completed local setup with compose

infra/base/infrastructure.yaml

@@ -20,6 +20,7 @@ volumes:
   vault_data:
   redis_data:
   nats_data:
+  authentik_data:
 
 services:
   # Edge Gateway & SSO
@@ -37,6 +38,14 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./traefik/config/:/etc/traefik/:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dashboard.rule=Host(`traefik.${DOMAIN}`)"
+      - "traefik.http.routers.dashboard.entrypoints=websecure"
+      - "traefik.http.routers.dashboard.tls=true"
+      - "traefik.http.routers.dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.dashboard.service=api@internal"
+      - "traefik.http.routers.dashboard.middlewares=authentik-forwardauth@file"
 
   # Identity & SSO (Authentik)
   apa-authentik-db:
@@ -46,7 +55,7 @@ services:
     networks:
       - backend
     volumes:
-      - postgres_data:/var/lib/postgresql/data
+      - authentik_data:/var/lib/postgresql/data
     environment:
       POSTGRES_DB: authentik
       POSTGRES_USER: authentik
@@ -94,7 +103,7 @@ services:
       - "traefik.http.routers.authentik.rule=Host(`auth.${DOMAIN}`)"
       - "traefik.http.routers.authentik.entrypoints=websecure"
       - "traefik.http.routers.authentik.tls=true"
-      - "traefik.http.routers.authentik.tls.certresolver=godaddy"
+      - "traefik.http.routers.authentik.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.services.authentik.loadbalancer.server.port=9000"
 
   apa-authentik-worker:
@@ -149,18 +158,23 @@ services:
     command: vault server -dev -dev-listen-address=0.0.0.0:8200
     cap_add:
       - IPC_LOCK
+    extra_hosts:
+      - "auth.local.lan:host-gateway"
+      - "vault.local.lan:host-gateway"
+      - "minio.local.lan:host-gateway"
+      - "api.local.lan:host-gateway"
+      - "traefik.local.lan:host-gateway"
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.vault.rule=Host(`vault.${DOMAIN}`)"
       - "traefik.http.routers.vault.entrypoints=websecure"
       - "traefik.http.routers.vault.tls=true"
-      - "traefik.http.routers.vault.tls.certresolver=godaddy"
-      - "traefik.http.routers.vault.middlewares=authentik-forwardauth@file"
+      - "traefik.http.routers.vault.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.services.vault.loadbalancer.server.port=8200"
 
   # Object Storage
   apa-minio:
-    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
+    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
     container_name: apa-minio
     restart: unless-stopped
     networks:
@@ -172,26 +186,35 @@ services:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
       MINIO_BROWSER_REDIRECT_URL: https://minio.${DOMAIN}
+      MINIO_IDENTITY_OPENID_CONFIG_URL: "https://auth.${DOMAIN}/application/o/minio-oidc/.well-known/openid-configuration"
+      MINIO_IDENTITY_OPENID_CLIENT_ID: "minio"
+      MINIO_IDENTITY_OPENID_CLIENT_SECRET: ${AUTHENTIK_MINIO_CLIENT_SECRET}
+      MINIO_IDENTITY_OPENID_SCOPES: "openid,profile,email,minio"
+      MINIO_IDENTITY_OPENID_REDIRECT_URI: "https://minio.${DOMAIN}/oauth_callback"
+      MINIO_IDENTITY_OPENID_DISPLAY_NAME: "Login with Authentik"
     command: server /data --address ":9092" --console-address ":9093"
     healthcheck:
-      test: ["CMD", "mc", "--version"]
+      test: ["CMD", "curl", "-f", "http://localhost:9092/minio/health/live"]
       interval: 30s
       timeout: 20s
       retries: 3
+    extra_hosts:
+      - "auth.local.lan:host-gateway"
+      - "minio.local.lan:host-gateway"
+      - "api.local.lan:host-gateway"
+      - "traefik.local.lan:host-gateway"
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.minio-api.rule=Host(`minio-api.${DOMAIN}`)"
       - "traefik.http.routers.minio-api.entrypoints=websecure"
       - "traefik.http.routers.minio-api.tls=true"
-      - "traefik.http.routers.minio-api.tls.certresolver=godaddy"
-      - "traefik.http.routers.minio-api.middlewares=authentik-forwardauth@file"
+      - "traefik.http.routers.minio-api.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.routers.minio-api.service=minio-api"
       - "traefik.http.services.minio-api.loadbalancer.server.port=9092"
       - "traefik.http.routers.minio-console.rule=Host(`minio.${DOMAIN}`)"
       - "traefik.http.routers.minio-console.entrypoints=websecure"
       - "traefik.http.routers.minio-console.tls=true"
-      - "traefik.http.routers.minio-console.tls.certresolver=godaddy"
-      - "traefik.http.routers.minio-console.middlewares=authentik-forwardauth@file"
+      - "traefik.http.routers.minio-console.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.routers.minio-console.service=minio-console"
       - "traefik.http.services.minio-console.loadbalancer.server.port=9093"
 
