Dockerfile.frontend
      args:
        VITE_DEFAULT_VIEW: browser_demo
    image: frontend-admin:latest
    container_name: sovereign-frontend-admin
    ports:
      - "${FRONTEND_ADMIN_HOST_PORT:-3003}:80"
    environment:
      - NODE_ENV=production
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - sovereign-network
    restart: always
  # ========================================================================
  # SOVEREIGN MAPS BACKEND (Flower Aggregator + Flask Metrics)
  # ========================================================================
  
  backend:
    build:
      context: .
      dockerfile: Dockerfile.backend.optimized
    container_name: sovereign-backend
    environment:
      - PYTHONUNBUFFERED=1
      - OMP_NUM_THREADS=1
      - MKL_NUM_THREADS=1
      - FLOWER_SERVER_PORT=8080
      - FLASK_PORT=8000
      - NUM_ROUNDS=${NUM_ROUNDS:-0}
      - MIN_FIT_CLIENTS=${MIN_FIT_CLIENTS:-3}
      - MIN_AVAILABLE_CLIENTS=${MIN_AVAILABLE_CLIENTS:-3}
      - ROUND_TIMEOUT_SECONDS=${ROUND_TIMEOUT_SECONDS:-600}
      - TPM_METRICS_ENDPOINT=${TPM_METRICS_ENDPOINT:-http://tpm-metrics:9091/event/attestation}
      - TOKENOMICS_METRICS_ENDPOINT=${TOKENOMICS_METRICS_ENDPOINT:-http://tokenomics-metrics:9105/event/tokenomics}
      - ALLOW_INSECURE_METRICS_ENDPOINTS=${ALLOW_INSECURE_METRICS_ENDPOINTS:-true}
      - LLM_ADAPTER_POLICY_PATH=${LLM_ADAPTER_POLICY_PATH:-/app/config/llm_adapter_policy.json}
      - JOIN_API_ADMIN_TOKEN=${JOIN_API_ADMIN_TOKEN:-local-dev-admin-token}
      - JOIN_INVITES_PATH=${JOIN_INVITES_PATH:-/app/data/join_invites.json}
      - JOIN_REGISTRATIONS_PATH=${JOIN_REGISTRATIONS_PATH:-/app/data/join_registrations.json}
      - CERT_DIR=${CERT_DIR:-/app/data/certs}
      - PUBLIC_AGGREGATOR_HOST=${PUBLIC_AGGREGATOR_HOST:-localhost}
      - PUBLIC_AGGREGATOR_PORT=${PUBLIC_AGGREGATOR_PORT:-8080}
      - OPS_PRIVACY_EPSILON_TARGET=${OPS_PRIVACY_EPSILON_TARGET:-1.0}
      - GEMINI_API_KEY=${GEMINI_API_KEY:-}
      - SECURITY_ENFORCE_HTTPS=${SECURITY_ENFORCE_HTTPS:-true}
      - SECURITY_ALLOW_LOCAL_HTTP=${SECURITY_ALLOW_LOCAL_HTTP:-true}
      - ALLOW_INSECURE_DEV_ADMIN_TOKEN=${ALLOW_INSECURE_DEV_ADMIN_TOKEN:-false}
    ports:
      - "${BACKEND_API_HOST_PORT:-8000}:8000"  # Flask metrics API
      - "${BACKEND_GRPC_HOST_PORT:-8080}:8080"  # Flower aggregator
    volumes:
      - ./sovereignmap_production_backend_v2.py:/app/sovereignmap_production_backend_v2.py:ro
      - ./tpm_cert_manager.py:/app/tpm_cert_manager.py:ro
      - ./src:/app/src:ro
      - ./config:/app/config:ro
      - backend_data:/app/data
    networks:
      - sovereign-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: on-failure
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    labels:
      - "description=Sovereign Maps Backend with Flower aggregator"

  # ========================================================================
  # FEDERATED LEARNING NODES (Flower Clients)
  # ========================================================================
  
  node-agent:
    build:
      context: .
      dockerfile: Dockerfile.node-agent
    environment:
      - PYTHONUNBUFFERED=1
      - OMP_NUM_THREADS=1
      - MKL_NUM_THREADS=1
      - ENABLE_DP=${ENABLE_DP:-false}
      - LOCAL_EPOCHS=${LOCAL_EPOCHS:-1}
      - BATCH_SIZE=${BATCH_SIZE:-16}
      - MAX_SAMPLES_PER_NODE=${MAX_SAMPLES_PER_NODE:-120}
      - AGGREGATOR_HOST=backend
      - AGGREGATOR_PORT=8080
      - BYZANTINE=${BYZANTINE:-false}
      - LLM_ADAPTER_MODEL_FAMILY=${LLM_ADAPTER_MODEL_FAMILY:-llama-3.1}
      - LLM_ADAPTER_MODEL_VERSION=${LLM_ADAPTER_MODEL_VERSION:-8b-instruct}
      - LLM_ADAPTER_TOKENIZER_HASH=${LLM_ADAPTER_TOKENIZER_HASH:-local-dev-tokenizer-v1}
      - LLM_ADAPTER_RANK=${LLM_ADAPTER_RANK:-16}
      - LLM_ADAPTER_TARGET_MODULES=${LLM_ADAPTER_TARGET_MODULES:-q_proj,v_proj}
    command: >
      sh -c 'NODE_ID_VAL=$$(python -c "import os,re; raw=os.getenv(\"NODE_ID\") or os.getenv(\"HOSTNAME\",\"1\"); m=re.search(r\"(\\d+)$\", raw); print(m.group(1) if m else int((\"\".join(c for c in raw if c in \"0123456789abcdefABCDEF\")[:8] or \"1\"), 16) % 1000000)"); python -u src/client.py --node-id "$${NODE_ID_VAL}" --aggregator backend:8080'
    volumes:
      - ./src:/app/src:ro
      - ./requirements.txt:/app/requirements.txt:ro
    working_dir: /app
    networks:
      - sovereign-network
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      disable: true
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    labels:
      - "description=Sovereign Maps Federated Learning Node"

  node-agent-amd-gpu:
    profiles:
      - amd-gpu
    build:
      context: .
      dockerfile: Dockerfile.node-agent
    environment:
      - PYTHONUNBUFFERED=1
      - OMP_NUM_THREADS=1
      - MKL_NUM_THREADS=1
      - ENABLE_DP=${ENABLE_DP:-false}
      - LOCAL_EPOCHS=${LOCAL_EPOCHS:-1}
      - BATCH_SIZE=${BATCH_SIZE:-16}
      - MAX_SAMPLES_PER_NODE=${MAX_SAMPLES_PER_NODE:-120}
      - AGGREGATOR_HOST=backend
      - AGGREGATOR_PORT=8080
      - BYZANTINE=${BYZANTINE:-false}
      - GPU_ENABLED=true
      - NPU_ENABLED=false
      - HIP_VISIBLE_DEVICES=${HIP_VISIBLE_DEVICES:-0}
      - ROCR_VISIBLE_DEVICES=${ROCR_VISIBLE_DEVICES:-0}
      - LLM_ADAPTER_MODEL_FAMILY=${LLM_ADAPTER_MODEL_FAMILY:-llama-3.1}
      - LLM_ADAPTER_MODEL_VERSION=${LLM_ADAPTER_MODEL_VERSION:-8b-instruct}
      - LLM_ADAPTER_TOKENIZER_HASH=${LLM_ADAPTER_TOKENIZER_HASH:-local-dev-tokenizer-v1}
      - LLM_ADAPTER_RANK=${LLM_ADAPTER_RANK:-16}
      - LLM_ADAPTER_TARGET_MODULES=${LLM_ADAPTER_TARGET_MODULES:-q_proj,v_proj}
    command: >
      sh -c 'NODE_ID_VAL=$$(python -c "import os,re; raw=os.getenv(\"NODE_ID\") or os.getenv(\"HOSTNAME\",\"1\"); m=re.search(r\"(\\d+)$\", raw); print(m.group(1) if m else int((\"\".join(c for c in raw if c in \"0123456789abcdefABCDEF\")[:8] or \"1\"), 16) % 1000000)"); python -u src/client.py --node-id "$${NODE_ID_VAL}" --aggregator backend:8080'
    volumes:
      - ./src:/app/src:ro
      - ./requirements.txt:/app/requirements.txt:ro
    working_dir: /app
    devices:
      - /dev/kfd:/dev/kfd
      - /dev/dri:/dev/dri
    group_add:
      - video
      - render
    networks:
      - sovereign-network
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      disable: true
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    labels:
      - "description=Sovereign Maps FL Node (AMD GPU profile)"

