docker-compose.yaml

services:
  # Red Hat OGX distribution with FAISS
  ogx:
    build:
      context: .
      dockerfile: deploy/ogx/test.containerfile
    platform: linux/amd64
    container_name: ogx
    ports:
      - "8321:8321"  # Expose OGX on 8321 (adjust if needed)
    depends_on:
      mock-tls-inference:
        condition: service_healthy
    volumes:
      # Used in legacy mode only: with a unified lightspeed-stack.yaml (one
      # carrying inference.providers / vector_store.providers / a
      # ogx.config block) the entrypoint synthesizes the run config
      # from lightspeed-stack.yaml and this mount is ignored
      - ./run.yaml:/opt/app-root/run.yaml:z
      # Host copies so `docker compose up` picks up script changes without rebuilding OGX
      - ./scripts/ogx-entrypoint.sh:/opt/app-root/enrich-entrypoint.sh:ro,z
      - ./src/ogx_configuration.py:/opt/app-root/ogx_configuration.py:ro,z
      - ./src/data:/opt/app-root/data:ro,z
      - ${GCP_KEYS_PATH:-./tmp/.gcp-keys-dummy}:/opt/app-root/.gcp-keys:ro
      - ./lightspeed-stack.yaml:/opt/app-root/lightspeed-stack.yaml:ro,z
      # Writable OGX storage (rag/ work copy is re-seeded by entrypoint each start)
      - ogx-storage:/opt/app-root/src/.llama/storage
      # Read-only e2e FAISS fixtures — never mount these as the live KV_RAG_PATH
      - ./tests/e2e/rag:/opt/app-root/src/.llama/storage/.e2e-rag-seed:ro,z
      - mock-tls-certs:/certs:ro
      - ${HF_CACHE_PATH:-./tmp/.hf-cache}:/opt/app-root/src/.cache/huggingface:z
    environment:
      - BRAVE_SEARCH_API_KEY=${BRAVE_SEARCH_API_KEY:-}
      - TAVILY_SEARCH_API_KEY=${TAVILY_SEARCH_API_KEY:-}
      # OpenAI
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - E2E_OPENAI_MODEL=${E2E_OPENAI_MODEL:-gpt-4o-mini}
      # Azure Entra ID credentials (AZURE_API_KEY is passed via provider_data at request time)
      - TENANT_ID=${TENANT_ID:-}
      - CLIENT_ID=${CLIENT_ID:-}
      - CLIENT_SECRET=${CLIENT_SECRET:-}
      # RHAIIS
      - RHAIIS_URL=${RHAIIS_URL}
      - RHAIIS_PORT=${RHAIIS_PORT}
      - RHAIIS_API_KEY=${RHAIIS_API_KEY}
      - RHAIIS_MODEL=${RHAIIS_MODEL}
      # RHEL AI
      - RHEL_AI_URL=${RHEL_AI_URL}
      - RHEL_AI_PORT=${RHEL_AI_PORT}
      - RHEL_AI_API_KEY=${RHEL_AI_API_KEY}
      - RHEL_AI_MODEL=${RHEL_AI_MODEL}
      # VertexAI
      - GOOGLE_APPLICATION_CREDENTIALS=${GOOGLE_APPLICATION_CREDENTIALS:-}
      - VERTEX_AI_PROJECT=${VERTEX_AI_PROJECT:-}
      - VERTEX_AI_LOCATION=${VERTEX_AI_LOCATION:-}
      # WatsonX
      - WATSONX_BASE_URL=${WATSONX_BASE_URL:-}
      - WATSONX_PROJECT_ID=${WATSONX_PROJECT_ID:-}
      - WATSONX_API_KEY=${WATSONX_API_KEY:-}
      - LITELLM_DROP_PARAMS=true
      # AWS Bedrock
      - AWS_BEARER_TOKEN_BEDROCK=${AWS_BEARER_TOKEN_BEDROCK:-}
      # Enable debug logging if needed
      - OGX_LOGGING=${OGX_LOGGING:-}
      # FAISS test
      - FAISS_VECTOR_STORE_ID=${FAISS_VECTOR_STORE_ID:-}
      # Disable OGX ~/.llama → ~/.ogx migration (bind-mount under ~/.llama/storage/rag).
      - OGX_CONFIG_DIR=/opt/app-root/src/.ogx
      # Live RAG DBs under /tmp (writable for UID 1001); seeded from .e2e-rag-seed
      - RAG_SEED_DIR=/opt/app-root/src/.llama/storage/.e2e-rag-seed
      - KV_RAG_PATH=/tmp/e2e-rag-work/kv_store.db
      - PDF_KV_RAG_PATH=/tmp/e2e-rag-work/pdf_kv_store.db
      # Prevent HuggingFace Hub update checks (HTTP 429 rate-limiting in CI from parallel jobs).
      - HF_HUB_OFFLINE=1
      # OKP/Solr RAG
      - RH_SERVER_OKP=${RH_SERVER_OKP:-}
      - SOLR_URL=${SOLR_URL:-}
      - SOLR_COLLECTION=${SOLR_COLLECTION:-}
      - SOLR_VECTOR_FIELD=${SOLR_VECTOR_FIELD:-}
      - SOLR_CONTENT_FIELD=${SOLR_CONTENT_FIELD:-}
      - SOLR_EMBEDDING_MODEL=${SOLR_EMBEDDING_MODEL:-}
      - SOLR_EMBEDDING_DIM=${SOLR_EMBEDDING_DIM:-}
      # Required for enrichment; E2E_LLAMA_HOSTNAME is the external/GitHub Actions name
      - E2E_OGX_HOSTNAME=${E2E_OGX_HOSTNAME:-${E2E_LLAMA_HOSTNAME:-ogx}}
    networks:
      - lightspeednet
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8321/v1/health"]
      interval: 10s   # how often to run the check
      timeout: 5s    # how long to wait before considering it failed
      retries: 3      # how many times to retry before marking as unhealthy
      start_period: 15s # time to wait before starting checks