@@ -214,7 +237,7 @@ services:
       - "traefik.http.routers.qdrant.rule=Host(`qdrant.${DOMAIN}`)"
       - "traefik.http.routers.qdrant.entrypoints=websecure"
       - "traefik.http.routers.qdrant.tls=true"
-      - "traefik.http.routers.qdrant.tls.certresolver=godaddy"
+      - "traefik.http.routers.qdrant.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.routers.qdrant.middlewares=authentik-forwardauth@file"
       - "traefik.http.services.qdrant.loadbalancer.server.port=6333"
 
@@ -242,7 +265,7 @@ services:
       - "traefik.http.routers.neo4j.rule=Host(`neo4j.${DOMAIN}`)"
       - "traefik.http.routers.neo4j.entrypoints=websecure"
       - "traefik.http.routers.neo4j.tls=true"
-      - "traefik.http.routers.neo4j.tls.certresolver=godaddy"
+      - "traefik.http.routers.neo4j.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.routers.neo4j.middlewares=authentik-forwardauth@file"
       - "traefik.http.services.neo4j.loadbalancer.server.port=7474"
 
@@ -334,6 +357,6 @@ services:
       - "traefik.http.routers.nats-monitor.rule=Host(`nats.${DOMAIN}`)"
       - "traefik.http.routers.nats-monitor.entrypoints=websecure"
       - "traefik.http.routers.nats-monitor.tls=true"
-      - "traefik.http.routers.nats-monitor.tls.certresolver=godaddy"
+      - "traefik.http.routers.nats-monitor.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.routers.nats-monitor.middlewares=authentik-forwardauth@file"
       - "traefik.http.services.nats-monitor.loadbalancer.server.port=8222"

infra/base/loki/loki.yml

@@ -0,0 +1,30 @@
+auth_enabled: false
+
+server:
+  http_listen_port: 3100
+  grpc_listen_port: 9096
+
+common:
+  instance_addr: 127.0.0.1
+  path_prefix: /loki
+  storage:
+    filesystem:
+      chunks_directory: /loki/chunks
+      rules_directory: /loki/rules
+  replication_factor: 1
+  ring:
+    kvstore:
+      store: inmemory
+
+schema_config:
+  configs:
+    - from: 2020-10-24
+      store: boltdb-shipper
+      object_store: filesystem
+      schema: v11
+      index:
+        prefix: index_
+        period: 24h
+
+ruler:
+  alertmanager_url: http://localhost:9093

infra/base/loki/promtail-config.yml

@@ -0,0 +1,26 @@
+server:
+  http_listen_port: 9080
+  grpc_listen_port: 0
+
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+  - url: http://apa-loki:3100/loki/api/v1/push
+
+scrape_configs:
+  - job_name: system
+    static_configs:
+      - targets:
+          - localhost
+        labels:
+          job: varlogs
+          __path__: /var/log/*log
+
+  - job_name: docker
+    static_configs:
+      - targets:
+          - localhost
+        labels:
+          job: docker
+          __path__: /var/lib/docker/containers/*/*-json.log

infra/base/monitoring.yaml

@@ -39,7 +39,7 @@ services:
       - "traefik.http.routers.prometheus.rule=Host(`prometheus.${DOMAIN}`)"
       - "traefik.http.routers.prometheus.entrypoints=websecure"
       - "traefik.http.routers.prometheus.tls=true"
-      - "traefik.http.routers.prometheus.tls.certresolver=godaddy"
+      - "traefik.http.routers.prometheus.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.routers.prometheus.middlewares=authentik-forwardauth@file"
       - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
 
