compose.yaml

# Environment variables shared by all agents
x-beeai-env: &beeai-env
  MCP_GATEWAY_URL: http://mcp-gateway:8000/sse
  GITLAB_TOKEN: ${GITLAB_TOKEN:-}
  UPSTREAM_SEARCH_API_URL: http://upstream-sea.hosted.upshift.rdu2.redhat.com:80/v1
  REDIS_URL: redis://valkey:6379/0
  COLLECTOR_ENDPOINT: http://otel-collector:4318/v1/traces
  GIT_REPO_BASEPATH: /git-repos
  MAX_RETRIES: 3
  MAX_CONCURRENT_TASKS: ${MAX_CONCURRENT_TASKS:-1}
  LOG_BUFFER_SIZE: ${LOG_BUFFER_SIZE:-0}
  DRY_RUN: ${DRY_RUN:-false}
  JIRA_DRY_RUN: ${JIRA_DRY_RUN:-false}
  JIRA_ALLOW_STATUS_CHANGES: ${JIRA_ALLOW_STATUS_CHANGES:-false}
  ERRATA_ALLOW_STATUS_CHANGES: ${ERRATA_ALLOW_STATUS_CHANGES:-false}
  AUTO_CHAIN: ${AUTO_CHAIN:-true}
  TRIAGE_ENQUEUE_REPRODUCER: ${TRIAGE_ENQUEUE_REPRODUCER:-true}
  REQUESTS_CA_BUNDLE: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
  SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT:-development}

# Base template for BeeAI agents
x-beeai-agent: &beeai-agent
  depends_on:
    - mcp-gateway
    - valkey
    - otel-collector
  environment:
    <<: *beeai-env
  env_file:
    - .secrets/beeai-agent.env
  volumes:
    - ./ymir:/home/beeai/ymir:ro,z
    - git-repos:/git-repos:rw,U
    - .secrets/rhel-config.json:/home/beeai/rhel-config.json:ro,z,U
    - .secrets/jotnar-vertex-dev.json:/home/beeai/jotnar-vertex-dev.json:ro,z,U
    - ./scripts:/home/beeai/scripts:ro,z
  restart: unless-stopped

# C9S agent template
x-beeai-agent-c9s: &beeai-agent-c9s
  <<: *beeai-agent
  image: beeai-agent:c9s
  build:
    context: .
    dockerfile: Containerfile.c9s
    args:
      INTERNAL_REPO_URL: ${INTERNAL_REPO_URL_C9S:-}
      EXTRA_PACKAGES: ${INTERNAL_PACKAGES_C9S:-}
  environment:
    <<: *beeai-env
    CONTAINER_VERSION: c9s

# C10S agent template
x-beeai-agent-c10s: &beeai-agent-c10s
  <<: *beeai-agent
  image: beeai-agent:c10s
  build:
    context: .
    dockerfile: Containerfile.c10s
    args:
      INTERNAL_REPO_URL: ${INTERNAL_REPO_URL_C10S:-}
      EXTRA_PACKAGES: ${INTERNAL_PACKAGES_C10S:-}
  environment:
    <<: *beeai-env
    CONTAINER_VERSION: c10s

x-supervisor: &supervisor
  depends_on:
    - valkey
    - otel-collector
  image: supervisor
  build:
    context: .
    dockerfile: Containerfile.supervisor
  environment:
    - REDIS_URL=redis://valkey:6379/0
    - COLLECTOR_ENDPOINT=http://otel-collector:4318/v1/traces
    - GIT_REPO_BASEPATH=/git-repos
    - "KRB5CCNAME=FILE:/home/beeai/ccache/krb5cc"
  env_file:
    - .secrets/supervisor.env
  volumes:
    - ./ymir/agents:/home/beeai/ymir/agents:ro,z
    - ./ymir/tools:/home/beeai/ymir/tools:ro,z
    - ./ymir/common:/home/beeai/ymir/common:ro,z
    - ./ymir/supervisor:/home/beeai/ymir/supervisor:ro,z
    - .secrets/ccache:/home/beeai/ccache:ro,z,U
  restart: unless-stopped

