docker-compose.yaml

# =============================================================================
# Full Local Docker Setup
# =============================================================================
# This docker-compose file runs EVERYTHING locally in Docker:
# - Anvil (local Ethereum)
# - Ethereum contract deployer
# - Canton Network (sequencer, mediator, participants)
# - PostgreSQL
# - Mock OAuth2 server
# - Bootstrap (party allocation, contract creation)
# - Bridge Relayer
#
# Usage:
#   docker compose up --build
#
# To clean and restart:
#   docker compose down -v
#   docker compose up --build
# =============================================================================

services:
  # ===========================================================================
  # Ethereum
  # ===========================================================================
  anvil:
    image: ghcr.io/foundry-rs/foundry
    container_name: anvil
    environment:
      ANVIL_IP_ADDR: "0.0.0.0"
    working_dir: /anvil
    ports:
      - "8545:8545"
    command: anvil --mnemonic "test test test test test test test test test test test junk" --host 0.0.0.0
    healthcheck:
      test: ["CMD", "cast", "block-number", "--rpc-url", "http://localhost:8545"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s
    networks:
      - bridge-network

  deployer:
    image: ghcr.io/foundry-rs/foundry
    container_name: deployer
    user: root
    depends_on:
      anvil:
        condition: service_healthy
    volumes:
      - ./contracts/ethereum-wayfinder:/app
    working_dir: /app
    environment:
      FOUNDRY_PROFILE: default
      DEPLOYER_PRIVATE_KEY: "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
      RELAYER_ADDRESS: "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266"
      ETH_RPC_URL: "http://anvil:8545"
    entrypoint: /bin/sh -c "forge clean || true; while ! cast block-number --rpc-url http://anvil:8545 > /dev/null 2>&1; do sleep 1; done; forge script script/Deployer.s.sol --rpc-url http://anvil:8545 --broadcast"
    networks:
      - bridge-network

  # ===========================================================================
  # Canton Network
  # ===========================================================================
  canton:
    image: chainsafe/canton:3.4.8
    container_name: canton
    ports:
      - "5001:5001"   # Sequencer Public API
      - "5002:5002"   # Sequencer Admin API
      - "5011:5011"   # Participant 1 Ledger API
      - "5012:5012"   # Participant 1 Admin API
      - "5013:5013"   # Participant 1 HTTP Ledger API
      - "5021:5021"   # Participant 2 Ledger API
      - "5022:5022"   # Participant 2 Admin API
      - "5023:5023"   # Participant 2 HTTP Ledger API
      - "5202:5202"   # Mediator Admin API
    environment:
      JDK_JAVA_OPTIONS: "-XX:+ExitOnOutOfMemoryError -Xmx8G"
    command:
      - "daemon"
      - "--log-level-root=INFO"
      - "--log-level-canton=DEBUG"
      - "--log-level-stdout=DEBUG"
      - "--config=/canton/simple-topology.conf"
      - "--bootstrap=/canton/deploy-dars.canton"
    volumes:
      - ./contracts/canton-erc20:/canton/contracts
      - ./deployments/usdcx-dars:/canton/usdcx-dars
      - ./deployments/canton-config/simple-topology.conf:/canton/simple-topology.conf
      - ./deployments/canton-config/deploy-dars.canton:/canton/deploy-dars.canton
    healthcheck:
      test:
        - CMD-SHELL
        - >-
          grpcurl --plaintext localhost:5011
          com.digitalasset.canton.health.admin.v0.StatusService.Status
          | jq -e '.success | select(.active)'
          && curl -sf http://localhost:5023/v2/packages
          | jq -e '(.packageIds | length) >= 30'
      interval: 10s
      timeout: 10s
      retries: 30
      start_period: 60s
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - bridge-network