@@ -80,12 +80,19 @@ services:
       GF_SECURITY_COOKIE_SECURE: true
       GF_SECURITY_COOKIE_SAMESITE: lax
       GF_AUTH_GENERIC_OAUTH_USE_PKCE: true
+      GF_AUTH_GENERIC_OAUTH_TLS_SKIP_VERIFY_INSECURE: true
+      GF_AUTH_SIGNOUT_REDIRECT_URL: https://auth.${DOMAIN}/application/o/grafana/end-session/
+    extra_hosts:
+      - "auth.local.lan:host-gateway"
+      - "grafana.local.lan:host-gateway"
+      - "api.local.lan:host-gateway"
+      - "traefik.local.lan:host-gateway"
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.grafana.rule=Host(`grafana.${DOMAIN}`)"
       - "traefik.http.routers.grafana.entrypoints=websecure"
       - "traefik.http.routers.grafana.tls=true"
-      - "traefik.http.routers.grafana.tls.certresolver=godaddy"
+      - "traefik.http.routers.grafana.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.services.grafana.loadbalancer.server.port=3000"
 
   # Log Aggregation
@@ -105,7 +112,7 @@ services:
       - "traefik.http.routers.loki.rule=Host(`loki.${DOMAIN}`)"
       - "traefik.http.routers.loki.entrypoints=websecure"
       - "traefik.http.routers.loki.tls=true"
-      - "traefik.http.routers.loki.tls.certresolver=godaddy"
+      - "traefik.http.routers.loki.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.routers.loki.middlewares=authentik-forwardauth@file"
       - "traefik.http.services.loki.loadbalancer.server.port=3100"
 

infra/base/prometheus/prometheus.yml

@@ -0,0 +1,21 @@
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: "prometheus"
+    static_configs:
+      - targets: ["localhost:9090"]
+
+  - job_name: "traefik"
+    static_configs:
+      - targets: ["apa-traefik:8080"]
+
+  - job_name: "services"
+    static_configs:
+      - targets:
+          - "apa-svc-ingestion:8000"
+          - "apa-svc-extract:8000"
+          - "apa-svc-kg:8000"
+          - "apa-svc-rag-retriever:8000"
+          - "apa-svc-rag-indexer:8000"

infra/base/services.yaml

@@ -40,8 +40,8 @@ services:
       - "traefik.http.routers.svc-ingestion.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/ingestion`)"
       - "traefik.http.routers.svc-ingestion.entrypoints=websecure"
       - "traefik.http.routers.svc-ingestion.tls=true"
-      - "traefik.http.routers.svc-ingestion.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-ingestion.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-ingestion.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-ingestion.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-ingestion.loadbalancer.server.port=8000"
 
   # Data Extraction Service
@@ -73,8 +73,8 @@ services:
       - "traefik.http.routers.svc-extract.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/extract`)"
       - "traefik.http.routers.svc-extract.entrypoints=websecure"
       - "traefik.http.routers.svc-extract.tls=true"
-      - "traefik.http.routers.svc-extract.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-extract.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-extract.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-extract.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-extract.loadbalancer.server.port=8000"
 
   # Knowledge Graph Service
@@ -100,8 +100,8 @@ services:
       - "traefik.http.routers.svc-kg.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/kg`)"
       - "traefik.http.routers.svc-kg.entrypoints=websecure"
       - "traefik.http.routers.svc-kg.tls=true"
-      - "traefik.http.routers.svc-kg.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-kg.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-kg.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-kg.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-kg.loadbalancer.server.port=8000"
 
   # RAG Retrieval Service
@@ -130,8 +130,8 @@ services:
       - "traefik.http.routers.svc-rag-retriever.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/rag`)"
       - "traefik.http.routers.svc-rag-retriever.entrypoints=websecure"
       - "traefik.http.routers.svc-rag-retriever.tls=true"
-      - "traefik.http.routers.svc-rag-retriever.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-rag-retriever.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-rag-retriever.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-rag-retriever.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-rag-retriever.loadbalancer.server.port=8000"
 
   # Forms Service
@@ -163,8 +163,8 @@ services:
       - "traefik.http.routers.svc-forms.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/forms`)"
       - "traefik.http.routers.svc-forms.entrypoints=websecure"
       - "traefik.http.routers.svc-forms.tls=true"
-      - "traefik.http.routers.svc-forms.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-forms.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-forms.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-forms.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-forms.loadbalancer.server.port=8000"
 
   # HMRC Integration Service
@@ -197,8 +197,8 @@ services:
       - "traefik.http.routers.svc-hmrc.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/hmrc`)"
       - "traefik.http.routers.svc-hmrc.entrypoints=websecure"
       - "traefik.http.routers.svc-hmrc.tls=true"
-      - "traefik.http.routers.svc-hmrc.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-hmrc.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-hmrc.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-hmrc.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-hmrc.loadbalancer.server.port=8000"
 
