docker-compose.dev.yml

services:
  # PostgreSQL must load the vector library so Hub (and Forma) can use the pgvector extension.
  postgres:
    image: pgvector/pgvector:pg18
    volumes:
      - postgres:/var/lib/postgresql
    environment:
      - POSTGRES_DB=postgres
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
    ports:
      - ${POSTGRES_PORT:-5432}:5432
    command: >
      postgres
      -c shared_preload_libraries=vector
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 10s

  authzed-db-bootstrap:
    image: pgvector/pgvector:pg18
    restart: "no"
    entrypoint: ["/bin/sh", "/usr/local/bin/authzed-postgres-bootstrap.sh"]
    environment:
      POSTGRES_ADMIN_URL: postgresql://postgres:postgres@postgres:5432/postgres?sslmode=disable
      AUTHZED_DATABASE_NAME: spicedb
      AUTHZED_DATABASE_USERNAME: spicedb
      AUTHZED_DATABASE_PASSWORD: ${AUTHZED_DATABASE_PASSWORD:?AUTHZED_DATABASE_PASSWORD is required}
    volumes:
      - ./docker/authzed-postgres-bootstrap.sh:/usr/local/bin/authzed-postgres-bootstrap.sh:ro
    depends_on:
      postgres:
        condition: service_healthy

  spicedb-migrate:
    image: ${SPICEDB_IMAGE_REF:-authzed/spicedb:v1.52.0}
    restart: "no"
    command: datastore migrate head
    environment:
      SPICEDB_DATASTORE_ENGINE: postgres
      SPICEDB_DATASTORE_CONN_URI: postgresql://spicedb:${AUTHZED_DATABASE_PASSWORD:?AUTHZED_DATABASE_PASSWORD is required}@postgres:5432/spicedb?sslmode=disable
    depends_on:
      authzed-db-bootstrap:
        condition: service_completed_successfully

  spicedb:
    image: ${SPICEDB_IMAGE_REF:-authzed/spicedb:v1.52.0}
    restart: unless-stopped
    command: serve
    mem_limit: 512m
    environment:
      SPICEDB_DATASTORE_ENGINE: postgres
      SPICEDB_DATASTORE_CONN_URI: postgresql://spicedb:${AUTHZED_DATABASE_PASSWORD:?AUTHZED_DATABASE_PASSWORD is required}@postgres:5432/spicedb?sslmode=disable
      SPICEDB_GRPC_PRESHARED_KEY: ${AUTHZED_TOKEN:?AUTHZED_TOKEN is required}
      SPICEDB_LOG_FORMAT: json
      SPICEDB_LOG_LEVEL: info
      SPICEDB_TELEMETRY_ENDPOINT: ""
    ports:
      - 127.0.0.1:${SPICEDB_GRPC_PORT:-50051}:50051
    depends_on:
      spicedb-migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "/usr/local/bin/grpc_health_probe", "-addr=localhost:50051"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s

  authzed-cli:
    image: ${ZED_IMAGE_REF:-authzed/zed:v1.1.1}
    profiles: ["authzed-tools"]
    entrypoint: ["zed"]
    volumes:
      - ./authzed/schema.zed:/schema.zed:ro

  authzed-ui:
    image: ${GRPCUI_IMAGE_REF:-fullstorydev/grpcui:v1.5.2}
    profiles: ["authzed-ui"]
    command:
      - -plaintext
      - -bind
      - 0.0.0.0
      - -port
      - "8080"
      - -H
      - "authorization: Bearer ${AUTHZED_TOKEN:?AUTHZED_TOKEN is required}"
      - spicedb:50051
    ports:
      - 127.0.0.1:${AUTHZED_GRPCUI_PORT:-50052}:8080
    depends_on:
      spicedb:
        condition: service_healthy

  mailhog:
    image: arjenz/mailhog
    ports:
      - 8025:8025
      - 1025:1025

  valkey:
    image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
    command: "valkey-server --maxmemory-policy noeviction"
    ports:
      - 6379:6379
    volumes:
      - valkey-data:/data

  rustfs-perms:
    image: busybox:1.36.1
    user: "0:0"
    command: ["sh", "-c", "mkdir -p /data && chown -R 10001:10001 /data"]
    volumes:
      - rustfs-data:/data

  rustfs:
    image: rustfs/rustfs:1.0.0-rc.2@sha256:7d6d361c49c08d427250fb59aae5d78df83d644c3405d9ccf4b21cda0b0692d0
    depends_on:
      rustfs-perms:
        condition: service_completed_successfully
    command: /data
    environment:
      - RUSTFS_ACCESS_KEY=devrustfs
      - RUSTFS_SECRET_KEY=devrustfs123
      - RUSTFS_ADDRESS=:9000
      - RUSTFS_CONSOLE_ENABLE=true
      - RUSTFS_CONSOLE_ADDRESS=:9001
    ports:
      - "9000:9000" # S3 API direct access
      - "9001:9001" # Web console
    volumes:
      - rustfs-data:/data

  rustfs-init:
    image: quay.io/minio/mc@sha256:95b5f3f7969a5c5a9f3a700ba72d5c84172819e13385aaf916e237cf111ab868
    depends_on:
      - rustfs
    environment:
      - RUSTFS_ADMIN_USER=devrustfs
      - RUSTFS_ADMIN_PASSWORD=devrustfs123
      - RUSTFS_BUCKET_NAME=forma
      - RUSTFS_POLICY_NAME=forma-policy
      - RUSTFS_SERVICE_USER=devrustfs-service
      - RUSTFS_SERVICE_PASSWORD=devrustfs-service123
      - RUSTFS_CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000,http://localhost:3001,http://127.0.0.1:3001,http://localhost:3002,http://127.0.0.1:3002
    volumes:
      - ./docker/rustfs-init.sh:/usr/local/bin/rustfs-init.sh:ro
    entrypoint:
      - /bin/sh
      - /usr/local/bin/rustfs-init.sh

  vllm:
    image: ${QWEN_VLLM_IMAGE:-vllm/vllm-openai:v0.14.0}
    profiles: ["qwen"]
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]
    command:
      - vllm
      - serve
      - ${QWEN_MODEL_ID:-Qwen/Qwen3-14B-AWQ}
      - --host
      - 0.0.0.0
      - --port
      - "8000"
      - --no-enable-prefix-caching
      - --max-model-len
      - ${QWEN_MAX_MODEL_LEN:-8192}
      - --dtype
      - ${QWEN_DTYPE:-float16}
      - --tensor-parallel-size
      - ${QWEN_TENSOR_PARALLEL_SIZE:-1}
      - --max-num-seqs
      - ${QWEN_MAX_NUM_SEQS:-8}
      - --gpu_memory_utilization
      - ${QWEN_GPU_MEMORY_UTILIZATION:-0.9}
      - --served-model-name
      - ${QWEN_SERVED_MODEL_NAME:-qwen3-14b-awq}
      - --default-chat-template-kwargs
      - '{"enable_thinking": false}'
    environment:
      HF_HOME: /data
    volumes:
      - qwen-model-cache:/data
    ports:
      - "${QWEN_VLLM_HOST:-127.0.0.1}:${QWEN_VLLM_PORT:-8000}:8000"
    healthcheck:
      test:
        [
          "CMD",
          "python3",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=5).read()",
        ]
      interval: 30s
      timeout: 10s
      retries: 40
      start_period: 10m

volumes:
  postgres:
    driver: local
  valkey-data:
    driver: local
  rustfs-data:
    driver: local
  qwen-model-cache:
    driver: local