  # ===========================================================================
  # Database
  # ===========================================================================
  postgres:
    image: postgres:15-alpine
    container_name: postgres
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: p@ssw0rd
      POSTGRES_DB: postgres
      POSTGRES_MULTIPLE_DATABASES: relayer,erc20_api,canton_indexer
    ports:
      - "5432:5432"
    volumes:
      - ./scripts/setup/init-multiple-dbs.sh:/docker-entrypoint-initdb.d/init-multiple-dbs.sh:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks:
      - bridge-network

  # ===========================================================================
  # Mock OAuth2 Server
  # ===========================================================================
  mock-oauth2:
    build:
      context: .
      dockerfile: Dockerfile.local
      target: mock-oauth2
    container_name: mock-oauth2
    ports:
      - "8088:8088"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8088/health"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks:
      - bridge-network

  # ===========================================================================
  # Bootstrap (runs once to set up Canton contracts)
  # ===========================================================================
  bootstrap:
    build:
      context: .
      dockerfile: Dockerfile.local
      target: bootstrap
    container_name: bootstrap
    environment:
      ENV: docker
      CONFIG_FILE: /app/state/config.yaml
      API_SERVER_CONFIG_FILE: /app/state/api-server-config.yaml
      INDEXER_CONFIG_FILE: /app/state/indexer-config.yaml
      CANTON_HTTP: http://canton:5013
      BROADCAST_DIR: /app/broadcast
      RELAYER_DATABASE_URL: "${RELAYER_DATABASE_URL:-postgres://postgres:p%40ssw0rd@postgres:5432/relayer}"
      API_SERVER_DATABASE_URL: "${API_SERVER_DATABASE_URL:-postgres://postgres:p%40ssw0rd@postgres:5432/erc20_api}"
      CANTON_AUTH_CLIENT_ID: "${CANTON_AUTH_CLIENT_ID:-local-test-client}"
      CANTON_AUTH_CLIENT_SECRET: "${CANTON_AUTH_CLIENT_SECRET:-local-test-secret}"
      ETHEREUM_RELAYER_PRIVATE_KEY: "${ETHEREUM_RELAYER_PRIVATE_KEY:-ac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80}"
    volumes:
      - ./contracts/ethereum-wayfinder/broadcast:/app/broadcast:ro
      - config_state:/app/state
      - e2e-deploy:/tmp
    depends_on:
      canton:
        condition: service_healthy
      mock-oauth2:
        condition: service_healthy
      deployer:
        condition: service_completed_successfully
    networks:
      - bridge-network

  # ===========================================================================
  # Bridge Relayer
  # ===========================================================================
  relayer:
    build:
      context: .
      dockerfile: Dockerfile.local
      target: relayer
    container_name: canton-bridge-relayer
    ports:
      - "8080:8080"
      - "9090:9090"
    volumes:
      - config_state:/app/state:ro
    command: ["-config", "/app/state/config.yaml"]
    environment:
      LOG_LEVEL: debug
      ENV: docker
      RELAYER_DATABASE_URL: "${RELAYER_DATABASE_URL:-postgres://postgres:p%40ssw0rd@postgres:5432/relayer}"
      CANTON_AUTH_CLIENT_ID: "${CANTON_AUTH_CLIENT_ID:-local-test-client}"
      CANTON_AUTH_CLIENT_SECRET: "${CANTON_AUTH_CLIENT_SECRET:-local-test-secret}"
      ETHEREUM_RELAYER_PRIVATE_KEY: "${ETHEREUM_RELAYER_PRIVATE_KEY:-ac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80}"
    depends_on:
      bootstrap:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      canton:
        condition: service_healthy
      anvil:
        condition: service_healthy
      mock-oauth2:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - bridge-network