   # OCR Service
@@ -230,8 +230,8 @@ services:
       - "traefik.http.routers.svc-ocr.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/ocr`)"
       - "traefik.http.routers.svc-ocr.entrypoints=websecure"
       - "traefik.http.routers.svc-ocr.tls=true"
-      - "traefik.http.routers.svc-ocr.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-ocr.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-ocr.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-ocr.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-ocr.loadbalancer.server.port=8000"
 
   # RAG Indexer Service
@@ -263,8 +263,8 @@ services:
       - "traefik.http.routers.svc-rag-indexer.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/rag-indexer`)"
       - "traefik.http.routers.svc-rag-indexer.entrypoints=websecure"
       - "traefik.http.routers.svc-rag-indexer.tls=true"
-      - "traefik.http.routers.svc-rag-indexer.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-rag-indexer.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-rag-indexer.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-rag-indexer.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-rag-indexer.loadbalancer.server.port=8000"
 
   # Reasoning Service
@@ -296,8 +296,8 @@ services:
       - "traefik.http.routers.svc-reason.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/reason`)"
       - "traefik.http.routers.svc-reason.entrypoints=websecure"
       - "traefik.http.routers.svc-reason.tls=true"
-      - "traefik.http.routers.svc-reason.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-reason.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-reason.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-reason.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-reason.loadbalancer.server.port=8000"
 
   # RPA Service
@@ -329,8 +329,8 @@ services:
       - "traefik.http.routers.svc-rpa.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/rpa`)"
       - "traefik.http.routers.svc-rpa.entrypoints=websecure"
       - "traefik.http.routers.svc-rpa.tls=true"
-      - "traefik.http.routers.svc-rpa.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-rpa.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-rpa.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-rpa.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-rpa.loadbalancer.server.port=8000"
 
   # Normalize & Map Service
@@ -362,8 +362,8 @@ services:
       - "traefik.http.routers.svc-normalize-map.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/normalize-map`)"
       - "traefik.http.routers.svc-normalize-map.entrypoints=websecure"
       - "traefik.http.routers.svc-normalize-map.tls=true"
-      - "traefik.http.routers.svc-normalize-map.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-normalize-map.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-normalize-map.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-normalize-map.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-normalize-map.loadbalancer.server.port=8000"
 
   # Coverage Service
@@ -395,8 +395,8 @@ services:
       - "traefik.http.routers.svc-coverage.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/coverage`)"
       - "traefik.http.routers.svc-coverage.entrypoints=websecure"
       - "traefik.http.routers.svc-coverage.tls=true"
-      - "traefik.http.routers.svc-coverage.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-coverage.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-coverage.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-coverage.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-coverage.loadbalancer.server.port=8000"
 
   # Firm Connectors Service
@@ -428,8 +428,8 @@ services:
       - "traefik.http.routers.svc-firm-connectors.rule=Host(`api.${DOMAIN}`) && PathPrefix(`/firm-connectors`)"
       - "traefik.http.routers.svc-firm-connectors.entrypoints=websecure"
       - "traefik.http.routers.svc-firm-connectors.tls=true"
-      - "traefik.http.routers.svc-firm-connectors.tls.certresolver=godaddy"
-      - "traefik.http.routers.svc-firm-connectors.middlewares=authentik-forwardauth@file,rate-limit@file"
+      - "traefik.http.routers.svc-firm-connectors.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
+      - "traefik.http.routers.svc-firm-connectors.middlewares=authentik-forwardauth@file,rate-limit@file,strip-api-prefixes@file"
       - "traefik.http.services.svc-firm-connectors.loadbalancer.server.port=8000"
 
   # Review UI
@@ -448,6 +448,6 @@ services:
       - "traefik.http.routers.ui-review.rule=Host(`app.${DOMAIN}`)"
       - "traefik.http.routers.ui-review.entrypoints=websecure"
       - "traefik.http.routers.ui-review.tls=true"
-      - "traefik.http.routers.ui-review.tls.certresolver=godaddy"
+      - "traefik.http.routers.ui-review.tls.certresolver=${TRAEFIK_CERT_RESOLVER}"
       - "traefik.http.routers.ui-review.middlewares=authentik-forwardauth@file"
       - "traefik.http.services.ui-review.loadbalancer.server.port=3030"