  lightspeed-stack:
    build:
      context: .
      dockerfile: deploy/lightspeed-stack/Containerfile
    container_name: lightspeed-stack
    ports:
      - "8080:8080"
    volumes:
      - ./lightspeed-stack.yaml:/app-root/lightspeed-stack.yaml:z
      - ./tests/e2e/skills:/app-root/skills:ro,z
      - ./tests/e2e/secrets/mcp-token:/tmp/mcp-token:ro,z
      - ./tests/e2e/secrets/invalid-mcp-token:/tmp/invalid-mcp-token:ro,z
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      # Azure Entra ID credentials (AZURE_API_KEY is obtained dynamically)
      - TENANT_ID=${TENANT_ID:-}
      - CLIENT_ID=${CLIENT_ID:-}
      - CLIENT_SECRET=${CLIENT_SECRET:-}
      # FAISS vector store ID (used by inline RAG config)
      - FAISS_VECTOR_STORE_ID=${FAISS_VECTOR_STORE_ID:-}
      # Substituted in mounted lightspeed-stack.yaml (ogx.url); GitHub Actions sets E2E_LLAMA_HOSTNAME
      - E2E_OGX_HOSTNAME=${E2E_OGX_HOSTNAME:-${E2E_LLAMA_HOSTNAME:-ogx}}
      - E2E_OGX_PORT=${E2E_OGX_PORT:-${E2E_LLAMA_PORT:-8321}}
      # OpenTelemetry configuration. Export is enabled by default and points at
      # the mock OTLP/HTTP collector so the OpenTelemetry delivery E2E test works
      # without per-scenario reconfiguration. Override any OTEL_* var (or set
      # OTEL_SDK_DISABLED=true) to change or disable export.
      - OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT:-http://mock-otel:4318}
      - OTEL_EXPORTER_OTLP_PROTOCOL=${OTEL_EXPORTER_OTLP_PROTOCOL:-http/protobuf}
      - OTEL_SERVICE_NAME=${OTEL_SERVICE_NAME:-lightspeed-stack-e2e}
      - OTEL_ANONYMIZATION_SECRET=${OTEL_ANONYMIZATION_SECRET:-lightspeed-stack-otel-anonymization-dev-default}
      - OTEL_SDK_DISABLED=${OTEL_SDK_DISABLED:-false}
    depends_on:
        ogx:
          condition: service_healthy
        mock-mcp:
          condition: service_healthy
        mock-otel:
          condition: service_healthy
    networks:
      - lightspeednet
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/liveness"]
      interval: 10s   # how often to run the check
      timeout: 5s    # how long to wait before considering it failed
      retries: 3      # how many times to retry before marking as unhealthy
      start_period: 5s # time to wait before starting checks

  # Mock JWKS server for RBAC E2E tests
  mock-jwks:
    build:
      context: ./tests/e2e/mock_jwks_server
      dockerfile: Dockerfile
    container_name: mock-jwks
    ports:
      - "8000:8000"
    networks:
      - lightspeednet
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
      interval: 5s
      timeout: 3s
      retries: 3
      start_period: 2s

  mock-mcp:
    build:
      context: ./tests/e2e/mock_mcp_server
      dockerfile: Dockerfile
    container_name: mock-mcp
    ports:
      - "3000:3000"
    networks:
      - lightspeednet
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:3000/health')"]
      interval: 5s
      timeout: 3s
      retries: 3
      start_period: 2s

  # Mock OTLP/HTTP collector for OpenTelemetry E2E tests.
  # lightspeed-stack exports to it by default (see OTEL_* above) and waits for it
  # to be healthy, so telemetry is delivered from startup. The port is bound to
  # loopback only so it is not exposed beyond the host running the tests.
  mock-otel:
    build:
      context: ./tests/e2e/mock_otel_collector
      dockerfile: Dockerfile
    container_name: mock-otel
    ports:
      - "127.0.0.1:4318:4318"
    networks:
      - lightspeednet
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4318/health')"]
      interval: 5s
      timeout: 3s
      retries: 3
      start_period: 2s

  # Mock TLS inference server for TLS E2E tests
  mock-tls-inference:
    build:
      context: ./tests/e2e/mock_tls_inference_server
      dockerfile: Dockerfile
    container_name: mock-tls-inference
    networks:
      - lightspeednet
    volumes:
      - mock-tls-certs:/certs
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request,ssl;c=ssl.create_default_context();c.check_hostname=False;c.verify_mode=ssl.CERT_NONE;urllib.request.urlopen('https://localhost:8443/health',context=c)"]
      interval: 5s
      timeout: 3s
      retries: 3
      start_period: 5s


volumes:
  ogx-storage:
  mock-tls-certs:

networks:
  lightspeednet:
    driver: bridge