  # ===========================================================================
  # USDCx Transfer Factory Registry (devstack only)
  # In production this is run by the USDCx issuer (e.g., Circle).
  # Here it wraps participant2's CIP56TransferFactory for P1 api-server.
  # ===========================================================================
  usdcx-registry:
    build:
      context: .
      dockerfile: Dockerfile.local
      target: usdcx-registry
    container_name: usdcx-registry
    ports:
      - "8090:8090"
    environment:
      CANTON_AUTH_CLIENT_ID: "${CANTON_AUTH_CLIENT_ID:-local-test-client}"
      CANTON_AUTH_CLIENT_SECRET: "${CANTON_AUTH_CLIENT_SECRET:-local-test-secret}"
    command:
      - "-p2"
      - "canton:5021"
      - "-p2-http"
      - "http://canton:5023"
      - "-p2-audience"
      - "http://canton:5021"
      - "-token-url"
      - "http://mock-oauth2:8088/oauth/token"
      - "-client-id"
      - "${CANTON_AUTH_CLIENT_ID:-local-test-client}"
      - "-client-secret"
      - "${CANTON_AUTH_CLIENT_SECRET:-local-test-secret}"
      - "-port"
      - "8090"
    depends_on:
      bootstrap:
        condition: service_completed_successfully
      canton:
        condition: service_healthy
      mock-oauth2:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8090/health"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - bridge-network

  # ===========================================================================
  # ERC-20 API Server
  # ===========================================================================
  api-server:
    build:
      context: .
      dockerfile: Dockerfile.local
      target: api-server
    container_name: erc20-api-server
    ports:
      - "8081:8081"
    volumes:
      - config_state:/app/state:ro
    command: ["-config", "/app/state/api-server-config.yaml"]
    environment:
      LOG_LEVEL: debug
      ENV: docker
      API_SERVER_DATABASE_URL: "${API_SERVER_DATABASE_URL:-postgres://postgres:p%40ssw0rd@postgres:5432/erc20_api}"
      CANTON_AUTH_CLIENT_ID: "${CANTON_AUTH_CLIENT_ID:-local-test-client}"
      CANTON_AUTH_CLIENT_SECRET: "${CANTON_AUTH_CLIENT_SECRET:-local-test-secret}"
      CANTON_MASTER_KEY: "${CANTON_MASTER_KEY}"  # Generate with: openssl rand -base64 32
      SKIP_CANTON_SIG_VERIFY: "${SKIP_CANTON_SIG_VERIFY:-false}"  # Set to "true" for local testing
    depends_on:
      bootstrap:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      canton:
        condition: service_healthy
      mock-oauth2:
        condition: service_healthy
      usdcx-registry:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8081/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - bridge-network

  # ===========================================================================
  # Canton Indexer
  # ===========================================================================
  indexer:
    build:
      context: .
      dockerfile: Dockerfile.local
      target: indexer
    container_name: canton-indexer
    ports:
      - "8082:8082"
    volumes:
      - config_state:/app/state:ro
    command: ["-config", "/app/state/indexer-config.yaml"]
    environment:
      LOG_LEVEL: debug
      ENV: docker
      INDEXER_DATABASE_URL: "${INDEXER_DATABASE_URL:-postgres://postgres:p%40ssw0rd@postgres:5432/canton_indexer}"
      CANTON_AUTH_CLIENT_ID: "${CANTON_AUTH_CLIENT_ID:-local-test-client}"
      CANTON_AUTH_CLIENT_SECRET: "${CANTON_AUTH_CLIENT_SECRET:-local-test-secret}"
    depends_on:
      bootstrap:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      canton:
        condition: service_healthy
      mock-oauth2:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8082/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - bridge-network

  # ===========================================================================
  # Monitoring
  # ===========================================================================
  prometheus:
    image: prom/prometheus:v3.11.2
    container_name: prometheus
    ports:
      - "9091:9090"
    volumes:
      - ./deployments/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    depends_on:
      relayer:
        condition: service_healthy
    networks:
      - bridge-network

  grafana:
    image: grafana/grafana:12.4
    container_name: grafana
    ports:
      - "3001:3000"
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Viewer
    volumes:
      - ./deployments/grafana/provisioning:/etc/grafana/provisioning:ro
    depends_on:
      - prometheus
    networks:
      - bridge-network

networks:
  bridge-network:
    driver: bridge

volumes:
  config_state:
  e2e-deploy: