git.stella-ops.org/devops/compose/docker-compose.china.yml

# StellaOps Docker Compose - International Profile
# Cryptography: SM2, SM3, SM4 (ShangMi / Commercial Cipher - temporarily using NIST)
# Provider: offline-verification
# Jurisdiction: china, world

x-release-labels: &release-labels
  com.stellaops.release.version: "2025.10.0-edge"
  com.stellaops.release.channel: "edge"
  com.stellaops.profile: "china"
  com.stellaops.crypto.profile: "china"
  com.stellaops.crypto.provider: "offline-verification"

x-crypto-env: &crypto-env
  # Crypto configuration
  STELLAOPS_CRYPTO_PROFILE: "china"
  STELLAOPS_CRYPTO_CONFIG_PATH: "/app/etc/appsettings.crypto.yaml"
  STELLAOPS_CRYPTO_MANIFEST_PATH: "/app/etc/crypto-plugins-manifest.json"

networks:
  stellaops:
    driver: bridge

volumes:
  rustfs-data:
  concelier-jobs:
  nats-data:
  valkey-data:
  advisory-ai-queue:
  advisory-ai-plans:
  advisory-ai-outputs:
  postgres-data:

services:
  postgres:
    image: docker.io/library/postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ../postgres-partitioning:/docker-entrypoint-initdb.d:ro
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    networks:
      - stellaops
    labels: *release-labels

  valkey:
    image: docker.io/valkey/valkey:8.0
    restart: unless-stopped
    command: ["valkey-server", "--appendonly", "yes"]
    volumes:
      - valkey-data:/data
    ports:
      - "${VALKEY_PORT:-6379}:6379"
    networks:
      - stellaops
    labels: *release-labels

  rustfs:
    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
    restart: unless-stopped
    environment:
      RUSTFS__LOG__LEVEL: info
      RUSTFS__STORAGE__PATH: /data
    volumes:
      - rustfs-data:/data
    ports:
      - "${RUSTFS_HTTP_PORT:-8080}:8080"
    networks:
      - stellaops
    labels: *release-labels

  nats:
    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
    command:
      - "-js"
      - "-sd"
      - /data
    restart: unless-stopped
    ports:
      - "${NATS_CLIENT_PORT:-4222}:4222"
    volumes:
      - nats-data:/data
    networks:
      - stellaops
    labels: *release-labels

  authority:
    image: registry.stella-ops.org/stellaops/authority:china
    restart: unless-stopped
    depends_on:
      - postgres
    environment:
      <<: *crypto-env
      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
    volumes:
      - ../../etc/authority.yaml:/etc/authority.yaml:ro
      - ../../etc/authority.plugins:/app/etc/authority.plugins:ro
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${AUTHORITY_PORT:-8440}:8440"
    networks:
      - stellaops
    labels: *release-labels

  signer:
    image: registry.stella-ops.org/stellaops/signer:china
    restart: unless-stopped
    depends_on:
      - postgres
    environment:
      <<: *crypto-env
      STELLAOPS_SIGNER__STORAGE__DRIVER: "postgres"
      STELLAOPS_SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${SIGNER_PORT:-8441}:8441"
    networks:
      - stellaops
    labels: *release-labels

  attestor:
    image: registry.stella-ops.org/stellaops/attestor:china
    restart: unless-stopped
    depends_on:
      - signer
    environment:
      <<: *crypto-env
      STELLAOPS_ATTESTOR__SIGNER__BASEURL: "http://signer:8441"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${ATTESTOR_PORT:-8442}:8442"
    networks:
      - stellaops
    labels: *release-labels

  concelier:
    image: registry.stella-ops.org/stellaops/concelier:china
    restart: unless-stopped
    depends_on:
      - postgres
      - rustfs
    environment:
      <<: *crypto-env
      STELLAOPS_CONCELIER__STORAGE__DRIVER: "postgres"
      STELLAOPS_CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      STELLAOPS_CONCELIER__STORAGE__RUSTFS__BASEURL: "http://rustfs:8080"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
      - concelier-jobs:/app/jobs
    ports:
      - "${CONCELIER_PORT:-8443}:8443"
    networks:
      - stellaops
    labels: *release-labels

  scanner:
    image: registry.stella-ops.org/stellaops/scanner:china
    restart: unless-stopped
    depends_on:
      - postgres
    environment:
      <<: *crypto-env
      STELLAOPS_SCANNER__STORAGE__DRIVER: "postgres"
      STELLAOPS_SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${SCANNER_PORT:-8444}:8444"
    networks:
      - stellaops
    labels: *release-labels

  excititor:
    image: registry.stella-ops.org/stellaops/excititor:china
    restart: unless-stopped
    depends_on:
      - postgres
    environment:
      <<: *crypto-env
      STELLAOPS_EXCITITOR__STORAGE__DRIVER: "postgres"
      STELLAOPS_EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${EXCITITOR_PORT:-8445}:8445"
    networks:
      - stellaops
    labels: *release-labels

  policy:
    image: registry.stella-ops.org/stellaops/policy:china
    restart: unless-stopped
    depends_on:
      - postgres
    environment:
      <<: *crypto-env
      STELLAOPS_POLICY__STORAGE__DRIVER: "postgres"
      STELLAOPS_POLICY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${POLICY_PORT:-8446}:8446"
    networks:
      - stellaops
    labels: *release-labels

  scheduler:
    image: registry.stella-ops.org/stellaops/scheduler:china
    restart: unless-stopped
    depends_on:
      - postgres
      - nats
    environment:
      <<: *crypto-env
      STELLAOPS_SCHEDULER__STORAGE__DRIVER: "postgres"
      STELLAOPS_SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
      STELLAOPS_SCHEDULER__MESSAGING__NATS__URL: "nats://nats:4222"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${SCHEDULER_PORT:-8447}:8447"
    networks:
      - stellaops
    labels: *release-labels

  notify:
    image: registry.stella-ops.org/stellaops/notify:china
    restart: unless-stopped
    depends_on:
      - postgres
    environment:
      <<: *crypto-env
      STELLAOPS_NOTIFY__STORAGE__DRIVER: "postgres"
      STELLAOPS_NOTIFY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${NOTIFY_PORT:-8448}:8448"
    networks:
      - stellaops
    labels: *release-labels

  zastava:
    image: registry.stella-ops.org/stellaops/zastava:china
    restart: unless-stopped
    depends_on:
      - postgres
    environment:
      <<: *crypto-env
      STELLAOPS_ZASTAVA__STORAGE__DRIVER: "postgres"
      STELLAOPS_ZASTAVA__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${ZASTAVA_PORT:-8449}:8449"
    networks:
      - stellaops
    labels: *release-labels

  gateway:
    image: registry.stella-ops.org/stellaops/gateway:china
    restart: unless-stopped
    depends_on:
      - authority
      - concelier
      - scanner
    environment:
      <<: *crypto-env
      STELLAOPS_GATEWAY__AUTHORITY__BASEURL: "http://authority:8440"
      STELLAOPS_GATEWAY__CONCELIER__BASEURL: "http://concelier:8443"
      STELLAOPS_GATEWAY__SCANNER__BASEURL: "http://scanner:8444"
    volumes:
      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
    ports:
      - "${GATEWAY_PORT:-8080}:8080"
    networks:
      - stellaops
    labels: *release-labels