stela ops usage fixes roles propagation and timoeut, one account to support multi tenants, migrations consolidation, search to support documentation, doctor and open api vector db search

2026-02-22 19:27:54 +02:00
parent a29f438f53
commit bd8fee6ed8
373 changed files with 832097 additions and 3369 deletions
--- a/devops/compose/docker-compose.stella-ops.yml
+++ b/devops/compose/docker-compose.stella-ops.yml
@@ -42,6 +42,26 @@ x-plugin-tmpfs: &plugin-tmpfs
  /app/plugins:
    mode: "1777"

+x-router-microservice-defaults: &router-microservice-defaults
+  Router__Region: "local"
+  Router__Gateways__0__Host: "router.stella-ops.local"
+  Router__Gateways__0__Port: "9100"
+  Router__Gateways__0__TransportType: "Messaging"
+  Router__OnMissingAuthorization: "${ROUTER_ON_MISSING_AUTHORIZATION:-WarnAndAllow}"
+  Router__TransportPlugins__Directory: "/app/plugins/router/transports"
+  Router__TransportPlugins__SearchPattern: "StellaOps.Router.Transport.*.dll"
+  Router__Messaging__Transport: "valkey"
+  Router__Messaging__PluginDirectory: "/app/plugins/messaging"
+  Router__Messaging__SearchPattern: "StellaOps.Messaging.Transport.*.dll"
+  Router__Messaging__RequestQueueTemplate: "router:requests:{service}"
+  Router__Messaging__ResponseQueueName: "router:responses"
+  Router__Messaging__RequestTimeout: "30s"
+  Router__Messaging__LeaseDuration: "5m"
+  Router__Messaging__BatchSize: "10"
+  Router__Messaging__HeartbeatInterval: "10s"
+  Router__Messaging__valkey__ConnectionString: "cache.stella-ops.local:6379"
+  Router__Messaging__valkey__Database: "0"
+
 # ---------------------------------------------------------------------------
 # Common anchors for the 60-service stack
 # ---------------------------------------------------------------------------
@@ -151,7 +171,7 @@ services:
        aliases:
          - s3.stella-ops.local
    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8333/"]
+      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:8333/status || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
@@ -177,16 +197,39 @@ services:
  rekor-v2:
    image: ${REKOR_TILES_IMAGE:-ghcr.io/sigstore/rekor-tiles:latest}
    container_name: stellaops-rekor
-    restart: unless-stopped
+    restart: on-failure:5
+    command:
+      - rekor-server
+      - serve
+      - --http-address
+      - 0.0.0.0
+      - --http-port
+      - "3322"
+      - --grpc-address
+      - 0.0.0.0
+      - --grpc-port
+      - "3323"
+      - --signer-filepath
+      - /etc/rekor/signer.pem
+      - --gcp-bucket
+      - ${REKOR_GCP_BUCKET:-stellaops-rekor-dev}
+      - --gcp-spanner
+      - ${REKOR_GCP_SPANNER:-projects/stellaops-dev/instances/rekor/databases/rekor}
    volumes:
      - rekor-tiles-data:/var/lib/rekor-tiles
+      - ../../etc/authority/keys/signing-dev.pem:/etc/rekor/signer.pem:ro
    ports:
      - "127.1.1.4:${REKOR_PORT:-3322}:3322"
    networks:
      stellaops:
        aliases:
          - rekor.stella-ops.local
-    profiles: ["sigstore"]
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3322/api/v1/log"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    profiles: ["sigstore-local"]
    labels:
      <<: *release-labels
      com.stellaops.component: "rekor-v2"
@@ -242,6 +285,20 @@ services:
      Gateway__Auth__Authority__Issuer: "https://authority.stella-ops.local/"
      Gateway__Auth__Authority__RequireHttpsMetadata: "false"
      Gateway__Auth__Authority__MetadataAddress: "https://authority.stella-ops.local/.well-known/openid-configuration"
+      Gateway__Auth__Authority__ClaimsOverridesUrl: "${ROUTER_AUTHORITY_CLAIMS_OVERRIDES_URL:-http://authority.stella-ops.local}"
+      Gateway__Transports__Messaging__Enabled: "${ROUTER_GATEWAY_MESSAGING_ENABLED:-true}"
+      Gateway__Transports__Messaging__transport: "valkey"
+      Gateway__Transports__Messaging__ConnectionString: "cache.stella-ops.local:6379"
+      Gateway__Transports__Messaging__Database: "0"
+      Gateway__Transports__Messaging__valkey__ConnectionString: "cache.stella-ops.local:6379"
+      Gateway__Transports__Messaging__valkey__Database: "0"
+      Gateway__Transports__Messaging__RequestQueueTemplate: "router:requests:{service}"
