clean up base infra

2025-10-11 11:42:43 +01:00
parent b324ff09ef
commit f0f7674b8d
52 changed files with 663 additions and 5224 deletions
--- a/infra/compose/authentik/compose.yaml
+++ b/infra/compose/authentik/compose.yaml
@@ -1,127 +0,0 @@
---
-services:
-  authentik-server:
-    image: ghcr.io/goauthentik/server:2025.8.1
-    container_name: authentik-server
-    command: server
-    environment:
-      - AUTHENTIK_REDIS__HOST=authentik-redis
-      - AUTHENTIK_POSTGRESQL__HOST=authentik-postgres
-      - AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER:-authentik}
-      - AUTHENTIK_POSTGRESQL__NAME=${POSTGRES_DB:-authentik}
-      - AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD:?error}
-      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY:?error}
-      - AUTHENTIK_ERROR_REPORTING__ENABLED=${AUTHENTIK_ERROR_REPORTING:-false}
-
-    labels:
-      # (Optional)  Enable Traefik integration for the Authentik Web UI. For more information
-      #             about integrating other services with Traefik and Authentik, see the
-      #             documentation at https://goauthentik.io/docs/outposts/integrations/traefik
-      #             and the middleware example files in `docker-compose/traefik/config`.
-      - traefik.enable=true
-      - traefik.http.services.authentik.loadbalancer.server.port=9000
-      - traefik.http.services.authentik.loadbalancer.server.scheme=http
-      - traefik.http.routers.authentik.entrypoints=websecure
-      - traefik.http.routers.authentik.rule=Host(`authentik.harkon.co.uk`)
-      - traefik.http.routers.authentik.tls=true
-      - traefik.http.routers.authentik.tls.certresolver=godaddy
-      - traefik.http.routers.authentik.service=authentik
-    volumes:
-      - ./media:/media
-      - ./custom-templates:/templates
-    depends_on:
-      - authentik-postgres
-      - authentik-redis
-    networks:
-      - frontend
-      - backend
-    restart: unless-stopped
-
-  authentik-worker:
-    image: ghcr.io/goauthentik/server:2025.8.1
-    container_name: authentik-worker
-    command: worker
-    environment:
-      - AUTHENTIK_REDIS__HOST=authentik-redis
-      - AUTHENTIK_POSTGRESQL__HOST=authentik-postgres
-      - AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER:-authentik}
-      - AUTHENTIK_POSTGRESQL__NAME=${POSTGRES_DB:-authentik}
-      - AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD:?error}
-      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY:?error}
-      - AUTHENTIK_ERROR_REPORTING__ENABLED=${AUTHENTIK_ERROR_REPORTING:-false}
-      # (Optional)  Enable Email Sending
-      #             Highly recommended to notify you about alerts and configuration issues.
-      # - AUTHENTIK_EMAIL__HOST=${EMAIL_HOST:?error}
-      # - AUTHENTIK_EMAIL__PORT=${EMAIL_PORT:-25}
-      # - AUTHENTIK_EMAIL__USERNAME=${EMAIL_USERNAME:?error}
-      # - AUTHENTIK_EMAIL__PASSWORD=${EMAIL_PASSWORD:?error}
-      # - AUTHENTIK_EMAIL__USE_TLS=${EMAIL_USE_TLS:-false}
-      # - AUTHENTIK_EMAIL__USE_SSL=${EMAIL_USE_SSL:-false}
-      # - AUTHENTIK_EMAIL__TIMEOUT=${EMAIL_TIMEOUT:-10}
-      # - AUTHENTIK_EMAIL__FROM=${EMAIL_FROM:?error}
-    # (Optional)  See more for the docker socket integration here:
-    #             https://goauthentik.io/docs/outposts/integrations/docker
-    user: root
-    volumes:
-      - /run/docker.sock:/run/docker.sock
-      - ./media:/media
-      - ./certs:/certs
-      - ./custom-templates:/templates
-    depends_on:
-      - authentik-postgres
-      - authentik-redis
-    networks:
-      - backend
-    restart: unless-stopped
-
-  authentik-redis:
-    image: docker.io/library/redis:8.2.1
-    container_name: authentik-redis
-    command: --save 60 1 --loglevel warning
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 3s
-    volumes:
-      - redis_data:/data
-    networks:
-      - backend
-    restart: unless-stopped
-
-  authentik-postgres:
-    # (Optional) Add a PostgreSQL Database for Authentik
-    #   Alternatively, you can host your PostgreSQL database externally, and
-    #   change the connection settings in the `authentik-server` and
-    #   `authentik-worker`.
-    image: docker.io/library/postgres:17.6
-    container_name: authentik-db
-    environment:
-      - POSTGRES_USER=${POSTGRES_USER:-authentik}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?error}
-      - POSTGRES_DB=${POSTGRES_DB:-authentik}
-      - TZ=${TZ:-UTC}
-    healthcheck:
-      test: ["CMD-SHELL", 'pg_isready -U "${POSTGRES_USER:-authentik}"']
-      start_period: 30s
-      interval: 10s
-      timeout: 10s
-      retries: 5
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    networks:
-      - backend
-    restart: unless-stopped
-
-volumes:
-  postgres_data:
-    driver: local
-  redis_data:
-    driver: local
-
-networks:
-  frontend:
-    external: true
-  backend:
-    external: true
--- a/infra/compose/docker-compose.backend.yml
+++ b/infra/compose/docker-compose.backend.yml
@@ -1,990 +0,0 @@
-# FILE: infra/compose/docker-compose.local.yml
-# Traefik (with Authentik ForwardAuth), Authentik, Vault, MinIO, Qdrant, Neo4j, Postgres, Redis, Prometheus/Grafana, Loki, Unleash, all services
-
-networks:
-  frontend:
-    external: true
-    name: ai-tax-agent-frontend
-
-  backend:
-    external: true
-    name: ai-tax-agent-backend
-
-volumes:
-  postgres_data:
-  neo4j_data:
-  neo4j_logs:
-  qdrant_data:
-  minio_data:
-  vault_data:
-  redis_data:
-  nats_data:
-  prometheus_data:
-  grafana_data:
-  loki_data:
-  authentik_data:
-  portainer-data:
-
-services:
-  # Identity & SSO
-  authentik-db:
-    image: postgres:15-alpine
-    container_name: authentik-db
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - authentik_data:/var/lib/postgresql/data
-    environment:
-      POSTGRES_DB: authentik
-      POSTGRES_USER: authentik
-      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD:-authentik}
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U authentik"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  authentik-redis:
-    image: redis:7-alpine
-    container_name: authentik-redis
-    restart: unless-stopped
-    networks:
-      - backend
-    command: --save 60 1 --loglevel warning
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  authentik-server:
-    image: ghcr.io/goauthentik/server:2025.8.3
-    container_name: authentik-server
-    restart: unless-stopped
-    networks:
-      - backend
-      - frontend
-    command: server
-    environment:
-      AUTHENTIK_REDIS__HOST: authentik-redis
-      AUTHENTIK_POSTGRESQL__HOST: authentik-db
-      AUTHENTIK_POSTGRESQL__USER: authentik
-      AUTHENTIK_POSTGRESQL__NAME: authentik
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-changeme}
-      AUTHENTIK_ERROR_REPORTING__ENABLED: false
-      # Optional bootstrap for automated setup (create admin and API token)
-      AUTHENTIK_BOOTSTRAP_EMAIL: ${AUTHENTIK_BOOTSTRAP_EMAIL:-admin@local.lan}
-      AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD:-admin123}
-      AUTHENTIK_BOOTSTRAP_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN:-}
-    volumes:
-      - ./authentik/media:/media
-      - ./authentik/custom-templates:/templates
-      - ./authentik/bootstrap.yaml:/blueprints/bootstrap.yaml
-    depends_on:
-      - authentik-db
-      - authentik-redis
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.authentik.rule=Host(`auth.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.authentik.entrypoints=websecure"
-      - "traefik.http.routers.authentik.tls=true"
-      - "traefik.docker.network=ai-tax-agent-frontend"
-      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
-
-  authentik-worker:
-    image: ghcr.io/goauthentik/server:2025.8.3
-    container_name: authentik-worker
-    restart: unless-stopped
-    networks:
-      - backend
-    command: worker
-    environment:
-      AUTHENTIK_REDIS__HOST: authentik-redis
-      AUTHENTIK_POSTGRESQL__HOST: authentik-db
-      AUTHENTIK_POSTGRESQL__USER: authentik
-      AUTHENTIK_POSTGRESQL__NAME: authentik
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-changeme}
-      AUTHENTIK_ERROR_REPORTING__ENABLED: false
-    volumes:
-      - ./authentik/media:/media
-      - ./authentik/custom-templates:/templates
-    depends_on:
-      - authentik-db
-      - authentik-redis
-
-  authentik-outpost:
-    image: ghcr.io/goauthentik/proxy:2025.8.3
-    container_name: authentik-outpost
-    restart: unless-stopped
-    networks:
-      - backend
-      - frontend
-    environment:
-      AUTHENTIK_HOST: http://authentik-server:9000
-      AUTHENTIK_INSECURE: true
-      AUTHENTIK_TOKEN: ${AUTHENTIK_OUTPOST_TOKEN:-changeme}
-      AUTHENTIK_REDIS__HOST: authentik-redis
-      AUTHENTIK_REDIS__PORT: 6379
-    depends_on:
-      - authentik-server
-      - authentik-redis
-
-  # Secrets Management
-  vault:
-    image: hashicorp/vault:1.15
-    container_name: vault
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "8200:8200"
-    volumes:
-      - vault_data:/vault/data
-      - ./vault/config:/vault/config:ro
-    environment:
-      VAULT_DEV_ROOT_TOKEN_ID: ${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
-    command: vault server -dev -dev-listen-address=0.0.0.0:8200
-    cap_add:
-      - IPC_LOCK
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.vault.rule=Host(`vault.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.vault.entrypoints=websecure"
-      - "traefik.http.routers.vault.tls=true"
-      - "traefik.http.routers.vault.middlewares=authentik-forwardauth@file"
-      - "traefik.http.services.vault.loadbalancer.server.port=8200"
-
-  # Object Storage
-  minio:
-    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
-    container_name: minio
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "9092:9092"
-      - "9093:9093"
-    volumes:
-      - minio_data:/data
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minio}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-miniopass}
-      MINIO_BROWSER_REDIRECT_URL: https://minio.${DOMAIN:-local.lan}
-    command: server /data --address ":9092" --console-address ":9093"
-    healthcheck:
-      test: ["CMD", "mc", "--version"]
-      interval: 30s
-      timeout: 20s
-      retries: 3
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.minio-api.rule=Host(`minio-api.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.minio-api.entrypoints=websecure"
-      - "traefik.http.routers.minio-api.tls=true"
-      - "traefik.http.routers.minio-api.middlewares=authentik-forwardauth@file"