  node-agent-npu:
    profiles:
      - npu
    build:
      context: .
      dockerfile: Dockerfile.node-agent
    environment:
      - PYTHONUNBUFFERED=1
      - OMP_NUM_THREADS=1
      - MKL_NUM_THREADS=1
      - ENABLE_DP=${ENABLE_DP:-false}
      - LOCAL_EPOCHS=${LOCAL_EPOCHS:-1}
      - BATCH_SIZE=${BATCH_SIZE:-16}
      - MAX_SAMPLES_PER_NODE=${MAX_SAMPLES_PER_NODE:-120}
      - AGGREGATOR_HOST=backend
      - AGGREGATOR_PORT=8080
      - BYZANTINE=${BYZANTINE:-false}
      - NPU_ENABLED=true
      - GPU_ENABLED=false
      - ASCEND_RT_VISIBLE_DEVICES=${ASCEND_RT_VISIBLE_DEVICES:-0}
      - LLM_ADAPTER_MODEL_FAMILY=${LLM_ADAPTER_MODEL_FAMILY:-llama-3.1}
      - LLM_ADAPTER_MODEL_VERSION=${LLM_ADAPTER_MODEL_VERSION:-8b-instruct}
      - LLM_ADAPTER_TOKENIZER_HASH=${LLM_ADAPTER_TOKENIZER_HASH:-local-dev-tokenizer-v1}
      - LLM_ADAPTER_RANK=${LLM_ADAPTER_RANK:-16}
      - LLM_ADAPTER_TARGET_MODULES=${LLM_ADAPTER_TARGET_MODULES:-q_proj,v_proj}
    command: >
      sh -c 'NODE_ID_VAL=$$(python -c "import os,re; raw=os.getenv(\"NODE_ID\") or os.getenv(\"HOSTNAME\",\"1\"); m=re.search(r\"(\\d+)$\", raw); print(m.group(1) if m else int((\"\".join(c for c in raw if c in \"0123456789abcdefABCDEF\")[:8] or \"1\"), 16) % 1000000)"); python -u src/client.py --node-id "$${NODE_ID_VAL}" --aggregator backend:8080'
    volumes:
      - ./src:/app/src:ro
      - ./requirements.txt:/app/requirements.txt:ro
    working_dir: /app
    devices:
      - /dev/dri:/dev/dri
    networks:
      - sovereign-network
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      disable: true
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    labels:
      - "description=Sovereign Maps FL Node (NPU profile)"

  node-agent-byzantine:
    profiles:
      - byzantine
    build:
      context: .
      dockerfile: Dockerfile.node-agent
    environment:
      - PYTHONUNBUFFERED=1
      - OMP_NUM_THREADS=1
      - MKL_NUM_THREADS=1
      - NODE_ID=${NODE_ID:-1}
      - AGGREGATOR_HOST=backend
      - AGGREGATOR_PORT=8080
      - BYZANTINE=1
      - LLM_ADAPTER_MODEL_FAMILY=${LLM_ADAPTER_MODEL_FAMILY:-llama-3.1}
      - LLM_ADAPTER_MODEL_VERSION=${LLM_ADAPTER_MODEL_VERSION:-8b-instruct}
      - LLM_ADAPTER_TOKENIZER_HASH=${LLM_ADAPTER_TOKENIZER_HASH:-local-dev-tokenizer-v1}
      - LLM_ADAPTER_RANK=${LLM_ADAPTER_RANK:-16}
      - LLM_ADAPTER_TARGET_MODULES=${LLM_ADAPTER_TARGET_MODULES:-q_proj,v_proj}
    command: >
      python -u src/client.py
      --node-id ${NODE_ID:-1}
      --aggregator backend:8080
      --byzantine
    volumes:
      - ./src:/app/src:ro
      - ./requirements.txt:/app/requirements.txt:ro
    working_dir: /app
    networks:
      - sovereign-network
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      disable: true
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    labels:
      - "description=Sovereign Maps Byzantine Federated Learning Node"

  # ========================================================================
  # MONITORING STACK
  # ========================================================================
  
  prometheus:
    image: prom/prometheus:v2.48.0
    container_name: sovereign-prometheus
    ports:
      - "${PROMETHEUS_HOST_PORT:-9090}:9090"
    volumes:
      - prometheus-data:/prometheus
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./tpm_alerts.yml:/etc/prometheus/tpm_alerts.yml:ro
      - ./dashboard_compat_rules.yml:/etc/prometheus/dashboard_compat_rules.yml:ro
      - ./fl_slo_alerts.yml:/etc/prometheus/fl_slo_alerts.yml:ro
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=30d'
    networks:
      - sovereign-network
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:9090/-/healthy"]
      interval: 15s
      timeout: 5s
      retries: 3
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  tpm-metrics:
    image: python:3.11-slim
    container_name: sovereign-tpm-metrics
    volumes:
      - ./tpm_metrics_exporter.py:/app/tpm_metrics_exporter.py:ro
      - ./tpm_cert_manager.py:/app/tpm_cert_manager.py:ro
      - tpm-certs:/etc/sovereign/certs
    working_dir: /app
    command: ["sh", "-c", "python -m pip install --no-cache-dir prometheus-client flask cryptography && python tpm_metrics_exporter.py"]
    ports:
      - "${TPM_METRICS_HOST_PORT:-9091}:9091"
    networks:
      - sovereign-network
    depends_on:
      - backend
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:9091/health', timeout=3)"]
      interval: 15s
      timeout: 5s

  fl-performance:
    image: python:3.11-slim
    container_name: sovereign-fl-performance
    volumes:
      - ./fl_performance_exporter.py:/app/fl_performance_exporter.py:ro
    working_dir: /app
    command: ["sh", "-c", "python -m pip install --no-cache-dir prometheus_client && python fl_performance_exporter.py"]
    ports:
      - "8001:8001"
    networks:
      - sovereign-network

  auto-tuner:
    image: python:3.11-slim
    volumes:
      - ./hardware_auto_tuner.py:/app/hardware_auto_tuner.py:ro
    working_dir: /app
    command: ["python", "hardware_auto_tuner.py"]
    networks:
      - sovereign-network
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  tokenomics-metrics:
    image: python:3.11-slim
    container_name: sovereign-tokenomics-metrics
    volumes:
      - ./tokenomics_metrics_exporter.py:/app/tokenomics_metrics_exporter.py:ro
      - ./test-data/tokenomics-telemetry.seed.json:/app/data/tokenomics-telemetry.seed.json:ro
    working_dir: /app
    command: ["sh", "-c", "python -m pip install --no-cache-dir prometheus-client flask && python tokenomics_metrics_exporter.py"]
    environment:
      - TOKENOMICS_SOURCE_FILE=/app/data/tokenomics-telemetry.seed.json
      - TOKENOMICS_STATE_FILE=/tmp/tokenomics-telemetry-state.json
      - TOKENOMICS_METRICS_PORT=9105
    ports:
      - "${TOKENOMICS_HOST_PORT:-9105}:9105"
    networks:
      - sovereign-network
    depends_on:
      - backend
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:9105/health', timeout=3)"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  grafana:
    image: grafana/grafana:10.2.3
    container_name: sovereign-grafana
    ports:
      - "${GRAFANA_HOST_PORT:-3001}:3000"
    environment:
      - GF_SECURITY_ADMIN_USER=${GRAFANA_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-CHANGE_ME_GRAFANA}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_INSTALL_PLUGINS=grafana-piechart-panel
      - GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH=/etc/grafana/provisioning/dashboards/operations_overview.json
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
      - ./grafana/dashboards:/etc/grafana/dashboards:ro
    networks:
      - sovereign-network
    depends_on:
      - prometheus
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
      interval: 15s
      timeout: 5s
      retries: 3
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  alertmanager:
    image: prom/alertmanager:v0.26.0
    container_name: sovereign-alertmanager
    ports:
      - "${ALERTMANAGER_HOST_PORT:-9093}:9093"
    volumes:
      - alertmanager-data:/alertmanager
      - ./alertmanager.yml:/etc/alertmanager/config.yml:ro
    command:
      - '--config.file=/etc/alertmanager/config.yml'
      - '--storage.path=/alertmanager'
    networks:
      - sovereign-network
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

# ========================================================================
# VOLUMES
# ========================================================================

volumes:
  backend_data:
    driver: local
  prometheus-data:
    driver: local
  grafana-data:
    driver: local
  alertmanager-data:
    driver: local
  tpm-certs:
    driver: local

# ========================================================================
# NETWORKS
# ========================================================================

networks:
  sovereign-network:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.name: br-sovereign