Refactor code structure for improved readability and maintainability; optimize performance in key functions.

2025-12-22 19:06:31 +02:00
parent dfaa2079aa
commit 4602ccc3a3
1444 changed files with 109919 additions and 8058 deletions
--- a/deploy/compose/docker-compose.airgap.yaml
+++ b/deploy/compose/docker-compose.airgap.yaml
@@ -8,8 +8,7 @@ networks:
    driver: bridge

 volumes:
-  mongo-data:
-  minio-data:
+  valkey-data:
  rustfs-data:
  concelier-jobs:
  nats-data:
@@ -20,19 +19,6 @@ volumes:
  advisory-ai-outputs:

 services:
-  mongo:
-    image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
-    command: ["mongod", "--bind_ip_all"]
-    restart: unless-stopped
-    environment:
-      MONGO_INITDB_ROOT_USERNAME: "${MONGO_INITDB_ROOT_USERNAME}"
-      MONGO_INITDB_ROOT_PASSWORD: "${MONGO_INITDB_ROOT_PASSWORD}"
-    volumes:
-      - mongo-data:/data/db
-    networks:
-      - stellaops
-    labels: *release-labels
-
  postgres:
    image: docker.io/library/postgres:17
    restart: unless-stopped
@@ -61,17 +47,14 @@ services:
      - stellaops
    labels: *release-labels

-  minio:
-    image: docker.io/minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
-    command: ["server", "/data", "--console-address", ":9001"]
+  valkey:
+    image: docker.io/valkey/valkey:8.0
    restart: unless-stopped
-    environment:
-      MINIO_ROOT_USER: "${MINIO_ROOT_USER}"
-      MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD}"
+    command: ["valkey-server", "--appendonly", "yes"]
    volumes:
-      - minio-data:/data
+      - valkey-data:/data
    ports:
-      - "${MINIO_CONSOLE_PORT:-29001}:9001"
+      - "${VALKEY_PORT:-26379}:6379"
    networks:
      - stellaops
    labels: *release-labels
@@ -110,10 +93,13 @@ services:
    image: registry.stella-ops.org/stellaops/authority@sha256:5551a3269b7008cd5aceecf45df018c67459ed519557ccbe48b093b926a39bcc
    restart: unless-stopped
    depends_on:
-      - mongo
+      - postgres
+      - valkey
    environment:
      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
-      STELLAOPS_AUTHORITY__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
    volumes:
@@ -129,11 +115,13 @@ services:
    image: registry.stella-ops.org/stellaops/signer@sha256:ddbbd664a42846cea6b40fca6465bc679b30f72851158f300d01a8571c5478fc
    restart: unless-stopped
    depends_on:
+      - postgres
      - authority
    environment:
      SIGNER__AUTHORITY__BASEURL: "https://authority:8440"
      SIGNER__POE__INTROSPECTURL: "${SIGNER_POE_INTROSPECT_URL}"
-      SIGNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      SIGNER__STORAGE__DRIVER: "postgres"
+      SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    ports:
      - "${SIGNER_PORT:-8441}:8441"
    networks:
@@ -145,9 +133,11 @@ services:
    restart: unless-stopped
    depends_on:
      - signer
+      - postgres
    environment:
      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
-      ATTESTOR__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      ATTESTOR__STORAGE__DRIVER: "postgres"
+      ATTESTOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    ports:
      - "${ATTESTOR_PORT:-8442}:8442"
    networks:
@@ -158,13 +148,14 @@ services:
    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
    restart: unless-stopped
    depends_on:
-      - mongo
+      - postgres
      - authority
    environment:
      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
-      ISSUERDIRECTORY__MONGO__CONNECTIONSTRING: "${ISSUER_DIRECTORY_MONGO_CONNECTION_STRING}"
+      ISSUERDIRECTORY__STORAGE__DRIVER: "postgres"
+      ISSUERDIRECTORY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
    volumes:
      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
@@ -178,13 +169,12 @@ services:
    image: registry.stella-ops.org/stellaops/concelier@sha256:29e2e1a0972707e092cbd3d370701341f9fec2aa9316fb5d8100480f2a1c76b5
    restart: unless-stopped
    depends_on:
-      - mongo
-      - minio
+      - postgres
+      - valkey
    environment:
-      CONCELIER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      CONCELIER__STORAGE__S3__ENDPOINT: "http://minio:9000"
-      CONCELIER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
-      CONCELIER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
+      CONCELIER__STORAGE__DRIVER: "postgres"
+      CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      CONCELIER__STORAGE__S3__ENDPOINT: "http://rustfs:8080"
      CONCELIER__AUTHORITY__BASEURL: "https://authority:8440"
      CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
      CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "${AUTHORITY_OFFLINE_CACHE_TOLERANCE:-00:30:00}"
@@ -200,18 +190,21 @@ services:
    image: registry.stella-ops.org/stellaops/scanner-web@sha256:3df8ca21878126758203c1a0444e39fd97f77ddacf04a69685cda9f1e5e94718
    restart: unless-stopped
    depends_on:
+      - postgres
+      - valkey
      - concelier
      - rustfs
-      - nats
    environment:
-      SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
-      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-redis}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-valkey}"
      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
@@ -249,16 +242,19 @@ services:
    image: registry.stella-ops.org/stellaops/scanner-worker@sha256:eea5d6cfe7835950c5ec7a735a651f2f0d727d3e470cf9027a4a402ea89c4fb5
    restart: unless-stopped
    depends_on:
+      - postgres
+      - valkey
      - scanner-web
      - rustfs
-      - nats
    environment:
-      SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
      # Surface.Env configuration (see docs/modules/scanner/design/surface-env.md)
      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
@@ -283,17 +279,17 @@ services:
    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
    restart: unless-stopped
    depends_on:
-      - mongo
-      - nats
+      - postgres
+      - valkey
      - scanner-web
    command:
      - "dotnet"
      - "StellaOps.Scheduler.Worker.Host.dll"
    environment:
-      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Nats}"
-      SCHEDULER__QUEUE__NATS__URL: "${SCHEDULER_QUEUE_NATS_URL:-nats://nats:4222}"
-      SCHEDULER__STORAGE__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCHEDULER__STORAGE__DATABASE: "${SCHEDULER_STORAGE_DATABASE:-stellaops_scheduler}"
+      SCHEDULER__STORAGE__DRIVER: "postgres"
+      SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Valkey}"
+      SCHEDULER__QUEUE__VALKEY__URL: "${SCHEDULER_QUEUE_VALKEY_URL:-valkey:6379}"
      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
    networks:
      - stellaops
@@ -319,10 +315,12 @@ services:
    image: registry.stella-ops.org/stellaops/excititor@sha256:65c0ee13f773efe920d7181512349a09d363ab3f3e177d276136bd2742325a68
    restart: unless-stopped
    depends_on:
+      - postgres
      - concelier
    environment:
      EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445"
-      EXCITITOR__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      EXCITITOR__STORAGE__DRIVER: "postgres"
+      EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    networks:
      - stellaops
    labels: *release-labels
--- a/deploy/compose/docker-compose.dev.yaml
+++ b/deploy/compose/docker-compose.dev.yaml
@@ -8,45 +8,16 @@ networks:
    driver: bridge

 volumes:
-  mongo-data:
-  minio-data:
  rustfs-data:
  concelier-jobs:
  nats-data:
+  valkey-data:
  advisory-ai-queue:
  advisory-ai-plans:
  advisory-ai-outputs:
  postgres-data:

 services:
-  mongo:
-    image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
-    command: ["mongod", "--bind_ip_all"]
-    restart: unless-stopped
-    environment:
-      MONGO_INITDB_ROOT_USERNAME: "${MONGO_INITDB_ROOT_USERNAME}"
-      MONGO_INITDB_ROOT_PASSWORD: "${MONGO_INITDB_ROOT_PASSWORD}"
-    volumes:
-      - mongo-data:/data/db
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  minio:
-    image: docker.io/minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
-    command: ["server", "/data", "--console-address", ":9001"]
-    restart: unless-stopped
-    environment:
-      MINIO_ROOT_USER: "${MINIO_ROOT_USER}"
-      MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD}"
-    volumes:
-      - minio-data:/data
-    ports:
-      - "${MINIO_CONSOLE_PORT:-9001}:9001"
-    networks:
-      - stellaops
-    labels: *release-labels
-
  postgres:
    image: docker.io/library/postgres:16
    restart: unless-stopped
@@ -63,6 +34,18 @@ services:
      - stellaops
    labels: *release-labels

+  valkey:
+    image: docker.io/valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    networks:
+      - stellaops
+    labels: *release-labels
+
  rustfs:
    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
@@ -97,10 +80,11 @@ services:
    image: registry.stella-ops.org/stellaops/authority@sha256:a8e8faec44a579aa5714e58be835f25575710430b1ad2ccd1282a018cd9ffcdd
    restart: unless-stopped
    depends_on:
-      - mongo
+      - postgres
    environment:
      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
-      STELLAOPS_AUTHORITY__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
    volumes:
@@ -117,10 +101,11 @@ services:
    restart: unless-stopped
    depends_on:
      - authority
+      - valkey
    environment:
      SIGNER__AUTHORITY__BASEURL: "https://authority:8440"
      SIGNER__POE__INTROSPECTURL: "${SIGNER_POE_INTROSPECT_URL}"
-      SIGNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      SIGNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
    ports:
      - "${SIGNER_PORT:-8441}:8441"
    networks:
@@ -132,9 +117,10 @@ services:
    restart: unless-stopped
    depends_on:
      - signer
+      - valkey
    environment:
      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
-      ATTESTOR__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      ATTESTOR__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
    ports:
      - "${ATTESTOR_PORT:-8442}:8442"
    networks:
@@ -145,13 +131,14 @@ services:
    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
    restart: unless-stopped
    depends_on:
-      - mongo
+      - postgres
      - authority
    environment:
      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
-      ISSUERDIRECTORY__MONGO__CONNECTIONSTRING: "${ISSUER_DIRECTORY_MONGO_CONNECTION_STRING}"
+      ISSUERDIRECTORY__STORAGE__DRIVER: "postgres"
+      ISSUERDIRECTORY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
    volumes:
      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
@@ -165,13 +152,10 @@ services:
    image: registry.stella-ops.org/stellaops/concelier@sha256:dafef3954eb4b837e2c424dd2d23e1e4d60fa83794840fac9cd3dea1d43bd085
    restart: unless-stopped
    depends_on:
-      - mongo
-      - minio
+      - postgres
    environment:
-      CONCELIER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      CONCELIER__STORAGE__S3__ENDPOINT: "http://minio:9000"
-      CONCELIER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
-      CONCELIER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
+      CONCELIER__STORAGE__DRIVER: "postgres"
+      CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      CONCELIER__AUTHORITY__BASEURL: "https://authority:8440"
    volumes:
      - concelier-jobs:/var/lib/concelier/jobs
@@ -185,34 +169,38 @@ services:
    image: registry.stella-ops.org/stellaops/scanner-web@sha256:e0dfdb087e330585a5953029fb4757f5abdf7610820a085bd61b457dbead9a11
    restart: unless-stopped
    depends_on:
+      - postgres
      - concelier
      - rustfs
      - nats
+      - valkey
    environment:
-      SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__QUEUE__BROKER: "nats://nats:4222"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
-      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-redis}"
-      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
-      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
-      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
-      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
-      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
-      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
-      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
-      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
-      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
-    volumes:
-      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
-      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
-    ports:
-      - "${SCANNER_WEB_PORT:-8444}:8444"
-    networks:
-      - stellaops
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-valkey}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-valkey:6379}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
+      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
+      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
+      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
+      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
+      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
+    volumes:
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+    ports:
+      - "${SCANNER_WEB_PORT:-8444}:8444"
+    networks:
+      - stellaops
    labels: *release-labels

  scanner-worker:
@@ -223,12 +211,13 @@ services:
      - rustfs
      - nats
    environment:
-      SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__QUEUE__BROKER: "nats://nats:4222"
    networks:
      - stellaops
    labels: *release-labels
@@ -237,17 +226,17 @@ services:
    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
    restart: unless-stopped
    depends_on:
-      - mongo
+      - postgres
      - nats
      - scanner-web
    command:
      - "dotnet"
      - "StellaOps.Scheduler.Worker.Host.dll"
    environment:
-      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Nats}"
-      SCHEDULER__QUEUE__NATS__URL: "${SCHEDULER_QUEUE_NATS_URL:-nats://nats:4222}"
-      SCHEDULER__STORAGE__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCHEDULER__STORAGE__DATABASE: "${SCHEDULER_STORAGE_DATABASE:-stellaops_scheduler}"
+      SCHEDULER__QUEUE__KIND: "Nats"
+      SCHEDULER__QUEUE__NATS__URL: "nats://nats:4222"
+      SCHEDULER__STORAGE__DRIVER: "postgres"
+      SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
    networks:
      - stellaops
@@ -259,8 +248,13 @@ services:
    depends_on:
      - postgres
      - authority
+      - valkey
    environment:
      DOTNET_ENVIRONMENT: Development
+      NOTIFY__STORAGE__DRIVER: "postgres"
+      NOTIFY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      NOTIFY__QUEUE__DRIVER: "nats"
+      NOTIFY__QUEUE__NATS__URL: "nats://nats:4222"
    volumes:
      - ../../etc/notify.dev.yaml:/app/etc/notify.yaml:ro
    ports:
@@ -273,10 +267,12 @@ services:
    image: registry.stella-ops.org/stellaops/excititor@sha256:d9bd5cadf1eab427447ce3df7302c30ded837239771cc6433b9befb895054285
    restart: unless-stopped
    depends_on:
+      - postgres
      - concelier
    environment:
      EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445"
-      EXCITITOR__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      EXCITITOR__STORAGE__DRIVER: "postgres"
+      EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    networks:
      - stellaops
    labels: *release-labels
--- a/deploy/compose/docker-compose.prod.yaml
+++ b/deploy/compose/docker-compose.prod.yaml
@@ -10,42 +10,26 @@ networks:
    external: true
    name: ${FRONTDOOR_NETWORK:-stellaops_frontdoor}

-volumes:
-  mongo-data:
-  minio-data:
-  rustfs-data:
-  concelier-jobs:
-  nats-data:
-  advisory-ai-queue:
-  advisory-ai-plans:
-  advisory-ai-outputs:
-  postgres-data:
+volumes:
+  valkey-data:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  scanner-surface-cache:
+  postgres-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:

-services:
-  mongo:
-    image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
-    command: ["mongod", "--bind_ip_all"]
+services:
+  valkey:
+    image: docker.io/valkey/valkey:8.0
    restart: unless-stopped
-    environment:
-      MONGO_INITDB_ROOT_USERNAME: "${MONGO_INITDB_ROOT_USERNAME}"
-      MONGO_INITDB_ROOT_PASSWORD: "${MONGO_INITDB_ROOT_PASSWORD}"
+    command: ["valkey-server", "--appendonly", "yes"]
    volumes:
-      - mongo-data:/data/db
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  minio:
-    image: docker.io/minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
-    command: ["server", "/data", "--console-address", ":9001"]
-    restart: unless-stopped
-    environment:
-      MINIO_ROOT_USER: "${MINIO_ROOT_USER}"
-      MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD}"
-    volumes:
-      - minio-data:/data
+      - valkey-data:/data
    ports:
-      - "${MINIO_CONSOLE_PORT:-9001}:9001"
+      - "${VALKEY_PORT:-6379}:6379"
    networks:
      - stellaops
    labels: *release-labels
@@ -84,10 +68,13 @@ services:
    image: registry.stella-ops.org/stellaops/authority@sha256:b0348bad1d0b401cc3c71cb40ba034c8043b6c8874546f90d4783c9dbfcc0bf5
    restart: unless-stopped
    depends_on:
-      - mongo
+      - postgres
+      - valkey
    environment:
      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
-      STELLAOPS_AUTHORITY__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
    volumes:
@@ -104,11 +91,13 @@ services:
    image: registry.stella-ops.org/stellaops/signer@sha256:8ad574e61f3a9e9bda8a58eb2700ae46813284e35a150b1137bc7c2b92ac0f2e
    restart: unless-stopped
    depends_on:
+      - postgres
      - authority
    environment:
      SIGNER__AUTHORITY__BASEURL: "https://authority:8440"
      SIGNER__POE__INTROSPECTURL: "${SIGNER_POE_INTROSPECT_URL}"
-      SIGNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      SIGNER__STORAGE__DRIVER: "postgres"
+      SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    ports:
      - "${SIGNER_PORT:-8441}:8441"
    networks:
@@ -116,69 +105,73 @@ services:
      - frontdoor
    labels: *release-labels

-  attestor:
-    image: registry.stella-ops.org/stellaops/attestor@sha256:0534985f978b0b5d220d73c96fddd962cd9135f616811cbe3bff4666c5af568f
-    restart: unless-stopped
-    depends_on:
-      - signer
-    environment:
-      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
-      ATTESTOR__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-    ports:
-      - "${ATTESTOR_PORT:-8442}:8442"
-    networks:
-      - stellaops
-      - frontdoor
-    labels: *release-labels
-
-  postgres:
-    image: docker.io/library/postgres:16
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
-      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
-      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
-      PGDATA: /var/lib/postgresql/data/pgdata
-    volumes:
-      - postgres-data:/var/lib/postgresql/data
-    ports:
-      - "${POSTGRES_PORT:-5432}:5432"
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  issuer-directory:
-    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
-    restart: unless-stopped
-    depends_on:
-      - mongo
-      - authority
-    environment:
-      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
-      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
-      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
-      ISSUERDIRECTORY__MONGO__CONNECTIONSTRING: "${ISSUER_DIRECTORY_MONGO_CONNECTION_STRING}"
-      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
-    volumes:
-      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
-    ports:
-      - "${ISSUER_DIRECTORY_PORT:-8447}:8080"
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  concelier:
-    image: registry.stella-ops.org/stellaops/concelier@sha256:c58cdcaee1d266d68d498e41110a589dd204b487d37381096bd61ab345a867c5
-    restart: unless-stopped
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor@sha256:0534985f978b0b5d220d73c96fddd962cd9135f616811cbe3bff4666c5af568f
+    restart: unless-stopped
    depends_on:
-      - mongo
-      - minio
+      - signer
+      - postgres
    environment:
-      CONCELIER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      CONCELIER__STORAGE__S3__ENDPOINT: "http://minio:9000"
-      CONCELIER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
-      CONCELIER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
+      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
+      ATTESTOR__STORAGE__DRIVER: "postgres"
+      ATTESTOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
+
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  issuer-directory:
+    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
+      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
+      ISSUERDIRECTORY__STORAGE__DRIVER: "postgres"
+      ISSUERDIRECTORY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
+    volumes:
+      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
+    ports:
+      - "${ISSUER_DIRECTORY_PORT:-8447}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier@sha256:c58cdcaee1d266d68d498e41110a589dd204b487d37381096bd61ab345a867c5
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+    environment:
+      CONCELIER__STORAGE__DRIVER: "postgres"
+      CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      CONCELIER__STORAGE__S3__ENDPOINT: "http://rustfs:8080"
      CONCELIER__AUTHORITY__BASEURL: "https://authority:8440"
+      CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
+      CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "${AUTHORITY_OFFLINE_CACHE_TOLERANCE:-00:30:00}"
    volumes:
      - concelier-jobs:/var/lib/concelier/jobs
    ports:
@@ -192,81 +185,116 @@ services:
    image: registry.stella-ops.org/stellaops/scanner-web@sha256:14b23448c3f9586a9156370b3e8c1991b61907efa666ca37dd3aaed1e79fe3b7
    restart: unless-stopped
    depends_on:
+      - postgres
+      - valkey
      - concelier
      - rustfs
-      - nats
    environment:
-      SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
-      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-true}"
-      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-redis}"
-      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
-      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
-      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
-      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
-      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
-      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
-      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
-      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
-      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
-    volumes:
-      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
-      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
-    ports:
-      - "${SCANNER_WEB_PORT:-8444}:8444"
-    networks:
-      - stellaops
-      - frontdoor
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-valkey}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
+      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
+      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
+      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
+      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
+      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+    ports:
+      - "${SCANNER_WEB_PORT:-8444}:8444"
+    networks:
+      - stellaops
+      - frontdoor
    labels: *release-labels

-  scanner-worker:
-    image: registry.stella-ops.org/stellaops/scanner-worker@sha256:32e25e76386eb9ea8bee0a1ad546775db9a2df989fab61ac877e351881960dab
-    restart: unless-stopped
-    depends_on:
-      - scanner-web
-      - rustfs
-      - nats
-    environment:
-      SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
-      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
-      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
-      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  scheduler-worker:
-    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
-    restart: unless-stopped
-    depends_on:
-      - mongo
-      - nats
-      - scanner-web
-    command:
-      - "dotnet"
-      - "StellaOps.Scheduler.Worker.Host.dll"
-    environment:
-      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Nats}"
-      SCHEDULER__QUEUE__NATS__URL: "${SCHEDULER_QUEUE_NATS_URL:-nats://nats:4222}"
-      SCHEDULER__STORAGE__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCHEDULER__STORAGE__DATABASE: "${SCHEDULER_STORAGE_DATABASE:-stellaops_scheduler}"
-      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
-    networks:
-      - stellaops
-    labels: *release-labels
+  scanner-worker:
+    image: registry.stella-ops.org/stellaops/scanner-worker@sha256:32e25e76386eb9ea8bee0a1ad546775db9a2df989fab61ac877e351881960dab
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+      - rustfs
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+    networks:
+      - stellaops
+    labels: *release-labels

-  notify-web:
-    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
-    restart: unless-stopped
-    depends_on:
-      - postgres
-      - authority
+  scheduler-worker:
+    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+    command:
+      - "dotnet"
+      - "StellaOps.Scheduler.Worker.Host.dll"
+    environment:
+      SCHEDULER__STORAGE__DRIVER: "postgres"
+      SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Valkey}"
+      SCHEDULER__QUEUE__VALKEY__URL: "${SCHEDULER_QUEUE_VALKEY_URL:-valkey:6379}"
+      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
    environment:
      DOTNET_ENVIRONMENT: Production
    volumes:
@@ -278,64 +306,66 @@ services:
      - frontdoor
    labels: *release-labels

-  excititor:
-    image: registry.stella-ops.org/stellaops/excititor@sha256:59022e2016aebcef5c856d163ae705755d3f81949d41195256e935ef40a627fa
-    restart: unless-stopped
-    depends_on:
-      - concelier
-    environment:
-      EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445"
-      EXCITITOR__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  advisory-ai-web:
-    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2
-    restart: unless-stopped
-    depends_on:
-      - scanner-web
-    environment:
-      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
-      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
-      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
-      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
-      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
-      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
-      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
-    ports:
-      - "${ADVISORY_AI_WEB_PORT:-8448}:8448"
-    volumes:
-      - advisory-ai-queue:/var/lib/advisory-ai/queue
-      - advisory-ai-plans:/var/lib/advisory-ai/plans
-      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
-    networks:
-      - stellaops
-      - frontdoor
-    labels: *release-labels
-
-  advisory-ai-worker:
-    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2
-    restart: unless-stopped
-    depends_on:
-      - advisory-ai-web
-    environment:
-      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
-      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
-      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
-      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
-      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
-      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
-      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
-    volumes:
-      - advisory-ai-queue:/var/lib/advisory-ai/queue
-      - advisory-ai-plans:/var/lib/advisory-ai/plans
-      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  web-ui:
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor@sha256:59022e2016aebcef5c856d163ae705755d3f81949d41195256e935ef40a627fa
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - concelier
+    environment:
+      EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445"
+      EXCITITOR__STORAGE__DRIVER: "postgres"
+      EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    ports:
+      - "${ADVISORY_AI_WEB_PORT:-8448}:8448"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
+
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2
+    restart: unless-stopped
+    depends_on:
+      - advisory-ai-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  web-ui:
    image: registry.stella-ops.org/stellaops/web-ui@sha256:10d924808c48e4353e3a241da62eb7aefe727a1d6dc830eb23a8e181013b3a23
    restart: unless-stopped
    depends_on:
--- a/deploy/compose/docker-compose.stage.yaml
+++ b/deploy/compose/docker-compose.stage.yaml
@@ -7,76 +7,60 @@ networks:
  stellaops:
    driver: bridge

-volumes:
-  mongo-data:
-  minio-data:
-  rustfs-data:
-  concelier-jobs:
-  nats-data:
-  advisory-ai-queue:
-  advisory-ai-plans:
-  advisory-ai-outputs:
-  postgres-data:
+volumes:
+  valkey-data:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  scanner-surface-cache:
+  postgres-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:

-services:
-  mongo:
-    image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
-    command: ["mongod", "--bind_ip_all"]
+services:
+  valkey:
+    image: docker.io/valkey/valkey:8.0
    restart: unless-stopped
-    environment:
-      MONGO_INITDB_ROOT_USERNAME: "${MONGO_INITDB_ROOT_USERNAME}"
-      MONGO_INITDB_ROOT_PASSWORD: "${MONGO_INITDB_ROOT_PASSWORD}"
+    command: ["valkey-server", "--appendonly", "yes"]
    volumes:
-      - mongo-data:/data/db
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
    networks:
      - stellaops
    labels: *release-labels

-  minio:
-    image: docker.io/minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
-    command: ["server", "/data", "--console-address", ":9001"]
+  postgres:
+    image: docker.io/library/postgres:16
    restart: unless-stopped
    environment:
-      MINIO_ROOT_USER: "${MINIO_ROOT_USER}"
-      MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD}"
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
-      - minio-data:/data
+      - postgres-data:/var/lib/postgresql/data
    ports:
-      - "${MINIO_CONSOLE_PORT:-9001}:9001"
+      - "${POSTGRES_PORT:-5432}:5432"
    networks:
      - stellaops
-    labels: *release-labels
-
-  postgres:
-    image: docker.io/library/postgres:16
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
-      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
-      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
-      PGDATA: /var/lib/postgresql/data/pgdata
-    volumes:
-      - postgres-data:/var/lib/postgresql/data
-    ports:
-      - "${POSTGRES_PORT:-5432}:5432"
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  rustfs:
-    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
-    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
-    restart: unless-stopped
-    environment:
-      RUSTFS__LOG__LEVEL: info
-      RUSTFS__STORAGE__PATH: /data
-    volumes:
-      - rustfs-data:/data
-    ports:
-      - "${RUSTFS_HTTP_PORT:-8080}:8080"
-    networks:
-      - stellaops
-    labels: *release-labels
+    labels: *release-labels
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_HTTP_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels

  nats:
    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
@@ -97,10 +81,13 @@ services:
    image: registry.stella-ops.org/stellaops/authority@sha256:b0348bad1d0b401cc3c71cb40ba034c8043b6c8874546f90d4783c9dbfcc0bf5
    restart: unless-stopped
    depends_on:
-      - mongo
+      - postgres
+      - valkey
    environment:
      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
-      STELLAOPS_AUTHORITY__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
    volumes:
@@ -116,63 +103,69 @@ services:
    image: registry.stella-ops.org/stellaops/signer@sha256:8ad574e61f3a9e9bda8a58eb2700ae46813284e35a150b1137bc7c2b92ac0f2e
    restart: unless-stopped
    depends_on:
+      - postgres
      - authority
    environment:
      SIGNER__AUTHORITY__BASEURL: "https://authority:8440"
      SIGNER__POE__INTROSPECTURL: "${SIGNER_POE_INTROSPECT_URL}"
-      SIGNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      SIGNER__STORAGE__DRIVER: "postgres"
+      SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    ports:
      - "${SIGNER_PORT:-8441}:8441"
    networks:
      - stellaops
    labels: *release-labels

-  attestor:
-    image: registry.stella-ops.org/stellaops/attestor@sha256:0534985f978b0b5d220d73c96fddd962cd9135f616811cbe3bff4666c5af568f
-    restart: unless-stopped
-   depends_on:
-     - signer
-    environment:
-      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
-      ATTESTOR__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-    ports:
-      - "${ATTESTOR_PORT:-8442}:8442"
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  issuer-directory:
-    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
-    restart: unless-stopped
-    depends_on:
-      - mongo
-      - authority
-    environment:
-      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
-      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
-      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
-      ISSUERDIRECTORY__MONGO__CONNECTIONSTRING: "${ISSUER_DIRECTORY_MONGO_CONNECTION_STRING}"
-      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
-    volumes:
-      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
-    ports:
-      - "${ISSUER_DIRECTORY_PORT:-8447}:8080"
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  concelier:
-    image: registry.stella-ops.org/stellaops/concelier@sha256:c58cdcaee1d266d68d498e41110a589dd204b487d37381096bd61ab345a867c5
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor@sha256:0534985f978b0b5d220d73c96fddd962cd9135f616811cbe3bff4666c5af568f
    restart: unless-stopped
    depends_on:
-      - mongo
-      - minio
+      - signer
+      - postgres
    environment:
-      CONCELIER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      CONCELIER__STORAGE__S3__ENDPOINT: "http://minio:9000"
-      CONCELIER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
-      CONCELIER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
+      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
+      ATTESTOR__STORAGE__DRIVER: "postgres"
+      ATTESTOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  issuer-directory:
+    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
+      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
+      ISSUERDIRECTORY__STORAGE__DRIVER: "postgres"
+      ISSUERDIRECTORY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
+    volumes:
+      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
+    ports:
+      - "${ISSUER_DIRECTORY_PORT:-8447}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier@sha256:c58cdcaee1d266d68d498e41110a589dd204b487d37381096bd61ab345a867c5
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+    environment:
+      CONCELIER__STORAGE__DRIVER: "postgres"
+      CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      CONCELIER__STORAGE__S3__ENDPOINT: "http://rustfs:8080"
      CONCELIER__AUTHORITY__BASEURL: "https://authority:8440"
+      CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
+      CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "${AUTHORITY_OFFLINE_CACHE_TOLERANCE:-00:30:00}"
    volumes:
      - concelier-jobs:/var/lib/concelier/jobs
    ports:
@@ -181,84 +174,119 @@ services:
      - stellaops
    labels: *release-labels

-  scanner-web:
+  scanner-web:
    image: registry.stella-ops.org/stellaops/scanner-web@sha256:14b23448c3f9586a9156370b3e8c1991b61907efa666ca37dd3aaed1e79fe3b7
    restart: unless-stopped
-    depends_on:
-      - concelier
-      - rustfs
-      - nats
-    environment:
-      SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
-      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
-      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
-      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
-      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
-      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-redis}"
-      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
-      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
-      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
-      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
-      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
-      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
-      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
-      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
-      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
-    volumes:
-      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
-      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
-    ports:
-      - "${SCANNER_WEB_PORT:-8444}:8444"
-    networks:
-      - stellaops
+    depends_on:
+      - postgres
+      - valkey
+      - concelier
+      - rustfs
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-valkey}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
+      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
+      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
+      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
+      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
+      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+    ports:
+      - "${SCANNER_WEB_PORT:-8444}:8444"
+    networks:
+      - stellaops
    labels: *release-labels

-  scanner-worker:
-    image: registry.stella-ops.org/stellaops/scanner-worker@sha256:32e25e76386eb9ea8bee0a1ad546775db9a2df989fab61ac877e351881960dab
-    restart: unless-stopped
-    depends_on:
-      - scanner-web
-      - rustfs
-      - nats
-    environment:
-      SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
-      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
-      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
-      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  scheduler-worker:
-    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
-    restart: unless-stopped
-    depends_on:
-      - mongo
-      - nats
-      - scanner-web
-    command:
-      - "dotnet"
-      - "StellaOps.Scheduler.Worker.Host.dll"
-    environment:
-      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Nats}"
-      SCHEDULER__QUEUE__NATS__URL: "${SCHEDULER_QUEUE_NATS_URL:-nats://nats:4222}"
-      SCHEDULER__STORAGE__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCHEDULER__STORAGE__DATABASE: "${SCHEDULER_STORAGE_DATABASE:-stellaops_scheduler}"
-      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
-    networks:
-      - stellaops
-    labels: *release-labels
+  scanner-worker:
+    image: registry.stella-ops.org/stellaops/scanner-worker@sha256:32e25e76386eb9ea8bee0a1ad546775db9a2df989fab61ac877e351881960dab
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+      - rustfs
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+    networks:
+      - stellaops
+    labels: *release-labels

-  notify-web:
-    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
-    restart: unless-stopped
-    depends_on:
-      - postgres
-      - authority
+  scheduler-worker:
+    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+    command:
+      - "dotnet"
+      - "StellaOps.Scheduler.Worker.Host.dll"
+    environment:
+      SCHEDULER__STORAGE__DRIVER: "postgres"
+      SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Valkey}"
+      SCHEDULER__QUEUE__VALKEY__URL: "${SCHEDULER_QUEUE_VALKEY_URL:-valkey:6379}"
+      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
    environment:
      DOTNET_ENVIRONMENT: Production
    volumes:
@@ -269,63 +297,65 @@ services:
      - stellaops
    labels: *release-labels

-  excititor:
-    image: registry.stella-ops.org/stellaops/excititor@sha256:59022e2016aebcef5c856d163ae705755d3f81949d41195256e935ef40a627fa
-    restart: unless-stopped
-    depends_on:
-      - concelier
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor@sha256:59022e2016aebcef5c856d163ae705755d3f81949d41195256e935ef40a627fa
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - concelier
    environment:
      EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445"
-      EXCITITOR__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
+      EXCITITOR__STORAGE__DRIVER: "postgres"
+      EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    networks:
      - stellaops
-    labels: *release-labels
-
-  advisory-ai-web:
-    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2
-    restart: unless-stopped
-    depends_on:
-      - scanner-web
-    environment:
-      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
-      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
-      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
-      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
-      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
-      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
-      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
-    ports:
-      - "${ADVISORY_AI_WEB_PORT:-8448}:8448"
-    volumes:
-      - advisory-ai-queue:/var/lib/advisory-ai/queue
-      - advisory-ai-plans:/var/lib/advisory-ai/plans
-      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  advisory-ai-worker:
-    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2
-    restart: unless-stopped
-    depends_on:
-      - advisory-ai-web
-    environment:
-      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
-      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
-      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
-      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
-      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
-      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
-      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
-    volumes:
-      - advisory-ai-queue:/var/lib/advisory-ai/queue
-      - advisory-ai-plans:/var/lib/advisory-ai/plans
-      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
-    networks:
-      - stellaops
-    labels: *release-labels
-
-  web-ui:
+    labels: *release-labels
+
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    ports:
+      - "${ADVISORY_AI_WEB_PORT:-8448}:8448"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2
+    restart: unless-stopped
+    depends_on:
+      - advisory-ai-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  web-ui:
    image: registry.stella-ops.org/stellaops/web-ui@sha256:10d924808c48e4353e3a241da62eb7aefe727a1d6dc830eb23a8e181013b3a23
    restart: unless-stopped
    depends_on:
--- a/deploy/compose/env/dev.env.example
+++ b/deploy/compose/env/dev.env.example
@@ -1,47 +1,78 @@
-# Substitutions for docker-compose.dev.yaml
-MONGO_INITDB_ROOT_USERNAME=stellaops
-MONGO_INITDB_ROOT_PASSWORD=dev-password
-MINIO_ROOT_USER=stellaops
-MINIO_ROOT_PASSWORD=dev-minio-secret
-MINIO_CONSOLE_PORT=9001
+# Substitutions for docker-compose.dev.yaml
+
+# PostgreSQL Database
+POSTGRES_USER=stellaops
+POSTGRES_PASSWORD=dev-postgres-password
+POSTGRES_DB=stellaops_platform
+POSTGRES_PORT=5432
+
+# Valkey (Redis-compatible cache and messaging)
+VALKEY_PORT=6379
+
+# RustFS Object Storage
 RUSTFS_HTTP_PORT=8080
+
+# Authority (OAuth2/OIDC)
 AUTHORITY_ISSUER=https://authority.localtest.me
-AUTHORITY_PORT=8440
-SIGNER_POE_INTROSPECT_URL=https://licensing.svc.local/introspect
+AUTHORITY_PORT=8440
+
+# Signer
+SIGNER_POE_INTROSPECT_URL=https://licensing.svc.local/introspect
 SIGNER_PORT=8441
+
+# Attestor
 ATTESTOR_PORT=8442
-# Secrets for Issuer Directory are provided via issuer-directory.mongo.env (see etc/secrets/issuer-directory.mongo.secret.example).
+
+# Issuer Directory
 ISSUER_DIRECTORY_PORT=8447
-ISSUER_DIRECTORY_MONGO_CONNECTION_STRING=mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017
 ISSUER_DIRECTORY_SEED_CSAF=true
+
+# Concelier
 CONCELIER_PORT=8445
+
+# Scanner
 SCANNER_WEB_PORT=8444
-UI_PORT=8443
-NATS_CLIENT_PORT=4222
 SCANNER_QUEUE_BROKER=nats://nats:4222
 SCANNER_EVENTS_ENABLED=false
-SCANNER_EVENTS_DRIVER=redis
-# Leave SCANNER_EVENTS_DSN empty to inherit the Redis queue DSN when SCANNER_QUEUE_BROKER uses redis://.
-SCANNER_EVENTS_DSN=
+SCANNER_EVENTS_DRIVER=valkey
+SCANNER_EVENTS_DSN=valkey:6379
 SCANNER_EVENTS_STREAM=stella.events
 SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
 SCANNER_EVENTS_MAX_STREAM_LENGTH=10000
-# Surface.Env defaults keep worker/web service aligned with local RustFS and inline secrets.
+
+# Surface.Env defaults keep worker/web service aligned with local RustFS and inline secrets
 SCANNER_SURFACE_FS_ENDPOINT=http://rustfs:8080/api/v1
 SCANNER_SURFACE_CACHE_ROOT=/var/lib/stellaops/surface
 SCANNER_SURFACE_SECRETS_PROVIDER=inline
 SCANNER_SURFACE_SECRETS_ROOT=
+
 # Zastava inherits Scanner defaults; override if Observer/Webhook diverge
 ZASTAVA_SURFACE_FS_ENDPOINT=${SCANNER_SURFACE_FS_ENDPOINT}
 ZASTAVA_SURFACE_CACHE_ROOT=${SCANNER_SURFACE_CACHE_ROOT}
 ZASTAVA_SURFACE_SECRETS_PROVIDER=${SCANNER_SURFACE_SECRETS_PROVIDER}
 ZASTAVA_SURFACE_SECRETS_ROOT=${SCANNER_SURFACE_SECRETS_ROOT}
+
+# Scheduler
 SCHEDULER_QUEUE_KIND=Nats
 SCHEDULER_QUEUE_NATS_URL=nats://nats:4222
-SCHEDULER_STORAGE_DATABASE=stellaops_scheduler
 SCHEDULER_SCANNER_BASEADDRESS=http://scanner-web:8444
+
+# Notify
+NOTIFY_WEB_PORT=8446
+
+# Advisory AI
 ADVISORY_AI_WEB_PORT=8448
 ADVISORY_AI_SBOM_BASEADDRESS=http://scanner-web:8444
 ADVISORY_AI_INFERENCE_MODE=Local
 ADVISORY_AI_REMOTE_BASEADDRESS=
 ADVISORY_AI_REMOTE_APIKEY=
+
+# Web UI
+UI_PORT=8443
+
+# NATS
+NATS_CLIENT_PORT=4222
+
+# CryptoPro (optional)
+CRYPTOPRO_PORT=18080
+CRYPTOPRO_ACCEPT_EULA=0