-      - "traefik.http.routers.minio-api.service=minio-api"
-      - "traefik.http.services.minio-api.loadbalancer.server.port=9092"
-      - "traefik.http.routers.minio-console.rule=Host(`minio.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.minio-console.entrypoints=websecure"
-      - "traefik.http.routers.minio-console.tls=true"
-      - "traefik.http.routers.minio-console.middlewares=authentik-forwardauth@file"
-      - "traefik.http.routers.minio-console.service=minio-console"
-      - "traefik.http.services.minio-console.loadbalancer.server.port=9093"
-
-  # Vector Database
-  qdrant:
-    image: qdrant/qdrant:v1.7.4
-    container_name: qdrant
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "6333:6333"
-      - "6334:6334"
-    volumes:
-      - qdrant_data:/qdrant/storage
-    environment:
-      QDRANT__SERVICE__GRPC_PORT: ${QDRANT__SERVICE__GRPC_PORT:-6334}
-      QDRANT__SERVICE__HTTP_PORT: 6333
-      QDRANT__LOG_LEVEL: INFO
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.qdrant.rule=Host(`qdrant.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.qdrant.entrypoints=websecure"
-      - "traefik.http.routers.qdrant.tls=true"
-      - "traefik.http.routers.qdrant.middlewares=authentik-forwardauth@file"
-      - "traefik.http.services.qdrant.loadbalancer.server.port=6333"
-
-  # Knowledge Graph Database
-  neo4j:
-    image: neo4j:5.15-community
-    container_name: neo4j
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "7474:7474"
-      - "7687:7687"
-    volumes:
-      - neo4j_data:/data
-      - neo4j_logs:/logs
-      - ./neo4j/plugins:/plugins
-    environment:
-      NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-neo4jpass}
-      NEO4J_PLUGINS: '["apoc", "graph-data-science"]'
-      NEO4J_dbms_security_procedures_unrestricted: gds.*,apoc.*
-      NEO4J_dbms_security_procedures_allowlist: gds.*,apoc.*
-      NEO4J_apoc_export_file_enabled: true
-      NEO4J_apoc_import_file_enabled: true
-      NEO4J_apoc_import_file_use__neo4j__config: true
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.neo4j.rule=Host(`neo4j.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.neo4j.entrypoints=websecure"
-      - "traefik.http.routers.neo4j.tls=true"
-      - "traefik.http.routers.neo4j.middlewares=authentik-forwardauth@file"
-      - "traefik.http.services.neo4j.loadbalancer.server.port=7474"
-
-  # Secure Client Data Store
-  postgres:
-    image: postgres:15-alpine
-    container_name: postgres
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "5432:5432"
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-      - ./postgres/init:/docker-entrypoint-initdb.d
-    environment:
-      POSTGRES_DB: tax_system
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
-      POSTGRES_INITDB_ARGS: "--auth-host=scram-sha-256"
-    command: >
-      postgres
-      -c shared_preload_libraries=pg_stat_statements
-      -c pg_stat_statements.track=all
-      -c max_connections=200
-      -c shared_buffers=256MB
-      -c effective_cache_size=1GB
-      -c maintenance_work_mem=64MB
-      -c checkpoint_completion_target=0.9
-      -c wal_buffers=16MB
-      -c default_statistics_target=100
-      -c random_page_cost=1.1
-      -c effective_io_concurrency=200
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  # Cache & Session Store
-  redis:
-    image: redis:7-alpine
-    container_name: redis
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "6379:6379"
-    volumes:
-      - redis_data:/data
-    command: >
-      redis-server
-      --appendonly yes
-      --appendfsync everysec
-      --maxmemory 512mb
-      --maxmemory-policy allkeys-lru
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  # Message Broker & Event Streaming
-  nats:
-    image: nats:2.10-alpine
-    container_name: nats
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "4222:4222" # NATS client connections
-      - "8222:8222" # HTTP monitoring
-      - "6222:6222" # Cluster routing (for future clustering)
-    volumes:
-      - nats_data:/data
-    command: >
-      --jetstream
-      --store_dir=/data
-      --http_port=8222
-    environment:
-      NATS_LOG_LEVEL: ${NATS_LOG_LEVEL:-info}
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "wget",
-          "--no-verbose",
-          "--tries=1",
-          "--spider",
-          "http://localhost:8222/healthz",
-        ]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.nats-monitor.rule=Host(`nats.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.nats-monitor.entrypoints=websecure"
-      - "traefik.http.routers.nats-monitor.tls=true"
-      - "traefik.http.routers.nats-monitor.middlewares=authentik-forwardauth@file"
-      - "traefik.http.services.nats-monitor.loadbalancer.server.port=8222"
-
-  # Monitoring & Observability
-  prometheus:
-    image: prom/prometheus:v2.48.1
-    container_name: prometheus
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "9090:9090"
-    volumes:
-      - prometheus_data:/prometheus
-    command:
-      - "--config.file=/etc/prometheus/prometheus.yml"
-      - "--storage.tsdb.path=/prometheus"
-      - "--web.console.libraries=/etc/prometheus/console_libraries"
-      - "--web.console.templates=/etc/prometheus/consoles"
-      - "--storage.tsdb.retention.time=30d"
-      - "--web.enable-lifecycle"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.prometheus.rule=Host(`prometheus.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.prometheus.entrypoints=websecure"
-      - "traefik.http.routers.prometheus.tls=true"
-      - "traefik.http.routers.prometheus.middlewares=authentik-forwardauth@file"
-      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
-
-  grafana:
-    image: grafana/grafana:10.2.3
-    container_name: grafana
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "3000:3000"
-    volumes:
-      - grafana_data:/var/lib/grafana
-      - ./grafana/provisioning:/etc/grafana/provisioning:ro
-      - ./grafana/dashboards:/var/lib/grafana/dashboards:ro
-    environment:
-      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-admin}
-      GF_USERS_ALLOW_SIGN_UP: false
-      GF_USERS_AUTO_ASSIGN_ORG: true
-      GF_USERS_AUTO_ASSIGN_ORG_ROLE: Viewer
-      GF_AUTH_GENERIC_OAUTH_ENABLED: true
-      GF_AUTH_GENERIC_OAUTH_NAME: Authentik
-      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ${GRAFANA_OAUTH_CLIENT_ID:-grafana}
-      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ${GRAFANA_OAUTH_CLIENT_SECRET:-changeme-grafana-secret}
-      GF_AUTH_GENERIC_OAUTH_SCOPES: openid profile email groups
-      GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://auth.${DOMAIN:-local.lan}/application/o/authorize/
-      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://auth.${DOMAIN:-local.lan}/application/o/token/
-      GF_AUTH_GENERIC_OAUTH_API_URL: https://auth.${DOMAIN:-local.lan}/application/o/userinfo/
-      GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN: false
-      GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: true
-      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: role
-      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_STRICT: false
-      GF_AUTH_GENERIC_OAUTH_GROUPS_ATTRIBUTE_PATH: groups
-      GF_AUTH_OAUTH_AUTO_LOGIN: false
-      GF_AUTH_DISABLE_LOGIN_FORM: false
-      # Cookie and security settings
-      GF_SERVER_ROOT_URL: https://grafana.${DOMAIN:-local.lan}
-      GF_SERVER_SERVE_FROM_SUB_PATH: false
-      GF_SECURITY_COOKIE_SECURE: false
-      GF_SECURITY_COOKIE_SAMESITE: lax
-      GF_AUTH_GENERIC_OAUTH_USE_PKCE: true
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.grafana.rule=Host(`grafana.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.grafana.entrypoints=websecure"
-      - "traefik.http.routers.grafana.tls=true"
-      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
-
-  loki:
-    image: grafana/loki:2.9.4
-    container_name: loki
-    restart: unless-stopped
-    networks:
-      - backend
-    ports:
-      - "3100:3100"
-    volumes:
-      - loki_data:/loki
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.loki.rule=Host(`loki.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.loki.entrypoints=websecure"
-      - "traefik.http.routers.loki.tls=true"
-      - "traefik.http.routers.loki.middlewares=authentik-forwardauth@file"
-      - "traefik.http.services.loki.loadbalancer.server.port=3100"
-
-  # Feature Flags
-  unleash:
-    image: unleashorg/unleash-server:5.7.3
-    container_name: unleash
-    restart: unless-stopped
-    networks:
-      - frontend
-      - backend
-    ports:
-      - "4242:4242"
-    environment:
-      DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/unleash
-      DATABASE_SSL: false
-      LOG_LEVEL: info
-    depends_on:
-      - postgres
-    labels:
-      - "traefik.docker.network=ai-tax-agent-frontend"
-      - "traefik.enable=true"
-      - "traefik.http.routers.unleash.rule=Host(`unleash.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.unleash.entrypoints=websecure"
-      - "traefik.http.routers.unleash.tls=true"
-      - "traefik.http.routers.unleash.middlewares=authentik-forwardauth@file"
-      - "traefik.http.services.unleash.loadbalancer.server.port=4242"
-
-  # Application Services
-  svc-ingestion:
-    build:
-      context: ../../
-      dockerfile: apps/svc_ingestion/Dockerfile
-    container_name: svc-ingestion
-    restart: unless-stopped
-    networks:
-      - backend
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - MINIO_ENDPOINT=minio:9092
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - REDIS_URL=redis://redis:6379
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - vault
-      - minio
-      - postgres
-      - redis
-      - nats
-      - neo4j
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-ingestion.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/ingestion`)"
-      - "traefik.http.routers.svc-ingestion.entrypoints=websecure"
-      - "traefik.http.routers.svc-ingestion.tls=true"
-      - "traefik.http.routers.svc-ingestion.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-ingestion.loadbalancer.server.port=8000"
-
-  svc-extract:
-    build:
-      context: ../../
-      dockerfile: apps/svc_extract/Dockerfile
-    container_name: svc-extract
-    restart: unless-stopped
-    networks:
-      - backend
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - MINIO_ENDPOINT=minio:9092
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - RAG_EMBEDDING_MODEL=${RAG_EMBEDDING_MODEL:-bge-small-en-v1.5}
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - vault
-      - minio
-      - postgres
-      - nats
-      - neo4j
-      - redis
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-extract.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/extract`)"
-      - "traefik.http.routers.svc-extract.entrypoints=websecure"
-      - "traefik.http.routers.svc-extract.tls=true"
-      - "traefik.http.routers.svc-extract.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-extract.loadbalancer.server.port=8000"
-
-  svc-kg:
-    build:
-      context: ../../
-      dockerfile: apps/svc_kg/Dockerfile
-    container_name: svc-kg
-    restart: unless-stopped
-    networks:
-      - backend
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - NEO4J_URI=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-neo4jpass}
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - vault
-      - neo4j
-      - nats
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-kg.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/kg`)"
-      - "traefik.http.routers.svc-kg.entrypoints=websecure"
-      - "traefik.http.routers.svc-kg.tls=true"
-      - "traefik.http.routers.svc-kg.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-kg.loadbalancer.server.port=8000"
-
-  svc-rag-retriever:
-    build:
-      context: ../../
-      dockerfile: apps/svc_rag_retriever/Dockerfile
-    container_name: svc-rag-retriever
-    restart: unless-stopped
-    networks:
-      - backend
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - QDRANT_URL=http://qdrant:6333
-      - NEO4J_URI=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-neo4jpass}
-      - RAG_EMBEDDING_MODEL=${RAG_EMBEDDING_MODEL:-bge-small-en-v1.5}
-      - RAG_RERANKER_MODEL=${RAG_RERANKER_MODEL:-cross-encoder/ms-marco-MiniLM-L-6-v2}
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - vault
-      - qdrant
-      - neo4j
-      - nats
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-rag-retriever.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/rag`)"
-      - "traefik.http.routers.svc-rag-retriever.entrypoints=websecure"
-      - "traefik.http.routers.svc-rag-retriever.tls=true"
-      - "traefik.http.routers.svc-rag-retriever.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-rag-retriever.loadbalancer.server.port=8000"
-
-  svc-coverage:
-    build:
-      context: ../../
-      dockerfile: apps/svc_coverage/Dockerfile
-    container_name: svc-coverage
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - ../../config:/app/config:ro
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - NEO4J_URI=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-neo4jpass}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - RAG_SERVICE_URL=http://svc-rag-retriever:8000
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - vault
-      - neo4j
-      - postgres
-      - nats
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-coverage.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/coverage`)"
-      - "traefik.http.routers.svc-coverage.entrypoints=websecure"
-      - "traefik.http.routers.svc-coverage.tls=true"
-      - "traefik.http.routers.svc-coverage.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-coverage.loadbalancer.server.port=8000"
-
-  svc-firm-connectors:
-    build:
-      context: ../../
-      dockerfile: apps/svc_firm_connectors/Dockerfile
-    container_name: svc-firm-connectors
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - ../../config:/app/config:ro
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
-      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
-      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-firm-connectors.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/firm-connectors`)"
-      - "traefik.http.routers.svc-firm-connectors.entrypoints=websecure"
-      - "traefik.http.routers.svc-firm-connectors.tls=true"
-      - "traefik.http.routers.svc-firm-connectors.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-firm-connectors.loadbalancer.server.port=8000"
-
-  svc-forms:
-    build:
-      context: ../../
-      dockerfile: apps/svc_forms/Dockerfile
-    container_name: svc-forms
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - ../../config:/app/config:ro
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
-      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
-      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-forms.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/forms`)"
-      - "traefik.http.routers.svc-forms.entrypoints=websecure"
-      - "traefik.http.routers.svc-forms.tls=true"
-      - "traefik.http.routers.svc-forms.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-forms.loadbalancer.server.port=8000"
-
-  svc-hmrc:
-    build:
-      context: ../../
-      dockerfile: apps/svc_hmrc/Dockerfile
-    container_name: svc-hmrc
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - ../../config:/app/config:ro
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
-      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
-      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-hmrc.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/hmrc`)"
-      - "traefik.http.routers.svc-hmrc.entrypoints=websecure"
-      - "traefik.http.routers.svc-hmrc.tls=true"
-      - "traefik.http.routers.svc-hmrc.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-hmrc.loadbalancer.server.port=8000"
-
-  svc-normalize-map:
-    build:
-      context: ../../
-      dockerfile: apps/svc_normalize_map/Dockerfile
-    container_name: svc-normalize-map
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - ../../config:/app/config:ro
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
-      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
-      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-normalize-map.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/normalize-map`)"
-      - "traefik.http.routers.svc-normalize-map.entrypoints=websecure"
-      - "traefik.http.routers.svc-normalize-map.tls=true"
-      - "traefik.http.routers.svc-normalize-map.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-normalize-map.loadbalancer.server.port=8000"
-
-  svc-ocr:
-    build:
-      context: ../../
-      dockerfile: apps/svc_ocr/Dockerfile
-    container_name: svc-ocr
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - ../../config:/app/config:ro
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
-      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
-      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-ocr.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/ocr`)"
-      - "traefik.http.routers.svc-ocr.entrypoints=websecure"
-      - "traefik.http.routers.svc-ocr.tls=true"
-      - "traefik.http.routers.svc-ocr.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-ocr.loadbalancer.server.port=8000"
-
-  svc-rag-indexer:
-    build:
-      context: ../../
-      dockerfile: apps/svc_rag_indexer/Dockerfile
-    container_name: svc-rag-indexer
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - ../../config:/app/config:ro
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
-      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
-      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-rag-indexer.rule=Host(`api.${DOMAIN:-.lan}`) && PathPrefix(`/rag-indexer`)"
-      - "traefik.http.routers.svc-rag-indexer.entrypoints=websecure"
-      - "traefik.http.routers.svc-rag-indexer.tls=true"
-      - "traefik.http.routers.svc-rag-indexer.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-rag-indexer.loadbalancer.server.port=8000"
-
-  svc-reason:
-    build:
-      context: ../../
-      dockerfile: apps/svc_reason/Dockerfile
-    container_name: svc-reason
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - ../../config:/app/config:ro
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
-      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
-      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-
-    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
-
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-reason.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/reason`)"
-      - "traefik.http.routers.svc-reason.entrypoints=websecure"
-      - "traefik.http.routers.svc-reason.tls=true"
-      - "traefik.http.routers.svc-reason.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-reason.loadbalancer.server.port=8000"
-
-  svc-rpa:
-    build:
-      context: ../../
-      dockerfile: apps/svc_rpa/Dockerfile
-    container_name: svc-rpa
-    restart: unless-stopped
-    networks:
-      - backend
-    volumes:
-      - ../../config:/app/config:ro
-    environment:
-      - VAULT_ADDR=http://vault:8200
-      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
-      - NEO4J_USER=neo4j
-      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
-      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
-      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
-      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
-      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
-      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
-    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.svc-rpa.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/rpa`)"
-      - "traefik.http.routers.svc-rpa.entrypoints=websecure"
-      - "traefik.http.routers.svc-rpa.tls=true"
-      - "traefik.http.routers.svc-rpa.middlewares=authentik-forwardauth@file,rate-limit@file"
-      - "traefik.http.services.svc-rpa.loadbalancer.server.port=8000"
-
-  ui-review:
-    build:
-      context: ../../ui-review
-      dockerfile: Dockerfile
-    container_name: ui-review
-    restart: unless-stopped
-    networks:
-      - frontend
-    environment:
-      - NEXTAUTH_URL=https://review.${DOMAIN:-local.lan}
-      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET:-changeme}
-      - API_BASE_URL=https://api.${DOMAIN:-local.lan}
-    depends_on:
-      - traefik
-    labels:
-      - "traefik.docker.network=ai-tax-agent-frontend"
-      - "traefik.enable=true"
-      - "traefik.http.routers.ui-review.rule=Host(`review.${DOMAIN:-local.lan}`)"
-      - "traefik.http.routers.ui-review.entrypoints=websecure"
-      - "traefik.http.routers.ui-review.tls=true"
-      - "traefik.http.routers.ui-review.middlewares=authentik-forwardauth@file"
-      - "traefik.http.services.ui-review.loadbalancer.server.port=3030"
--- a/infra/compose/docker-compose.local.yml
+++ b/infra/compose/docker-compose.local.yml
@@ -27,9 +27,9 @@ volumes:
 services:
  # Edge Gateway & Load Balancer

-  traefik:
+  aia-traefik:
    image: docker.io/library/traefik:v3.5.1
-    container_name: traefik
+    container_name: aia-traefik
    ports:
      - 80:80
      - 443:443
@@ -49,9 +49,9 @@ services:
    restart: unless-stopped

  # Identity & SSO
-  authentik-db:
+  aia-authentik-db:
    image: postgres:15-alpine
-    container_name: authentik-db
+    container_name: aia-authentik-db
    restart: unless-stopped
    networks:
      - backend
@@ -67,9 +67,9 @@ services:
      timeout: 10s
      retries: 3

-  authentik-redis:
+  aia-authentik-redis:
    image: redis:7-alpine
-    container_name: authentik-redis
+    container_name: aia-authentik-redis
    restart: unless-stopped
    networks:
      - backend
@@ -80,17 +80,17 @@ services:
      timeout: 10s
      retries: 3

-  authentik-server:
+  aia-authentik-server:
    image: ghcr.io/goauthentik/server:2025.8.3
-    container_name: authentik-server
+    container_name: aia-authentik-server
    restart: unless-stopped
    networks:
      - backend
      - frontend
    command: server
    environment:
-      AUTHENTIK_REDIS__HOST: authentik-redis
-      AUTHENTIK_POSTGRESQL__HOST: authentik-db
+      AUTHENTIK_REDIS__HOST: aia-authentik-redis
+      AUTHENTIK_POSTGRESQL__HOST: aia-authentik-db
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD:-authentik}
@@ -105,8 +105,8 @@ services:
      - ../authentik/custom-templates:/templates
      - ../authentik/bootstrap.yaml:/blueprints/bootstrap.yaml
    depends_on:
-      - authentik-db
-      - authentik-redis
+      - aia-authentik-db
+      - aia-authentik-redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.authentik.rule=Host(`auth.${DOMAIN:-local.lan}`)"
@@ -115,16 +115,16 @@ services:
      - "traefik.docker.network=ai-tax-agent-frontend"
      - "traefik.http.services.authentik.loadbalancer.server.port=9000"

-  authentik-worker:
+  aia-authentik-worker:
    image: ghcr.io/goauthentik/server:2025.8.3
-    container_name: authentik-worker
+    container_name: aia-authentik-worker
    restart: unless-stopped
    networks:
      - backend
    command: worker
    environment:
-      AUTHENTIK_REDIS__HOST: authentik-redis
-      AUTHENTIK_POSTGRESQL__HOST: authentik-db
+      AUTHENTIK_REDIS__HOST: aia-authentik-redis
+      AUTHENTIK_POSTGRESQL__HOST: aia-authentik-db
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD:-authentik}
@@ -134,30 +134,30 @@ services:
      - ../authentik/media:/media
      - ../authentik/custom-templates:/templates
    depends_on:
-      - authentik-db
-      - authentik-redis
+      - aia-authentik-db
+      - aia-authentik-redis

-  authentik-outpost:
+  aia-authentik-outpost:
    image: ghcr.io/goauthentik/proxy:2025.8.3
-    container_name: authentik-outpost
+    container_name: aia-authentik-outpost
    restart: unless-stopped
    networks:
      - backend
      - frontend
    environment:
-      AUTHENTIK_HOST: http://authentik-server:9000
+      AUTHENTIK_HOST: http://aia-authentik-server:9000
      AUTHENTIK_INSECURE: true
      AUTHENTIK_TOKEN: ${AUTHENTIK_OUTPOST_TOKEN:-changeme}
-      AUTHENTIK_REDIS__HOST: authentik-redis
+      AUTHENTIK_REDIS__HOST: aia-authentik-redis
      AUTHENTIK_REDIS__PORT: 6379
    depends_on:
-      - authentik-server
-      - authentik-redis
+      - aia-authentik-server
+      - aia-authentik-redis

  # Secrets Management
-  vault:
+  aia-vault:
    image: hashicorp/vault:1.15
-    container_name: vault
+    container_name: aia-vault
    restart: unless-stopped
    networks:
      - backend
@@ -181,9 +181,9 @@ services:
      - "traefik.http.services.vault.loadbalancer.server.port=8200"

  # Object Storage
-  minio:
+  aia-minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
-    container_name: minio
+    container_name: aia-minio
    restart: unless-stopped
    networks:
      - backend
@@ -218,9 +218,9 @@ services:
      - "traefik.http.services.minio-console.loadbalancer.server.port=9093"

  # Vector Database
-  qdrant:
+  aia-qdrant:
    image: qdrant/qdrant:v1.7.4
-    container_name: qdrant
+    container_name: aia-qdrant
    restart: unless-stopped
    networks:
      - backend
@@ -242,9 +242,9 @@ services:
      - "traefik.http.services.qdrant.loadbalancer.server.port=6333"

  # Knowledge Graph Database
-  neo4j:
+  aia-neo4j:
    image: neo4j:5.15-community
-    container_name: neo4j
+    container_name: aia-neo4j
    restart: unless-stopped
    networks:
      - backend
@@ -257,7 +257,7 @@ services:
      - ../neo4j/plugins:/plugins
    environment:
      NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-neo4jpass}
-      NEO4J_PLUGINS: '["apoc", "graph-data-science"]'
+      NEO4J_PLUGINS: '["apoc", "graph-daia-science"]'
      NEO4J_dbms_security_procedures_unrestricted: gds.*,apoc.*
      NEO4J_dbms_security_procedures_allowlist: gds.*,apoc.*
      NEO4J_apoc_export_file_enabled: true
@@ -272,9 +272,9 @@ services:
      - "traefik.http.services.neo4j.loadbalancer.server.port=7474"

  # Secure Client Data Store
-  postgres:
+  aia-postgres:
    image: postgres:15-alpine
-    container_name: postgres
+    container_name: aia-postgres
    restart: unless-stopped
    networks:
      - backend
@@ -308,9 +308,9 @@ services:
      retries: 3

  # Cache & Session Store
-  redis:
+  aia-redis:
    image: redis:7-alpine
-    container_name: redis
+    container_name: aia-redis
    restart: unless-stopped
    networks:
      - backend
@@ -331,9 +331,9 @@ services:
      retries: 3

  # Message Broker & Event Streaming
-  nats:
+  aia-nats:
    image: nats:2.10-alpine
-    container_name: nats
+    container_name: aia-nats
    restart: unless-stopped
    networks:
      - backend
@@ -371,9 +371,9 @@ services:
      - "traefik.http.services.nats-monitor.loadbalancer.server.port=8222"

  # Monitoring & Observability
-  prometheus:
+  aia-prometheus:
    image: prom/prometheus:v2.48.1
-    container_name: prometheus
+    container_name: aia-prometheus
    restart: unless-stopped
    networks:
      - backend
@@ -396,9 +396,9 @@ services:
      - "traefik.http.routers.prometheus.middlewares=authentik-forwardauth@file"
      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"

-  grafana:
+  aia-grafana:
    image: grafana/grafana:10.2.3
-    container_name: grafana
+    container_name: aia-grafana
    restart: unless-stopped
    networks:
      - backend
@@ -441,9 +441,9 @@ services:
      - "traefik.http.routers.grafana.tls=true"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"

-  loki:
+  aia-loki:
    image: grafana/loki:2.9.4
-    container_name: loki
+    container_name: aia-loki
    restart: unless-stopped
    networks:
      - backend
@@ -460,9 +460,9 @@ services:
      - "traefik.http.services.loki.loadbalancer.server.port=3100"

  # Feature Flags
-  unleash:
+  aia-unleash:
    image: unleashorg/unleash-server:5.7.3
-    container_name: unleash
+    container_name: aia-unleash
    restart: unless-stopped
    networks:
      - frontend
@@ -470,11 +470,11 @@ services:
    ports:
      - "4242:4242"
    environment:
-      DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/unleash
+      DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/unleash
      DATABASE_SSL: false
      LOG_LEVEL: info
    depends_on:
-      - postgres
+      - aia-postgres
    labels:
      - "traefik.docker.network=ai-tax-agent-frontend"
      - "traefik.enable=true"
@@ -485,31 +485,31 @@ services:
      - "traefik.http.services.unleash.loadbalancer.server.port=4242"

  # Application Services
-  svc-ingestion:
+  aia-svc-ingestion:
    build:
      context: ../../
      dockerfile: apps/svc_ingestion/Dockerfile
-    container_name: svc-ingestion
+    container_name: aia-svc-ingestion
    restart: unless-stopped
    networks:
      - backend
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - MINIO_ENDPOINT=minio:9092
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - REDIS_URL=redis://redis:6379
+      - MINIO_ENDPOINT=aia-minio:9092
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - REDIS_URL=redis://aia-redis:6379
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - vault
-      - minio
-      - postgres
-      - redis
-      - nats
-      - neo4j
+      - aia-vault
+      - aia-minio
+      - aia-postgres
+      - aia-redis
+      - aia-nats
+      - aia-neo4j
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-ingestion.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/ingestion`)"
@@ -518,31 +518,31 @@ services:
      - "traefik.http.routers.svc-ingestion.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-ingestion.loadbalancer.server.port=8000"

-  svc-extract:
+  aia-svc-extract:
    build:
      context: ../../
      dockerfile: apps/svc_extract/Dockerfile
-    container_name: svc-extract
+    container_name: aia-svc-extract
    restart: unless-stopped
    networks:
      - backend
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - MINIO_ENDPOINT=minio:9092
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
+      - MINIO_ENDPOINT=aia-minio:9092
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
      - RAG_EMBEDDING_MODEL=${RAG_EMBEDDING_MODEL:-bge-small-en-v1.5}
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - vault
-      - minio
-      - postgres
-      - nats
-      - neo4j
-      - redis
+      - aia-vault
+      - aia-minio
+      - aia-postgres
+      - aia-nats
+      - aia-neo4j
+      - aia-redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-extract.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/extract`)"
@@ -551,28 +551,28 @@ services:
      - "traefik.http.routers.svc-extract.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-extract.loadbalancer.server.port=8000"

-  svc-kg:
+  aia-svc-kg:
    build:
      context: ../../
      dockerfile: apps/svc_kg/Dockerfile
-    container_name: svc-kg
+    container_name: aia-svc-kg
    restart: unless-stopped
    networks:
      - backend
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - NEO4J_URI=bolt://neo4j:7687
+      - NEO4J_URI=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-neo4jpass}
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - vault
-      - neo4j
-      - nats
+      - aia-vault
+      - aia-neo4j
+      - aia-nats
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-kg.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/kg`)"
@@ -581,32 +581,32 @@ services:
      - "traefik.http.routers.svc-kg.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-kg.loadbalancer.server.port=8000"

-  svc-rag-retriever:
+  aia-svc-rag-retriever:
    build:
      context: ../../
      dockerfile: apps/svc_rag_retriever/Dockerfile
-    container_name: svc-rag-retriever
+    container_name: aia-svc-rag-retriever
    restart: unless-stopped
    networks:
      - backend
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - QDRANT_URL=http://qdrant:6333
-      - NEO4J_URI=bolt://neo4j:7687
+      - QDRANT_URL=http://aia-qdrant:6333
+      - NEO4J_URI=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-neo4jpass}
      - RAG_EMBEDDING_MODEL=${RAG_EMBEDDING_MODEL:-bge-small-en-v1.5}
      - RAG_RERANKER_MODEL=${RAG_RERANKER_MODEL:-cross-encoder/ms-marco-MiniLM-L-6-v2}
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - vault
-      - qdrant
-      - neo4j
-      - nats
+      - aia-vault
+      - aia-qdrant
+      - aia-neo4j
+      - aia-nats
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-rag-retriever.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/rag`)"
@@ -615,33 +615,33 @@ services:
      - "traefik.http.routers.svc-rag-retriever.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-rag-retriever.loadbalancer.server.port=8000"

-  svc-coverage:
+  aia-svc-coverage:
    build:
      context: ../../
      dockerfile: apps/svc_coverage/Dockerfile
-    container_name: svc-coverage
+    container_name: aia-svc-coverage
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ../../config:/app/config:ro
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - NEO4J_URI=bolt://neo4j:7687
+      - NEO4J_URI=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-neo4jpass}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - RAG_SERVICE_URL=http://svc-rag-retriever:8000
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - RAG_SERVICE_URL=http://aia-svc-rag-retriever:8000
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - vault
-      - neo4j
-      - postgres
-      - nats
+      - aia-vault
+      - aia-neo4j
+      - aia-postgres
+      - aia-nats
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-coverage.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/coverage`)"
@@ -650,40 +650,40 @@ services:
      - "traefik.http.routers.svc-coverage.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-coverage.loadbalancer.server.port=8000"

-  svc-firm-connectors:
+  aia-svc-firm-connectors:
    build:
      context: ../../
      dockerfile: apps/svc_firm_connectors/Dockerfile
-    container_name: svc-firm-connectors
+    container_name: aia-svc-firm-connectors
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ../../config:/app/config:ro
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - NEO4J_URL=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
+      - REDIS_URL=redis://aia-redis:6379
+      - MINIO_ENDPOINT=aia-minio:9092
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
+      - QDRANT_URL=http://aia-qdrant:6333
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
+      - aia-postgres
+      - aia-neo4j
+      - aia-minio
+      - aia-qdrant
+      - aia-nats
+      - aia-traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-firm-connectors.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/firm-connectors`)"
@@ -692,40 +692,40 @@ services:
      - "traefik.http.routers.svc-firm-connectors.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-firm-connectors.loadbalancer.server.port=8000"

-  svc-forms:
+  aia-svc-forms:
    build:
      context: ../../
      dockerfile: apps/svc_forms/Dockerfile
-    container_name: svc-forms
+    container_name: aia-svc-forms
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ../../config:/app/config:ro
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - NEO4J_URL=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
+      - REDIS_URL=redis://aia-redis:6379
+      - MINIO_ENDPOINT=aia-minio:9092
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
+      - QDRANT_URL=http://aia-qdrant:6333
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
+      - aia-postgres
+      - aia-neo4j
+      - aia-minio
+      - aia-qdrant
+      - aia-nats
+      - aia-traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-forms.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/forms`)"
@@ -734,40 +734,40 @@ services:
      - "traefik.http.routers.svc-forms.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-forms.loadbalancer.server.port=8000"

-  svc-hmrc:
+  aia-svc-hmrc:
    build:
      context: ../../
      dockerfile: apps/svc_hmrc/Dockerfile
-    container_name: svc-hmrc
+    container_name: aia-svc-hmrc
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ../../config:/app/config:ro
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - NEO4J_URL=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
+      - REDIS_URL=redis://aia-redis:6379
+      - MINIO_ENDPOINT=aia-minio:9092
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
+      - QDRANT_URL=http://aia-qdrant:6333
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
+      - aia-postgres
+      - aia-neo4j
+      - aia-minio
+      - aia-qdrant
+      - aia-nats
+      - aia-traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-hmrc.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/hmrc`)"
@@ -776,40 +776,40 @@ services:
      - "traefik.http.routers.svc-hmrc.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-hmrc.loadbalancer.server.port=8000"

-  svc-normalize-map:
+  aia-svc-normalize-map:
    build:
      context: ../../
      dockerfile: apps/svc_normalize_map/Dockerfile
-    container_name: svc-normalize-map
+    container_name: aia-svc-normalize-map
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ../../config:/app/config:ro
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - NEO4J_URL=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
+      - REDIS_URL=redis://aia-redis:6379
+      - MINIO_ENDPOINT=aia-minio:9092
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
+      - QDRANT_URL=http://aia-qdrant:6333
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
+      - aia-postgres
+      - aia-neo4j
+      - aia-minio
+      - aia-qdrant
+      - aia-nats
+      - aia-traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-normalize-map.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/normalize-map`)"
@@ -818,40 +818,40 @@ services:
      - "traefik.http.routers.svc-normalize-map.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-normalize-map.loadbalancer.server.port=8000"

-  svc-ocr:
+  aia-svc-ocr:
    build:
      context: ../../
      dockerfile: apps/svc_ocr/Dockerfile
-    container_name: svc-ocr
+    container_name: aia-svc-ocr
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ../../config:/app/config:ro
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - NEO4J_URL=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
+      - REDIS_URL=redis://aia-redis:6379
+      - MINIO_ENDPOINT=aia-minio:9092
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
+      - QDRANT_URL=http://aia-qdrant:6333
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
+      - aia-postgres
+      - aia-neo4j
+      - aia-minio
+      - aia-qdrant
+      - aia-nats
+      - aia-traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-ocr.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/ocr`)"
@@ -860,40 +860,40 @@ services:
      - "traefik.http.routers.svc-ocr.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-ocr.loadbalancer.server.port=8000"

-  svc-rag-indexer:
+  aia-svc-rag-indexer:
    build:
      context: ../../
      dockerfile: apps/svc_rag_indexer/Dockerfile
-    container_name: svc-rag-indexer
+    container_name: aia-svc-rag-indexer
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ../../config:/app/config:ro
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - NEO4J_URL=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
+      - REDIS_URL=redis://aia-redis:6379
+      - MINIO_ENDPOINT=aia-minio:9092
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
+      - QDRANT_URL=http://aia-qdrant:6333
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
+      - aia-postgres
+      - aia-neo4j
+      - aia-minio
+      - aia-qdrant
+      - aia-nats
+      - aia-traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-rag-indexer.rule=Host(`api.${DOMAIN:-.lan}`) && PathPrefix(`/rag-indexer`)"
@@ -902,41 +902,41 @@ services:
      - "traefik.http.routers.svc-rag-indexer.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-rag-indexer.loadbalancer.server.port=8000"

-  svc-reason:
+  aia-svc-reason:
    build:
      context: ../../
      dockerfile: apps/svc_reason/Dockerfile
-    container_name: svc-reason
+    container_name: aia-svc-reason
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ../../config:/app/config:ro
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - NEO4J_URL=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
+      - REDIS_URL=redis://aia-redis:6379
+      - MINIO_ENDPOINT=aia-minio:9092
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
+      - QDRANT_URL=http://aia-qdrant:6333
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}

    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
+      - aia-postgres
+      - aia-neo4j
+      - aia-minio
+      - aia-qdrant
+      - aia-nats
+      - aia-traefik

    labels:
      - "traefik.enable=true"
@@ -946,40 +946,40 @@ services:
      - "traefik.http.routers.svc-reason.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-reason.loadbalancer.server.port=8000"

-  svc-rpa:
+  aia-svc-rpa:
    build:
      context: ../../
      dockerfile: apps/svc_rpa/Dockerfile
-    container_name: svc-rpa
+    container_name: aia-svc-rpa
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ../../config:/app/config:ro
    environment:
-      - VAULT_ADDR=http://vault:8200
+      - VAULT_ADDR=http://aia-vault:8200
      - VAULT_TOKEN=${VAULT_DEV_ROOT_TOKEN_ID:-root}
-      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/tax_system
-      - NEO4J_URL=bolt://neo4j:7687
+      - POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD:-postgres}@aia-postgres:5432/tax_system
+      - NEO4J_URL=bolt://aia-neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
-      - REDIS_URL=redis://redis:6379
-      - MINIO_ENDPOINT=minio:9092
+      - REDIS_URL=redis://aia-redis:6379
+      - MINIO_ENDPOINT=aia-minio:9092
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
-      - QDRANT_URL=http://qdrant:6333
+      - QDRANT_URL=http://aia-qdrant:6333
      - EVENT_BUS_TYPE=${EVENT_BUS_TYPE:-memory}
      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS:-}
-      - NATS_SERVERS=${NATS_SERVERS:-nats://nats:4222}
+      - NATS_SERVERS=${NATS_SERVERS:-nats://aia-nats:4222}
      - NATS_STREAM_NAME=${NATS_STREAM_NAME:-TAX_AGENT_EVENTS}
      - NATS_CONSUMER_GROUP=${NATS_CONSUMER_GROUP:-tax-agent}
    depends_on:
-      - postgres
-      - neo4j
-      - minio
-      - qdrant
-      - nats
-      - traefik
+      - aia-postgres
+      - aia-neo4j
+      - aia-minio
+      - aia-qdrant
+      - aia-nats
+      - aia-traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.svc-rpa.rule=Host(`api.${DOMAIN:-local.lan}`) && PathPrefix(`/rpa`)"
@@ -988,11 +988,11 @@ services:
      - "traefik.http.routers.svc-rpa.middlewares=authentik-forwardauth@file,rate-limit@file"
      - "traefik.http.services.svc-rpa.loadbalancer.server.port=8000"

-  ui-review:
+  aia-ui-review:
    build:
      context: ../../ui-review
      dockerfile: Dockerfile
-    container_name: ui-review
+    container_name: aia-ui-review
    restart: unless-stopped
    networks:
      - frontend
@@ -1001,7 +1001,7 @@ services:
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET:-changeme}
      - API_BASE_URL=https://api.${DOMAIN:-local.lan}
    depends_on:
-      - traefik
+      - aia-traefik
    labels:
      - "traefik.docker.network=ai-tax-agent-frontend"
      - "traefik.enable=true"
--- a/infra/compose/gitea/compose.yaml
+++ b/infra/compose/gitea/compose.yaml
@@ -1,63 +0,0 @@
---
-services:
-  gitea-server:
-    image: docker.io/gitea/gitea:1.24.5
-    container_name: gitea-server
-    env_file:
-      - ./.env # contains the GoDaddy API Key and Secret
-    environment:
-      - USER_UID=1000
-      - USER_GID=1000
-      - GITEA__database__DB_TYPE=postgres
-      - GITEA__database__HOST=${POSTGRES_HOST:-gitea-postgres}:${POSTGRES_PORT:-5432}
-      - GITEA__database__NAME=${POSTGRES_DB:-gitea}
-      - GITEA__database__USER=${POSTGRES_USER:-gitea}
-      - GITEA__database__PASSWD=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD not set}
-      - GITEA__server__SSH_PORT=2221 # <-- (Optional) Replace with your desired SSH port
-      - GITEA__server__ROOT_URL=https://gitea.harkon.co.uk # <-- Replace with your FQDN
-    networks:
-      - frontend
-      - backend
-    volumes:
-      - gitea-data:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    ports:
-      - "2221:22" # <-- (Optional) Replace with your desired SSH port
-    depends_on:
-      - gitea-postgres
-    labels:
-      - traefik.enable=true
-      - traefik.http.services.gitea.loadbalancer.server.port=3000
-      - traefik.http.services.gitea.loadbalancer.server.scheme=http
-      - traefik.http.routers.gitea-https.entrypoints=websecure
-      - traefik.http.routers.gitea-https.rule=Host(`gitea.harkon.co.uk`) # <-- Replace with your FQDN
-      - traefik.http.routers.gitea-https.tls=true
-      - traefik.http.routers.gitea-https.tls.certresolver=godaddy # <-- Replace with your certresolver
-      - traefik.http.routers.gitea.service=gitea
-    restart: unless-stopped
-
-  gitea-postgres:
-    image: docker.io/library/postgres:17.5
-    container_name: gitea-postgres
-    environment:
-      - POSTGRES_USER=${POSTGRES_USER:-gitea}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD not set}
-      - POSTGRES_DB=${POSTGRES_DB:-gitea}
-    networks:
-      - backend
-    volumes:
-      - gitea-db:/var/lib/postgresql/data
-    restart: unless-stopped
-
-volumes:
-  gitea-data:
-    driver: local
-  gitea-db:
-    driver: local
-
-networks:
-  frontend:
-    external: true
-  backend:
-    external: true
--- a/infra/compose/nextcloud/compose.yaml
+++ b/infra/compose/nextcloud/compose.yaml
@@ -1,104 +0,0 @@
-# /opt/compose/nextcloud/compose.yml
-networks:
-  frontend:
-    external: true
-  backend:
-    external: true
-
-volumes:
-  nextcloud_html:
-  nextcloud_data:
-  nextcloud_config:
-  nextcloud_apps:
-  nextcloud_postgres:
-  nextcloud_redis:
-
-services:
-  nextcloud-postgres:
-    image: postgres:16-alpine
-    container_name: nextcloud-postgres
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: nextcloud
-      POSTGRES_USER: nextcloud
-      POSTGRES_PASSWORD: ${NEXTCLOUD_DB_PASSWORD}
-    volumes:
-      - nextcloud_postgres:/var/lib/postgresql/data
-    networks: [backend]
-
-  nextcloud-redis:
-    image: redis:7-alpine
-    container_name: nextcloud-redis
-    restart: unless-stopped
-    command:
-      [
-        "redis-server",
-        "--appendonly",
-        "yes",
-        "--requirepass",
-        "${REDIS_PASSWORD}",
-      ]
-    volumes:
-      - nextcloud_redis:/data
-    networks: [backend]
-
-  nextcloud-server:
-    image: nextcloud:apache
-    container_name: nextcloud-server
-    restart: unless-stopped
-    depends_on: [nextcloud-postgres, nextcloud-redis]
-    env_file:
-      - ./.env
-    environment:
-      # DB
-      POSTGRES_DB: nextcloud
-      POSTGRES_USER: nextcloud
-      POSTGRES_PASSWORD: ${NEXTCLOUD_DB_PASSWORD}
-      POSTGRES_HOST: nextcloud-postgres
-      # Initial admin (used only on first run)
-      NEXTCLOUD_ADMIN_USER: ${NEXTCLOUD_ADMIN_USER}
-      NEXTCLOUD_ADMIN_PASSWORD: ${NEXTCLOUD_ADMIN_PASSWORD}
-      # Reverse frontend awareness
-      NEXTCLOUD_TRUSTED_DOMAINS: cloud.harkon.co.uk
-      OVERWRITEHOST: cloud.harkon.co.uk
-      OVERWRITEPROTOCOL: https
-      # Redis for locks/cache
-      REDIS_HOST: nextcloud-redis
-      REDIS_HOST_PASSWORD: ${REDIS_PASSWORD}
-    volumes:
-      - nextcloud_html:/var/www/html
-      - nextcloud_data:/var/www/html/data
-      - nextcloud_config:/var/www/html/config
-      - nextcloud_apps:/var/www/html/custom_apps
-    networks:
-      - frontend # for Traefik
-      - backend # for DB/Redis
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.nextcloud.rule=Host(`cloud.harkon.co.uk`)
-      - traefik.http.routers.nextcloud.entrypoints=websecure
-      - traefik.http.routers.nextcloud.tls=true
-      - traefik.http.routers.nextcloud.tls.certresolver=godaddy
-      - traefik.http.services.nextcloud.loadbalancer.server.port=80
-      - traefik.http.routers.nextcloud.service=nextcloud
-
-  # Run background jobs as a separate container
-  cron:
-    image: nextcloud:apache
-    container_name: nextcloud-cron
-    restart: unless-stopped
-    depends_on: [nc_db, nc_redis]
-    entrypoint: /cron.sh
-    environment:
-      POSTGRES_DB: nextcloud
-      POSTGRES_USER: nextcloud
-      POSTGRES_PASSWORD: ${NEXTCLOUD_DB_PASSWORD}
-      POSTGRES_HOST: db
-      REDIS_HOST: redis
-      REDIS_HOST_PASSWORD: ${REDIS_PASSWORD}
-    volumes:
-      - nextcloud_html:/var/www/html
-      - nextcloud_data:/var/www/html/data
-      - nextcloud_config:/var/www/html/config
-      - nextcloud_apps:/var/www/html/custom_apps
-    networks: [backend]
--- a/infra/compose/portainer/docker-compose.yaml
+++ b/infra/compose/portainer/docker-compose.yaml
@@ -1,27 +0,0 @@
---
-services:
-  app:
-    container_name: portainer
-    image: docker.io/portainer/portainer-ce:2.33.1-alpine
-    volumes:
-      - /run/docker.sock:/var/run/docker.sock
-      - portainer-data:/data
-    labels:
-      - traefik.enable=true
-      - traefik.http.services.portainer.loadbalancer.server.port=9000
-      - traefik.http.routers.portainer.service=portainer
-      - traefik.http.routers.portainer.entrypoints=websecure
-      - traefik.http.routers.portainer.rule=Host(`portainer.harkon.co.uk`)
-      - traefik.http.routers.portainer.tls=true
-      - traefik.http.routers.portainer.tls.certresolver=godaddy
-    networks:
-      - frontend
-    restart: unless-stopped
-
-volumes:
-  portainer-data:
-    driver: local
-
-networks:
-  frontend:
-    external: true
--- a/infra/compose/traefik/compose.yaml
+++ b/infra/compose/traefik/compose.yaml
@@ -1,39 +0,0 @@
-# FILE: infra/compose/traefik/compose.yaml
-# there is another traefik instance in the infra used by the application.
-# Current instance used for company services on the dev environment.
-# TODO: Unify the two traefik instances.
---
-services:
-  traefik:
-    image: docker.io/library/traefik:v3.5.1
-    container_name: traefik
-    ports:
-      - 80:80
-      - 443:443
-      # --> (Optional) Enable Dashboard, don't do in production
-      # - 8080:8080
-      # <--
-    volumes:
-      - /run/docker.sock:/run/docker.sock:ro
-      - ./config/:/etc/traefik/:ro
-      - ./certs/:/var/traefik/certs/:rw
-    environment:
-      - CF_DNS_API_TOKEN=your-cloudflare-api-token # <-- Change this to your Cloudflare API Token
-    env_file:
-      - ./.provider.env # contains the GoDaddy API Key and Secret
-    networks:
-      - frontend
-    restart: unless-stopped
-    labels:
-      - traefik.enable=true
-      - traefik.http.middlewares.basicauth.basicauth.users=admin:$2y$05$/B2hjJGytCjjMK4Rah1/aeJofBrzqEnAVoZCMKKwetS9mgmck.MVS
-      - traefik.http.routers.traefik.rule=Host(`traefik.harkon.co.uk`)
-      - traefik.http.routers.traefik.entrypoints=websecure
-      - traefik.http.routers.traefik.tls.certresolver=le
-      - traefik.http.routers.traefik.middlewares=basicauth@docker
-      - traefik.http.routers.traefik.service=api@internal
-
-networks:
-  frontend:
-    external: true # <-- (Optional) Change this to false if you want to create a new network
-#
--- a/infra/compose/traefik/config/example.externalservice.yaml
+++ b/infra/compose/traefik/config/example.externalservice.yaml
@@ -1,21 +0,0 @@
-# --> (Example) Expose an external service using Traefik...
-# http:
-#   # -- Change Router Configuration here...
-#   routers:
-#     your-local-router:
-#       rule: "Host(`your-local-service.your-domain.com`)"  # <-- Change Rules here...
-#       service: your-local-service  # <-- Change Service Name here...
-#       priority: 1000  # <-- (Optional) Change Routing Priority here...
-#       entryPoints:
-#         - web
-#         - websecure
-#       tls:
-#         certResolver: cloudflare
-#
-#   # -- Change Service Configuration here...
-#   services:
-#     your-local-service:  # <-- Change Service Name here...
-#       loadBalancer:
-#         servers:
-#           - url: "http://your-local-service:port"  # <-- Change Target Service URL here...
-# <--
--- a/infra/compose/traefik/config/example.middleware-authentik.yaml
+++ b/infra/compose/traefik/config/example.middleware-authentik.yaml
@@ -1,19 +0,0 @@
-# --> (Example) Securely expose apps using the Traefik proxy outpost...
-http:
-  middlewares:
-    authentik:
-      forwardAuth:
-        address: http://authentik-server:9000/outpost.goauthentik.io/auth/traefik
-        trustForwardHeader: true
-        authResponseHeaders:
-          - X-authentik-username
-          - X-authentik-groups
-          - X-authentik-email
-          - X-authentik-name
-          - X-authentik-uid
-          - X-authentik-jwt
-          - X-authentik-meta-jwks
-          - X-authentik-meta-outpost
-          - X-authentik-meta-provider
-          - X-authentik-meta-app
-          - X-authentik-meta-version
--- a/infra/compose/traefik/config/example.middleware-passbolt.yaml
+++ b/infra/compose/traefik/config/example.middleware-passbolt.yaml
@@ -1,22 +0,0 @@
-# --> (Optional) When using Passbolt with Traefik...
-# http:
-#   middlewares:
-#     passbolt-middleware:
-#       headers:
-#         FrameDeny: true
-#         AccessControlAllowMethods: 'GET,OPTIONS,PUT'
-#         AccessControlAllowOriginList:
-#           - origin-list-or-null
-#         AccessControlMaxAge: 100
-#         AddVaryHeader: true
-#         BrowserXssFilter: true
-#         ContentTypeNosniff: true
-#         ForceSTSHeader: true
-#         STSIncludeSubdomains: true
-#         STSPreload: true
-#         ContentSecurityPolicy: default-src 'self' 'unsafe-inline'
-#         CustomFrameOptionsValue: SAMEORIGIN
-#         ReferrerPolicy: same-origin
-#         PermissionsPolicy: vibrate 'self'
-#         STSSeconds: 315360000
-# <--
--- a/infra/compose/traefik/config/example.tls.yaml
+++ b/infra/compose/traefik/config/example.tls.yaml
@@ -1,18 +0,0 @@
-# --> (Example) Change TLS Configuration here...
-# tls:
-#   options:
-#     default:
-#       minVersion: VersionTLS12
-#       sniStrict: true
-#       curvePreferences:
-#         - CurveP256
-#         - CurveP384
-#         - CurveP521
-#       cipherSuites:
-#         - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
-#         - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
-#         - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-#         - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-#         - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-#         - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
-# <--
--- a/infra/compose/traefik/config/traefik.yaml
+++ b/infra/compose/traefik/config/traefik.yaml
@@ -1,64 +0,0 @@
---
-global:
-  checkNewVersion: false
-  sendAnonymousUsage: false
-
-# --> (Optional) Change log level and format here ...
-#     - level: [TRACE, DEBUG, INFO, WARN, ERROR, FATAL]
-log:
-  level: DEBUG
-# <--
-
-# --> (Optional) Enable accesslog here ...
-accesslog: {}
-# <--
-
-# --> (Optional) Enable API and Dashboard here, don't do in production
-api:
-  dashboard: true
-  insecure: true
-# <--
-
-# -- Change EntryPoints here...
-entryPoints:
-  web:
-    address: :80
-    # --> (Optional) Redirect all HTTP to HTTPS
-    http:
-      redirections:
-        entryPoint:
-          to: websecure
-          scheme: https
-    # <--
-  websecure:
-    address: :443
-
-# -- Configure your CertificateResolver here...
-certificatesResolvers:
-  godaddy:
-    acme:
-      email: info@harkon.co.uk
-      storage: /var/traefik/certs/godaddy-acme.json
-      caServer: "https://acme-v02.api.letsencrypt.org/directory"
-      dnsChallenge:
-        provider: godaddy
-        resolvers:
-          - 1.1.1.1:53
-          - 8.8.8.8:53
-          - 97.74.103.44:53
-          - 173.201.71.44:53
-
-# --> (Optional) Disable TLS Cert verification check
-# serversTransport:
-#   insecureSkipVerify: true
-# <--
-
-providers:
-  docker:
-    exposedByDefault: false # <-- (Optional) Change this to true if you want to expose all services
-    # Specify discovery network - This ensures correct name resolving and possible issues with containers, that are in multiple networks.
-    # E.g. Database container in a separate network and a container in the frontend and database network.
-    network: frontend
-  file:
-    directory: /etc/traefik
-    watch: true