x-release-labels: &release-labels com.stellaops.release.version: "2025.09.2" com.stellaops.release.channel: "stable" com.stellaops.profile: "prod" networks: stellaops: driver: bridge frontdoor: external: true name: ${FRONTDOOR_NETWORK:-stellaops_frontdoor} volumes: valkey-data: rustfs-data: concelier-jobs: nats-data: scanner-surface-cache: postgres-data: advisory-ai-queue: advisory-ai-plans: advisory-ai-outputs: services: valkey: image: docker.io/valkey/valkey:8.0 restart: unless-stopped command: ["valkey-server", "--appendonly", "yes"] volumes: - valkey-data:/data ports: - "${VALKEY_PORT:-6379}:6379" networks: - stellaops labels: *release-labels rustfs: image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"] restart: unless-stopped environment: RUSTFS__LOG__LEVEL: info RUSTFS__STORAGE__PATH: /data volumes: - rustfs-data:/data ports: - "${RUSTFS_HTTP_PORT:-8080}:8080" networks: - stellaops labels: *release-labels nats: image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e command: - "-js" - "-sd" - /data restart: unless-stopped ports: - "${NATS_CLIENT_PORT:-4222}:4222" volumes: - nats-data:/data networks: - stellaops labels: *release-labels authority: image: registry.stella-ops.org/stellaops/authority@sha256:b0348bad1d0b401cc3c71cb40ba034c8043b6c8874546f90d4783c9dbfcc0bf5 restart: unless-stopped depends_on: - postgres - valkey environment: STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}" STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres" STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}" STELLAOPS_AUTHORITY__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379" STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins" STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins" volumes: - ../../etc/authority.yaml:/etc/authority.yaml:ro - ../../etc/authority.plugins:/app/etc/authority.plugins:ro ports: - "${AUTHORITY_PORT:-8440}:8440" networks: - stellaops - frontdoor labels: *release-labels signer: image: registry.stella-ops.org/stellaops/signer@sha256:8ad574e61f3a9e9bda8a58eb2700ae46813284e35a150b1137bc7c2b92ac0f2e restart: unless-stopped depends_on: - postgres - authority environment: SIGNER__AUTHORITY__BASEURL: "https://authority:8440" SIGNER__POE__INTROSPECTURL: "${SIGNER_POE_INTROSPECT_URL}" SIGNER__STORAGE__DRIVER: "postgres" SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}" ports: - "${SIGNER_PORT:-8441}:8441" networks: - stellaops - frontdoor labels: *release-labels attestor: image: registry.stella-ops.org/stellaops/attestor@sha256:0534985f978b0b5d220d73c96fddd962cd9135f616811cbe3bff4666c5af568f restart: unless-stopped depends_on: - signer - postgres environment: ATTESTOR__SIGNER__BASEURL: "https://signer:8441" ATTESTOR__STORAGE__DRIVER: "postgres" ATTESTOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}" ports: - "${ATTESTOR_PORT:-8442}:8442" networks: - stellaops - frontdoor labels: *release-labels postgres: image: docker.io/library/postgres:16 restart: unless-stopped environment: POSTGRES_USER: "${POSTGRES_USER:-stellaops}" POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}" POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}" PGDATA: /var/lib/postgresql/data/pgdata volumes: - postgres-data:/var/lib/postgresql/data ports: - "${POSTGRES_PORT:-5432}:5432" networks: - stellaops labels: *release-labels issuer-directory: image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge restart: unless-stopped depends_on: - postgres - authority environment: ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml" ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}" ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440" ISSUERDIRECTORY__STORAGE__DRIVER: "postgres" ISSUERDIRECTORY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}" ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}" volumes: - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro ports: - "${ISSUER_DIRECTORY_PORT:-8447}:8080" networks: - stellaops labels: *release-labels concelier: image: registry.stella-ops.org/stellaops/concelier@sha256:c58cdcaee1d266d68d498e41110a589dd204b487d37381096bd61ab345a867c5 restart: unless-stopped depends_on: - postgres - valkey environment: CONCELIER__STORAGE__DRIVER: "postgres" CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}" CONCELIER__STORAGE__S3__ENDPOINT: "http://rustfs:8080" CONCELIER__AUTHORITY__BASEURL: "https://authority:8440" CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true" CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "${AUTHORITY_OFFLINE_CACHE_TOLERANCE:-00:30:00}" volumes: - concelier-jobs:/var/lib/concelier/jobs ports: - "${CONCELIER_PORT:-8445}:8445" networks: - stellaops - frontdoor labels: *release-labels scanner-web: image: registry.stella-ops.org/stellaops/scanner-web@sha256:14b23448c3f9586a9156370b3e8c1991b61907efa666ca37dd3aaed1e79fe3b7 restart: unless-stopped depends_on: - postgres - valkey - concelier - rustfs environment: SCANNER__STORAGE__DRIVER: "postgres" SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}" SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379" SCANNER__ARTIFACTSTORE__DRIVER: "rustfs" SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1" SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts" SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30" SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}" SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}" SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-valkey}" SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}" SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}" SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}" SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}" SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}" SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}" SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}" SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}" SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}" SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}" SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}" SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}" SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}" SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}" SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}" SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}" SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}" SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}" SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}" SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}" SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}" volumes: - scanner-surface-cache:/var/lib/stellaops/surface - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro ports: - "${SCANNER_WEB_PORT:-8444}:8444" networks: - stellaops - frontdoor labels: *release-labels scanner-worker: image: registry.stella-ops.org/stellaops/scanner-worker@sha256:32e25e76386eb9ea8bee0a1ad546775db9a2df989fab61ac877e351881960dab restart: unless-stopped depends_on: - postgres - valkey - scanner-web - rustfs environment: SCANNER__STORAGE__DRIVER: "postgres" SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}" SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379" SCANNER__ARTIFACTSTORE__DRIVER: "rustfs" SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1" SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts" SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30" SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}" SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}" SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}" SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}" SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}" SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}" SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}" SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}" SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}" SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}" SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}" SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}" SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}" volumes: - scanner-surface-cache:/var/lib/stellaops/surface - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro networks: - stellaops labels: *release-labels scheduler-worker: image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge restart: unless-stopped depends_on: - postgres - valkey - scanner-web command: - "dotnet" - "StellaOps.Scheduler.Worker.Host.dll" environment: SCHEDULER__STORAGE__DRIVER: "postgres" SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}" SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Valkey}" SCHEDULER__QUEUE__VALKEY__URL: "${SCHEDULER_QUEUE_VALKEY_URL:-valkey:6379}" SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}" networks: - stellaops labels: *release-labels notify-web: image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2} restart: unless-stopped depends_on: - postgres - authority environment: DOTNET_ENVIRONMENT: Production volumes: - ../../etc/notify.prod.yaml:/app/etc/notify.yaml:ro ports: - "${NOTIFY_WEB_PORT:-8446}:8446" networks: - stellaops - frontdoor labels: *release-labels excititor: image: registry.stella-ops.org/stellaops/excititor@sha256:59022e2016aebcef5c856d163ae705755d3f81949d41195256e935ef40a627fa restart: unless-stopped depends_on: - postgres - concelier environment: EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445" EXCITITOR__STORAGE__DRIVER: "postgres" EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}" networks: - stellaops labels: *release-labels advisory-ai-web: image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2 restart: unless-stopped depends_on: - scanner-web environment: ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}" ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue" ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans" ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs" ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}" ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}" ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}" ports: - "${ADVISORY_AI_WEB_PORT:-8448}:8448" volumes: - advisory-ai-queue:/var/lib/advisory-ai/queue - advisory-ai-plans:/var/lib/advisory-ai/plans - advisory-ai-outputs:/var/lib/advisory-ai/outputs networks: - stellaops - frontdoor labels: *release-labels advisory-ai-worker: image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2 restart: unless-stopped depends_on: - advisory-ai-web environment: ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}" ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue" ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans" ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs" ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}" ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}" ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}" volumes: - advisory-ai-queue:/var/lib/advisory-ai/queue - advisory-ai-plans:/var/lib/advisory-ai/plans - advisory-ai-outputs:/var/lib/advisory-ai/outputs networks: - stellaops labels: *release-labels web-ui: image: registry.stella-ops.org/stellaops/web-ui@sha256:10d924808c48e4353e3a241da62eb7aefe727a1d6dc830eb23a8e181013b3a23 restart: unless-stopped depends_on: - scanner-web environment: STELLAOPS_UI__BACKEND__BASEURL: "https://scanner-web:8444" ports: - "${UI_PORT:-8443}:8443" networks: - stellaops - frontdoor labels: *release-labels