+      Gateway__Transports__Messaging__ResponseQueueName: "router:responses"
+      Gateway__Transports__Messaging__ConsumerGroup: "router-gateway"
+      Gateway__Transports__Messaging__RequestTimeout: "30s"
+      Gateway__Transports__Messaging__LeaseDuration: "5m"
+      Gateway__Transports__Messaging__BatchSize: "10"
+      Gateway__Transports__Messaging__HeartbeatInterval: "10s"
      # Audience validation disabled until authority includes aud in access tokens
      # Gateway__Auth__Authority__Audiences__0: "stella-ops-api"
      Logging__LogLevel__Microsoft.AspNetCore.Authentication: "Debug"
@@ -250,7 +307,7 @@ services:
    volumes:
      - *cert-volume
      - console-dist:/app/wwwroot:ro
-      - ./router-gateway-local.json:/app/appsettings.local.json:ro
+      - ${ROUTER_GATEWAY_CONFIG:-./router-gateway-local.json}:/app/appsettings.local.json:ro
      - ./envsettings-override.json:/app/envsettings-override.json:ro
      - ./gateway-ca-bundle.crt:/etc/ssl/certs/ca-certificates.crt:ro
    ports:
@@ -274,7 +331,7 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
      Platform__Authority__Issuer: "https://authority.stella-ops.local/"
@@ -329,6 +386,8 @@ services:
      STELLAOPS_SIGNALS_URL: "http://signals.stella-ops.local"
      STELLAOPS_ADVISORYAI_URL: "http://advisoryai.stella-ops.local"
      STELLAOPS_UNKNOWNS_URL: "http://unknowns.stella-ops.local"
+      Router__Enabled: "${PLATFORM_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "platform"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -376,11 +435,15 @@ services:
      STELLAOPS_AUTHORITY_AUTHORITY__PLUGINS__DESCRIPTORS__standard__Type: "standard"
      STELLAOPS_AUTHORITY_AUTHORITY__PLUGINS__DESCRIPTORS__standard__AssemblyName: "StellaOps.Authority.Plugin.Standard"
      STELLAOPS_AUTHORITY_AUTHORITY__PLUGINS__DESCRIPTORS__standard__Enabled: "true"
+      STELLAOPS_AUTHORITY_AUTHORITY__PLUGINS__DESCRIPTORS__standard__TenantId: "demo-prod"
+      STELLAOPS_AUTHORITY_AUTHORITY__PLUGINS__DESCRIPTORS__standard__BootstrapUser__Username: "admin"
+      STELLAOPS_AUTHORITY_AUTHORITY__PLUGINS__DESCRIPTORS__standard__BootstrapUser__Password: "password"
+      <<: *router-microservice-defaults
+      Router__Enabled: "${AUTHORITY_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "authority"
    volumes:
      - ../../etc/authority:/app/etc/authority:ro
      - ../../etc/certificates/trust-roots:/etc/ssl/certs/stellaops:ro
-    tmpfs:
-      - /app/plugins:mode=1777
    ports:
      - "127.1.0.4:80:80"
    networks:
@@ -401,12 +464,14 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:80;http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
      Gateway__Auth__DpopEnabled: "false"
      Gateway__Auth__Authority__Issuer: "https://authority.stella-ops.local/"
      Gateway__Auth__Authority__RequireHttpsMetadata: "false"
+      Router__Enabled: "${GATEWAY_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "gateway"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -432,9 +497,12 @@ services:
      - signer
    environment:
      ASPNETCORE_URLS: "http://+:8442"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ATTESTOR_ATTESTOR__SIGNER__BASEURL: "http://signer.stella-ops.local"
+      ATTESTOR_ATTESTOR__POSTGRES__CONNECTIONSTRING: *postgres-connection
      ConnectionStrings__Default: *postgres-connection
+      Router__Enabled: "${ATTESTOR_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "attestor"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -485,7 +553,7 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      EvidenceLocker__Database__ConnectionString: *postgres-connection
      EvidenceLocker__Database__ApplyMigrationsAtStartup: "true"
      EvidenceLocker__ObjectStore__Kind: "FileSystem"
@@ -506,6 +574,8 @@ services:
      Authority__ResourceServer__BypassNetworks__2: "::1/128"
      Authority__ResourceServer__BypassNetworks__3: "0.0.0.0/0"
      Authority__ResourceServer__BypassNetworks__4: "::/0"
+      Router__Enabled: "${EVIDENCELOCKER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "evidencelocker"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -561,11 +631,11 @@ services:
      valkey:
        condition: service_healthy
      rustfs:
-        condition: service_started
+        condition: service_healthy
    environment:
      ASPNETCORE_URLS: "http://+:8444"
-      <<: *kestrel-cert
-      SCANNER_SCANNER__PLUGINS__BASEDIRECTORY: "/app"
+      <<: [*kestrel-cert, *router-microservice-defaults]
+      SCANNER_SCANNER__PLUGINS__BASEDIRECTORY: "/tmp/stellaops"
      SCANNER_SCANNER__STORAGE__DRIVER: "postgres"
      SCANNER_SCANNER__STORAGE__DSN: *postgres-connection
      SCANNER_SCANNER__STORAGE__COMMANDTIMEOUTSECONDS: "30"
@@ -595,6 +665,8 @@ services:
      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+      Router__Enabled: "${SCANNER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "scanner"
    volumes:
      - ../../etc/scanner:/app/etc/scanner:ro
      - ../../etc/certificates/trust-roots:/etc/ssl/certs/stellaops:ro
@@ -603,7 +675,6 @@ services:
      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
      - *cert-volume
    tmpfs:
-      - /app/plugins:mode=1777
      - /var/lib/stellaops/surface:mode=1777
    ports:
      - "127.1.0.8:80:80"
@@ -627,7 +698,7 @@ services:
      valkey:
        condition: service_healthy
      rustfs:
-        condition: service_started
+        condition: service_healthy
    environment:
      <<: *kestrel-cert
      # Scanner worker options
@@ -672,23 +743,23 @@ services:
      valkey:
        condition: service_healthy
      rustfs:
-        condition: service_started
+        condition: service_healthy
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
-      CONCELIER_PLUGINS__BASEDIRECTORY: "/app"
+      <<: [*kestrel-cert, *router-microservice-defaults]
+      CONCELIER_PLUGINS__BASEDIRECTORY: "/tmp/stellaops"
      CONCELIER_POSTGRESSTORAGE__CONNECTIONSTRING: *postgres-connection
      CONCELIER_POSTGRESSTORAGE__ENABLED: "true"
      CONCELIER_S3__ENDPOINT: "http://s3.stella-ops.local:8333"
      CONCELIER_AUTHORITY__BASEURL: "https://authority.stella-ops.local"
      CONCELIER_AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
      CONCELIER_AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "${AUTHORITY_OFFLINE_CACHE_TOLERANCE:-00:30:00}"
+      Router__Enabled: "${CONCELIER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "concelier"
    volumes:
      - concelier-jobs:/var/lib/concelier/jobs
      - *cert-volume
      - *ca-bundle
-    tmpfs:
-      - /app/plugins:mode=1777
    ports:
      - "127.1.0.9:80:80"
    networks:
@@ -709,7 +780,7 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      # Postgres options (section: Postgres:Excititor)
      Postgres__Excititor__ConnectionString: *postgres-connection
      Postgres__Excititor__SchemaName: "vex"
@@ -720,11 +791,11 @@ services:
      Excititor__Authority__BaseUrls__default: "https://authority.stella-ops.local"
      # IssuerDirectoryClientOptions.Validate() requires BaseAddress
      IssuerDirectory__Client__BaseAddress: "http://issuerdirectory.stella-ops.local"
+      Router__Enabled: "${EXCITITOR_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "excititor"
    volumes:
      - *cert-volume
      - *ca-bundle
-    tmpfs:
-      - /app/plugins:mode=1777
    ports:
      - "127.1.0.10:80:80"
    networks:
@@ -778,11 +849,13 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
      Postgres__ConnectionString: *postgres-connection
      Postgres__SchemaName: "vexhub"
+      Router__Enabled: "${VEXHUB_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "vexhub"
    volumes:
      - *cert-volume
    ports:
@@ -805,9 +878,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${VEXLENS_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "vexlens"
    volumes:
      - *cert-volume
    ports:
@@ -830,9 +905,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${VULNEXPLORER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "vulnexplorer"
    volumes:
      - *cert-volume
    ports:
@@ -855,7 +932,7 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      STELLAOPS_POLICY_ENGINE_Postgres__Policy__ConnectionString: *postgres-connection
      STELLAOPS_POLICY_ENGINE_ConnectionStrings__Redis: "cache.stella-ops.local:6379"
      STELLAOPS_POLICY_ENGINE_PolicyEngine__ResourceServer__Authority: "https://authority.stella-ops.local/"
@@ -877,6 +954,8 @@ services:
      PolicyEngine__ResourceServer__BypassNetworks__2: "::1/128"
      Logging__LogLevel__Microsoft.AspNetCore.Authentication: "Debug"
      Logging__LogLevel__Microsoft.IdentityModel: "Debug"
+      Router__Enabled: "${POLICY_ENGINE_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "policy-engine"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -900,7 +979,7 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8084"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
      Postgres__Policy__ConnectionString: *postgres-connection
@@ -919,6 +998,8 @@ services:
      STELLAOPS_POLICY_GATEWAY_PolicyGateway__ResourceServer__RequiredScopes__0: "policy:read"
      STELLAOPS_POLICY_GATEWAY_PolicyGateway__PolicyEngine__ClientCredentials__Enabled: "false"
      STELLAOPS_POLICY_GATEWAY_Postgres__Policy__ConnectionString: *postgres-connection
+      Router__Enabled: "${POLICY_GATEWAY_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "policy-gateway"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -942,9 +1023,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${RISKENGINE_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "riskengine"
    volumes:
      - *cert-volume
    ports:
@@ -986,9 +1069,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${ORCHESTRATOR_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "orchestrator"
    volumes:
      - *cert-volume
    ports:
@@ -1030,9 +1115,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${TASKRUNNER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "taskrunner"
    volumes:
      - *cert-volume
    ports:
@@ -1082,7 +1169,7 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
      Scheduler__Authority__Enabled: "false"
@@ -1095,10 +1182,11 @@ services:
      Scheduler__Worker__Graph__Cartographer__BaseAddress: "http://cartographer.stella-ops.local"
      Scheduler__Worker__Graph__SchedulerApi__BaseAddress: "http://scheduler.stella-ops.local"
      Scheduler__Worker__Policy__Api__BaseAddress: "http://policy.stella-ops.local"
+      Router__Enabled: "${SCHEDULER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "scheduler"
    volumes:
      - *cert-volume
    tmpfs:
-      - /app/plugins:mode=1777
      - /plugins:mode=1777
    ports:
      - "127.1.0.19:80:80"
@@ -1156,9 +1244,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${GRAPH_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "graph"
    volumes:
      - *cert-volume
    ports:
@@ -1181,9 +1271,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${CARTOGRAPHER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "cartographer"
    volumes:
      - *cert-volume
    ports:
@@ -1206,9 +1298,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${REACHGRAPH_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "reachgraph"
    volumes:
      - *cert-volume
    ports:
@@ -1231,9 +1325,12 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      TIMELINE_Postgres__Timeline__ConnectionString: *postgres-connection
+      Router__Enabled: "${TIMELINE_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "timelineindexer"
    volumes:
      - *cert-volume
    ports:
@@ -1257,6 +1354,7 @@ services:
      <<: *kestrel-cert
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      TIMELINE_Postgres__Timeline__ConnectionString: *postgres-connection
    volumes:
      - *cert-volume
    healthcheck:
@@ -1275,9 +1373,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${TIMELINE_SERVICE_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "timeline"
    volumes:
      - *cert-volume
    ports:
@@ -1300,7 +1400,7 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__FindingsLedger: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
@@ -1318,6 +1418,8 @@ services:
      findings__ledger__Attachments__SignedUrlSecret: "dev-signed-url-secret"
      findings__ledger__Attachments__SignedUrlLifetime: "00:15:00"
      findings__ledger__Attachments__RequireConsoleCsrf: "false"
+      Router__Enabled: "${FINDINGS_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "findings-ledger"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -1341,12 +1443,14 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