services:
  mcp-gateway: &mcp-gateway
    image: mcp-gateway
    build:
      context: .
      dockerfile: Containerfile.mcp
      args:
        INTERNAL_REPO_URL: ${INTERNAL_REPO_URL_MCP:-}
        EXTRA_PACKAGES: ${INTERNAL_PACKAGES_MCP:-}
    environment:
      - SSE_PORT=8000
      - KEYTAB_FILE=/home/mcp/keytab
      # default cache location is a keyring
      - KRB5CCNAME=FILE:/tmp/krb5cc
      # Point requests at the system CA bundle (includes RH IT Root CAs from
      # files/Current-IT-Root-CAs.pem via update-ca-trust in Containerfile.mcp).
      # Without this, requests uses certifi and fails on internal HTTPS (e.g. artifacts.osci).
      # Fedora 44 dropped the /etc/pki/tls/certs/ca-bundle.crt compat symlink
      # (https://fedoraproject.org/wiki/Changes/droppingOfCertPemFile); use the
      # canonical extracted bundle path instead.
      - REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
      # SAFETY: These default to false for production agents, but MUST be true for E2E tests.
      # The E2E Makefile targets set them in the environment before invoking compose
      # (e.g., MOCK_JIRA=true DRY_RUN=true make run-triage-agent-e2e-tests) so the
      # ${VAR:-false} substitution picks up the true value. This prevents E2E tests
      # from writing to production Jira when run via make targets.
      - DRY_RUN=${DRY_RUN:-false}
      - MOCK_JIRA=${MOCK_JIRA:-false}
      - JIRA_DRY_RUN=${JIRA_DRY_RUN:-false}
      - SHARED_RULES_ENABLED=${SHARED_RULES_ENABLED:-true}
      - TESTING_FARM_DRY_RUN=${TESTING_FARM_DRY_RUN:-false}
      - TESTING_FARM_COMPOSE_FILTER=${TESTING_FARM_COMPOSE_FILTER:-}
      - GIT_REPO_BASEPATH=/git-repos
      - JIRA_MOCK_FILES=ymir/tools/privileged/tests/data
      # e2e tests write insteadOf rewrites here; ignored when the file is absent
      - GIT_CONFIG_GLOBAL=${GIT_REPO_BASEPATH:-/git-repos}/.mock_gitconfig
    env_file:
      - .secrets/mcp-gateway.env
    volumes:
      - ./ymir/tools:/home/mcp/ymir/tools:ro,z
      - ${JIRA_MOCK_FILES_HOST:-./ymir/tools/privileged/tests/data}:/home/mcp/ymir/tools/privileged/tests/data:rw,z
      - ./ymir/common:/home/mcp/ymir/common:ro,z
      - .secrets/keytab:/home/mcp/keytab:ro,z,U
      - ${GIT_REPOS_HOST:-git-repos}:${GIT_REPO_BASEPATH:-/git-repos}:z
      - .secrets/rhel-config.json:/home/mcp/rhel-config.json:ro,z,U
    command: ["python", "-m", "ymir.tools.privileged.gateway"]
    restart: unless-stopped
    profiles: ["agents", "supervisor", "e2e-test"]

  mcp-gateway-cli:
    <<: *mcp-gateway
    # keep-id maps the host UID into the container so git clones written to
    # the bind-mounted GIT_REPOS_HOST directory are owned by the calling user.
    userns_mode: keep-id
    ports:
      - "127.0.0.1:8000:8000"
    restart: "no"
    profiles: ["cli"]
    networks:
      default:
        aliases:
          - mcp-gateway

  valkey:
    image: docker.io/valkey/valkey:8
    volumes:
      - valkey-data:/data
    restart: unless-stopped
    profiles: ["agents", "supervisor", "e2e-test"]

  phoenix-db:
    image: quay.io/sclorg/postgresql-16-c9s
    environment:
      - POSTGRESQL_USER=phoenix
      - POSTGRESQL_PASSWORD=phoenix
      - POSTGRESQL_DATABASE=phoenix
    volumes:
      - phoenix-db-data:/var/lib/pgsql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U phoenix -d phoenix"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    profiles: ["agents", "supervisor", "e2e-test"]

  phoenix:
    image: quay.io/jotnar/phoenix:latest
    build:
      context: .
      dockerfile: Containerfile.phoenix
    depends_on:
      phoenix-db:
        condition: service_healthy
    ports:
      - "0.0.0.0:6006:6006"
    environment:
      - PHOENIX_WORKING_DIR=/mnt/data
      - PHOENIX_SQL_DATABASE_URL=postgresql://phoenix:phoenix@phoenix-db/phoenix
    volumes:
      - phoenix-data:/mnt/data
    restart: unless-stopped
    profiles: ["agents", "supervisor", "e2e-test"]

  trace-server:
    image: trace-server
    build:
      context: .
      dockerfile: Containerfile.trace-server
    ports:
      - "8082:8080"
    environment:
      - TRACE_DB_PATH=/data/traces.db
    volumes:
      - ./trace_server:/app:ro,z
      - trace-server-data:/data:U
    restart: unless-stopped
    profiles: ["agents", "supervisor", "e2e-test", "cli"]

  otel-collector:
    image: docker.io/otel/opentelemetry-collector-contrib
    depends_on:
      - phoenix
      - trace-server
    volumes:
      - .secrets/otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml:ro,z
    restart: unless-stopped
    profiles: ["agents", "supervisor", "e2e-test"]

  redis-commander:
    image: quay.io/jotnar/redis-commander
    build:
      context: .
      dockerfile: Containerfile.redis-commander
    environment:
      - REDIS_HOST=valkey
      - REDIS_PORT=6379
    ports:
      - "8081:8081"
    depends_on:
      - valkey
    restart: unless-stopped
    profiles: ["agents", "supervisor"]

  triage-agent:
    <<: *beeai-agent-c10s
    environment:
      <<: *beeai-env
    command: ["python", "-m", "ymir.agents.triage_agent"]
    profiles: ["agents"]

  triage-cli:
    <<: *beeai-agent-c10s
    depends_on: []
    userns_mode: keep-id
    environment:
      <<: *beeai-env
      COLLECTOR_ENDPOINT: http://trace-server:8080/v1/traces
      GOOGLE_APPLICATION_CREDENTIALS: /home/beeai/jotnar-vertex-dev.json
    volumes:
      - ./ymir:/home/beeai/ymir:ro,z
      - ${GIT_REPOS_HOST:-git-repos}:${GIT_REPO_BASEPATH:-/git-repos}:rw,z
      - .secrets/rhel-config.json:/home/beeai/rhel-config.json:ro,z
      - .secrets/jotnar-vertex-dev.json:/home/beeai/jotnar-vertex-dev.json:ro,z
    command: ["python", "-m", "ymir.agents.triage_agent"]
    restart: "no"
    profiles: ["cli"]

  preliminary-testing-agent:
    <<: *beeai-agent-c10s
    environment:
      <<: *beeai-env
    command: ["python", "-m", "ymir.agents.preliminary_testing_agent"]
    profiles: ["agents"]

  issue-verification-agent:
    <<: *beeai-agent-c10s
    environment:
      <<: *beeai-env
    command: ["python", "-m", "ymir.agents.issue_verification_agent"]
    profiles: ["agents"]

  errata-workflow-agent:
    <<: *beeai-agent-c10s
    environment:
      <<: *beeai-env
    command: ["python", "-m", "ymir.agents.errata_workflow_agent"]
    profiles: ["agents"]

  triage-agent-e2e-tests:
    <<: *beeai-agent-c10s
    environment:
      <<: *beeai-env
      MOCK_REPOS_DIR: /home/beeai/mock_repos/triage
      # SAFETY: These MUST be set to prevent E2E tests from writing to production Jira.
      # Tests use real issue keys (e.g., RHEL-174694) and will post comments to
      # production if these are not enforced. The Makefile passes them via -e flags,
      # but setting them here provides defense-in-depth if someone runs the container
      # directly via podman-compose.
      MOCK_JIRA: ${MOCK_JIRA:-true}
      DRY_RUN: ${DRY_RUN:-true}
    volumes:  # YAML doesn't support list concatenation
      - ./ymir:/home/beeai/ymir:ro,z
      - git-repos:/git-repos:rw,U
      - .secrets/rhel-config.json:/home/beeai/rhel-config.json:ro,z,U
      - .secrets/jotnar-vertex-dev.json:/home/beeai/jotnar-vertex-dev.json:ro,z,U
      - ${MOCK_REPOS_HOST:-./ymir/agents/tests/e2e/mock_repos}:/home/beeai/mock_repos:ro,z
      - ${TMT_TEST_DATA:-./.tmt}/results.yaml:/home/beeai/results.yaml:rw,z,U
    # the option about default loop is here because of litellm issue
    # https://github.com/BerriAI/litellm/issues/14521
    command:
      [
        "pytest",
        "ymir/agents/tests/e2e/test_triage.py",
        "-o",
        "asyncio_default_test_loop_scope=session",
        "--log-disable=agent.trajectory",
      ]
    restart: "no"
    profiles: ["e2e-test"]

  backport-agent-e2e-tests:
    <<: *beeai-agent-c10s
    environment:
      <<: *beeai-env
      BACKPORT_MOCK_REPOS_DIR: /home/beeai/mock_repos/backport
      # SAFETY: These MUST be set to prevent E2E tests from writing to production Jira.
      MOCK_JIRA: ${MOCK_JIRA:-true}
      DRY_RUN: ${DRY_RUN:-true}
    volumes:
      - ./ymir:/home/beeai/ymir:ro,z
      - git-repos:/git-repos:rw,U
      - .secrets/rhel-config.json:/home/beeai/rhel-config.json:ro,z,U
      - .secrets/jotnar-vertex-dev.json:/home/beeai/jotnar-vertex-dev.json:ro,z,U
      - ${MOCK_REPOS_HOST:-./ymir/agents/tests/e2e/mock_repos}:/home/beeai/mock_repos:ro,z
    command:
      [
        "pytest",
        "ymir/agents/tests/e2e/backport_agent/test_backport.py",
        "-o",
        "asyncio_default_test_loop_scope=session",
        "--log-disable=agent.trajectory",
      ]
    restart: "no"
    profiles: ["e2e-test"]

  reproducer-agent-e2e-tests:
    <<: *beeai-agent-c10s
    environment:
      <<: *beeai-env
      REPRODUCER_MOCK_REPOS_DIR: /home/beeai/mock_repos/reproducer
      # SAFETY: These MUST be set to prevent E2E tests from writing to production Jira.
      MOCK_JIRA: ${MOCK_JIRA:-true}
      DRY_RUN: ${DRY_RUN:-true}
      # TF dry-run defaults safe; overridden to false via Makefile for real TF provisioning.
      TESTING_FARM_DRY_RUN: ${TESTING_FARM_DRY_RUN:-true}
      CHAT_MODEL_TIMEOUT: ${CHAT_MODEL_TIMEOUT:-600}
    volumes:
      - ./ymir:/home/beeai/ymir:ro,z
      - git-repos:/git-repos:rw,U
      - .secrets/rhel-config.json:/home/beeai/rhel-config.json:ro,z,U
      - .secrets/jotnar-vertex-dev.json:/home/beeai/jotnar-vertex-dev.json:ro,z,U
      - ${MOCK_REPOS_HOST:-./ymir/agents/tests/e2e/mock_repos}:/home/beeai/mock_repos:ro,z
    command: ["pytest", "ymir/agents/tests/e2e/reproducer_agent/test_reproducer.py", "-o", "asyncio_default_test_loop_scope=session"]
    restart: "no"
    profiles: ["e2e-test"]

  reproducer-agent:
    <<: *beeai-agent-c10s
    command: ["python", "-m", "ymir.agents.reproducer_agent"]
    profiles: ["agents"]

  backport-agent-c9s:
    <<: *beeai-agent-c9s
    command: ["python", "-m", "ymir.agents.backport_agent"]
    profiles: ["agents"]

  backport-agent-c10s:
    <<: *beeai-agent-c10s
    command: ["python", "-m", "ymir.agents.backport_agent"]
    profiles: ["agents"]

  rebase-agent-c9s:
    <<: *beeai-agent-c9s
    command: ["python", "-m", "ymir.agents.rebase_agent"]
    profiles: ["agents"]

  rebase-agent-c10s:
    <<: *beeai-agent-c10s
    command: ["python", "-m", "ymir.agents.rebase_agent"]
    profiles: ["agents"]

  rebuild-agent-c9s:
    <<: *beeai-agent-c9s
    command: ["python", "-m", "ymir.agents.rebuild_agent"]
    profiles: ["agents"]

  rebuild-agent-c10s:
    <<: *beeai-agent-c10s
    command: ["python", "-m", "ymir.agents.rebuild_agent"]
    profiles: ["agents"]

  mr-agent-c9s:
    <<: *beeai-agent-c9s
    command: ["python", "-m", "ymir.agents.merge_request_agent"]
    profiles: ["agents"]

  mr-agent-c10s:
    <<: *beeai-agent-c10s
    command: ["python", "-m", "ymir.agents.merge_request_agent"]
    profiles: ["agents"]

  mr-consolidation-agent-c9s:
    <<: *beeai-agent-c9s
    command: ["python", "-m", "ymir.agents.mr_consolidation_agent"]
    profiles: ["agents"]

  mr-consolidation-agent-c10s:
    <<: *beeai-agent-c10s
    command: ["python", "-m", "ymir.agents.mr_consolidation_agent"]
    profiles: ["agents"]

  mr-consolidation-agent-e2e-tests:
    <<: *beeai-agent-c10s
    environment:
      <<: *beeai-env
      MR_CONSOLIDATION_MOCK_REPOS_DIR: /home/beeai/mock_repos/mr_consolidation
    volumes:
      - ./ymir:/home/beeai/ymir:ro,z
      - git-repos:/git-repos:rw,U
      - .secrets/rhel-config.json:/home/beeai/rhel-config.json:ro,z,U
      - .secrets/jotnar-vertex-dev.json:/home/beeai/jotnar-vertex-dev.json:ro,z,U
      - ${MOCK_REPOS_HOST:-./ymir/agents/tests/e2e/mock_repos}:/home/beeai/mock_repos:ro,z
    command: ["pytest", "ymir/agents/tests/e2e/mr_consolidation/test_mr_consolidation.py", "-o", "asyncio_default_test_loop_scope=session"]
    restart: "no"
    profiles: ["e2e-test"]

  # This is here so we can use it for '$(COMPOSE) run'
  supervisor:
    <<: *supervisor
    command: ["sh", "-c", "echo 'This service isn't run directly' && exit 1"]
    profiles: []
    restart: "no"


  jira-issue-fetcher:
    # No hard dependencies - will connect to existing services or fail gracefully
    # otherwise it will kill agents already running
    image: jira-issue-fetcher
    build:
      context: .
      dockerfile: Containerfile.jira-issue-fetcher
    environment:
      - REDIS_URL=redis://valkey:6379/0
    env_file:
      - .secrets/jira-issue-fetcher.env
    restart: "no"
    profiles: ["manual"]  # Don't start by default, run manually for testing

  mr-cleanup:
    image: mr-cleanup
    build:
      context: .
      dockerfile: Containerfile.mr-cleanup
    env_file:
      - .secrets/mr-cleanup.env
    restart: "no"
    profiles: ["manual"]

  sweep:
    image: sweep
    build:
      context: .
      dockerfile: Containerfile.sweep
    environment:
      - REDIS_URL=redis://valkey:6379/0
    env_file:
      - .secrets/sweep.env
    restart: "no"
    profiles: ["manual"]


volumes:
  valkey-data:
  phoenix-data:
  phoenix-db-data:
  trace-server-data:
  git-repos: