clean up base infra

infra/base/infrastructure.yaml

@@ -6,10 +6,10 @@
 networks:
   frontend:
     external: true
-    name: frontend
+    name: apa-frontend
   backend:
     external: true
-    name: backend
+    name: apa-backend
 
 volumes:
   postgres_data:
@@ -22,10 +22,121 @@ volumes:
   nats_data:
 
 services:
+  # Edge Gateway & SSO
+  apa-traefik:
+    image: docker.io/library/traefik:v3.5.1
+    container_name: apa-traefik
+    restart: unless-stopped
+    networks:
+      - frontend
+      - backend
+    ports:
+      - 80:80
+      - 443:443
+      - 8080:8080
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik/config/:/etc/traefik/:ro
+
+  # Identity & SSO (Authentik)
+  apa-authentik-db:
+    image: postgres:15-alpine
+    container_name: apa-authentik-db
+    restart: unless-stopped
+    networks:
+      - backend
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: authentik
+      POSTGRES_USER: authentik
+      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U authentik"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  apa-authentik-redis:
+    image: redis:7-alpine
+    container_name: apa-authentik-redis
+    restart: unless-stopped
+    networks:
+      - backend
+    command: --save 60 1 --loglevel warning
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  apa-authentik-server:
+    image: ghcr.io/goauthentik/server:2025.8.3
+    container_name: apa-authentik-server
+    restart: unless-stopped
+    networks:
+      - backend
+      - frontend
+    command: server
+    environment:
+      AUTHENTIK_REDIS__HOST: apa-authentik-redis
+      AUTHENTIK_POSTGRESQL__HOST: apa-authentik-db
+      AUTHENTIK_POSTGRESQL__USER: authentik
+      AUTHENTIK_POSTGRESQL__NAME: authentik
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
+      AUTHENTIK_ERROR_REPORTING__ENABLED: false
+    depends_on:
+      - apa-authentik-db
+      - apa-authentik-redis
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.authentik.rule=Host(`auth.${DOMAIN}`)"
+      - "traefik.http.routers.authentik.entrypoints=websecure"
+      - "traefik.http.routers.authentik.tls=true"
+      - "traefik.http.routers.authentik.tls.certresolver=godaddy"
+      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
+
+  apa-authentik-worker:
+    image: ghcr.io/goauthentik/server:2025.8.3
+    container_name: apa-authentik-worker
+    restart: unless-stopped
+    networks:
+      - backend
+    command: worker
+    environment:
+      AUTHENTIK_REDIS__HOST: apa-authentik-redis
+      AUTHENTIK_POSTGRESQL__HOST: apa-authentik-db
+      AUTHENTIK_POSTGRESQL__USER: authentik
+      AUTHENTIK_POSTGRESQL__NAME: authentik
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
+      AUTHENTIK_ERROR_REPORTING__ENABLED: false
+    depends_on:
+      - apa-authentik-db
+      - apa-authentik-redis
+
+  apa-authentik-outpost:
+    image: ghcr.io/goauthentik/proxy:2025.8.3
+    container_name: apa-authentik-outpost
+    restart: unless-stopped
+    networks:
+      - backend
+      - frontend
+    environment:
+      AUTHENTIK_HOST: http://apa-authentik-server:9000
+      AUTHENTIK_INSECURE: true
+      AUTHENTIK_TOKEN: ${AUTHENTIK_OUTPOST_TOKEN}
+      AUTHENTIK_REDIS__HOST: apa-authentik-redis
+      AUTHENTIK_REDIS__PORT: 6379
+    depends_on:
+      - apa-authentik-server
+      - apa-authentik-redis
+
   # Secrets Management
-  vault:
+  apa-vault:
     image: hashicorp/vault:1.15
-    container_name: vault
+    container_name: apa-vault
     restart: unless-stopped
     networks:
       - backend
@@ -48,9 +159,9 @@ services:
       - "traefik.http.services.vault.loadbalancer.server.port=8200"
 
   # Object Storage
-  minio:
+  apa-minio:
     image: minio/minio:RELEASE.2025-09-07T16-13-09Z
-    container_name: minio
+    container_name: apa-minio
     restart: unless-stopped
     networks:
       - backend
@@ -85,9 +196,9 @@ services:
       - "traefik.http.services.minio-console.loadbalancer.server.port=9093"
 
   # Vector Database
-  qdrant:
+  apa-qdrant:
     image: qdrant/qdrant:v1.7.4
-    container_name: qdrant
+    container_name: apa-qdrant
     restart: unless-stopped
     networks:
       - backend
@@ -108,9 +219,9 @@ services:
       - "traefik.http.services.qdrant.loadbalancer.server.port=6333"
 
   # Knowledge Graph Database
-  neo4j:
+  apa-neo4j:
     image: neo4j:5.15-community
-    container_name: neo4j
+    container_name: apa-neo4j
     restart: unless-stopped
     networks:
       - backend
@@ -136,9 +247,9 @@ services:
       - "traefik.http.services.neo4j.loadbalancer.server.port=7474"
 
   # Secure Client Data Store
-  postgres:
+  apa-postgres:
     image: postgres:15-alpine
-    container_name: postgres
+    container_name: apa-postgres
     restart: unless-stopped
     networks:
       - backend
@@ -169,9 +280,9 @@ services:
       retries: 3
 
   # Cache & Session Store
-  redis:
+  apa-redis:
     image: redis:7-alpine
-    container_name: redis
+    container_name: apa-redis
     restart: unless-stopped
     networks:
       - backend
@@ -190,9 +301,9 @@ services:
       retries: 3
 
   # Message Broker & Event Streaming
-  nats:
+  apa-nats:
     image: nats:2.10-alpine
-    container_name: nats
+    container_name: apa-nats
     restart: unless-stopped
     networks:
       - backend