      Doctor__Authority__Issuer: "https://authority.stella-ops.local/"
      Doctor__Authority__RequireHttpsMetadata: "false"
      Doctor__Authority__BypassNetworks__0: "172.19.0.0/16"
+      Router__Enabled: "${DOCTOR_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "doctor"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -1368,13 +1472,17 @@ services:
    restart: unless-stopped
    depends_on: *depends-infra
    environment:
-      <<: *kestrel-cert
+      ASPNETCORE_URLS: "http://+:80"
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${DOCTOR_SCHEDULER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "doctor-scheduler"
    volumes:
      - *cert-volume
    healthcheck:
-      <<: *healthcheck-worker
+      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/$(hostname)/80'"]
+      <<: *healthcheck-tcp
    networks:
      stellaops:
        aliases:
@@ -1389,9 +1497,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${OPSMEMORY_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "opsmemory"
    volumes:
      - *cert-volume
    ports:
@@ -1414,9 +1524,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${NOTIFIER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "notifier"
    volumes:
      - *cert-volume
    ports:
@@ -1461,22 +1573,22 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      DOTNET_ENVIRONMENT: Production
      NOTIFY_NOTIFY__STORAGE__DRIVER: "postgres"
      NOTIFY_NOTIFY__STORAGE__CONNECTIONSTRING: *postgres-connection
      NOTIFY_NOTIFY__STORAGE__DATABASE: "notify"
-      NOTIFY_NOTIFY__PLUGINS__BASEDIRECTORY: "/app"
+      NOTIFY_NOTIFY__PLUGINS__BASEDIRECTORY: "/tmp/stellaops"
      NOTIFY_NOTIFY__AUTHORITY__ENABLED: "false"
      NOTIFY_NOTIFY__AUTHORITY__ALLOWANONYMOUSFALLBACK: "true"
      NOTIFY_NOTIFY__AUTHORITY__DEVELOPMENTSIGNINGKEY: "StellaOps-Development-Key-NotifyService-2026!!"
      NOTIFY_Postgres__Notify__ConnectionString: *postgres-connection
      Postgres__Notify__ConnectionString: *postgres-connection
+      Router__Enabled: "${NOTIFY_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "notify"
    volumes:
      - ../../etc/notify:/app/etc/notify:ro
      - *cert-volume
-    tmpfs:
-      - /app/plugins:mode=1777
    ports:
      - "127.1.0.29:80:80"
    networks:
@@ -1499,9 +1611,11 @@ services:
      - valkey
    environment:
      ASPNETCORE_URLS: "http://+:8441"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__KeyManagement: *postgres-connection
      ConnectionStrings__Default: *postgres-connection
+      Router__Enabled: "${SIGNER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "signer"
    volumes:
      - *cert-volume
    ports:
@@ -1524,9 +1638,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${SMREMOTE_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "smremote"
    volumes:
      - *cert-volume
    ports:
@@ -1549,9 +1665,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${AIRGAP_CONTROLLER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "airgap-controller"
    volumes:
      - *cert-volume
    ports:
@@ -1575,8 +1693,10 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
+      Router__Enabled: "${AIRGAP_TIME_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "airgap-time"
    volumes:
      - *cert-volume
    ports:
@@ -1599,9 +1719,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${PACKSREGISTRY_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "packsregistry"
    volumes:
      - *cert-volume
    ports:
@@ -1643,7 +1765,7 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      RegistryTokenService__Signing__Issuer: "http://registry-token.stella-ops.local"
      RegistryTokenService__Signing__KeyPath: "/app/etc/certs/kestrel-dev.pfx"
@@ -1656,6 +1778,8 @@ services:
      RegistryTokenService__Plans__0__Repositories__0__Pattern: "*"
      RegistryTokenService__Plans__0__Repositories__0__Actions__0: "pull"
      RegistryTokenService__Plans__0__Repositories__0__Actions__1: "push"
+      Router__Enabled: "${REGISTRY_TOKEN_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "registry-token"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -1679,9 +1803,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${BINARYINDEX_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "binaryindex"
    volumes:
      - *cert-volume
    ports:
@@ -1706,7 +1832,7 @@ services:
      - authority
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ISSUERDIRECTORY__AUTHORITY__ENABLED: "true"
      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER:-http://authority.stella-ops.local}"
      ISSUERDIRECTORY__AUTHORITY__AUDIENCES__0: "api://issuer-directory"
@@ -1714,6 +1840,8 @@ services:
      ISSUERDIRECTORY__PERSISTENCE__PROVIDER: "Postgres"
      ISSUERDIRECTORY__PERSISTENCE__POSTGRESCONNECTIONSTRING: *postgres-connection
      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "false"
+      Router__Enabled: "${ISSUERDIRECTORY_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "issuerdirectory"
    volumes:
      - ../../etc/issuer-directory:/app/etc/issuer-directory:ro
      - *cert-volume
@@ -1737,12 +1865,14 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
      Authority__ResourceServer__Authority: "https://authority.stella-ops.local/"
      Authority__ResourceServer__RequireHttpsMetadata: "false"
      Authority__ResourceServer__BypassNetworks__0: "172.19.0.0/16"
+      Router__Enabled: "${SYMBOLS_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "symbols"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -1766,9 +1896,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${SBOMSERVICE_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "sbomservice"
    volumes:
      - *cert-volume
    ports:
@@ -1791,7 +1923,7 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
      Export__AllowInMemoryRepositories: "true"
@@ -1804,6 +1936,8 @@ services:
      Authority__ResourceServer__BypassNetworks__2: "::1/128"
      Authority__ResourceServer__BypassNetworks__3: "0.0.0.0/0"
      Authority__ResourceServer__BypassNetworks__4: "::/0"
+      Router__Enabled: "${EXPORTCENTER_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "exportcenter"
    volumes:
      - *cert-volume
      - *ca-bundle
@@ -1853,9 +1987,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${REPLAY_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "replay"
    volumes:
      - *cert-volume
    ports:
@@ -1878,13 +2014,14 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
+      ConnectionStrings__IntegrationsDb: *postgres-connection
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${INTEGRATIONS_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "integrations"
    volumes:
      - *cert-volume
-    tmpfs:
-      - /app/plugins:mode=1777
    ports:
      - "127.1.0.42:80:80"
    networks:
@@ -1947,9 +2084,11 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${SIGNALS_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "signals"
    volumes:
      - *cert-volume
    ports:
@@ -1973,14 +2112,18 @@ services:
      - scanner-web
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner.stella-ops.local}"
      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Adapters__Llm__Enabled: "${ADVISORY_AI_LLM_ADAPTERS_ENABLED:-true}"
+      ADVISORYAI__AdvisoryAI__LlmProviders__ConfigDirectory: "${ADVISORY_AI_LLM_PROVIDERS_DIRECTORY:-/app/etc/llm-providers}"
      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+      Router__Enabled: "${ADVISORYAI_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "advisoryai"
    ports:
      - "127.1.0.44:80:80"
    volumes:
@@ -1989,8 +2132,6 @@ services:
      - advisory-ai-queue:/var/lib/advisory-ai/queue
      - advisory-ai-plans:/var/lib/advisory-ai/plans
      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
-    tmpfs:
-      - /app/plugins:mode=1777
    networks:
      stellaops:
        aliases:
@@ -2034,10 +2175,12 @@ services:
    depends_on: *depends-infra
    environment:
      ASPNETCORE_URLS: "http://+:8080"
-      <<: *kestrel-cert
+      <<: [*kestrel-cert, *router-microservice-defaults]
      ConnectionStrings__Default: *postgres-connection
      ConnectionStrings__UnknownsDb: *postgres-connection
      ConnectionStrings__Redis: "cache.stella-ops.local:6379"
+      Router__Enabled: "${UNKNOWNS_ROUTER_ENABLED:-true}"
+      Router__Messaging__ConsumerGroup: "unknowns"
    volumes:
      - *cert-volume
    ports: