# =========================================================================
# AETHONEX SOVEREIGN STACK V1.0 — DEMO ORCHESTRATION BLUEPRINT
# =========================================================================
# Purpose: Minimal, high-authority credibility prop for client sales calls.
# Footprint: Hetzner Cloud VPS CPX31 (4 vCPU / 8GB RAM) or standard CPU/GPU local node.
# Security: 100% telemetry severed, data databases fully air-gapped on internal bridge.
# =========================================================================

version: '3.8'

services:
  # -----------------------------------------------------------------------
  # LAYER 1: INGRESS & SECURITY LAYER
  # -----------------------------------------------------------------------
  # Caddy Server: Light, fast, automatic SSL reverse proxy. Exposes only the
  # safe ingress point. Resolves SSL dynamically via Let's Encrypt.
  gateway:
    image: caddy:2-alpine
    container_name: aethonex-gateway
    restart: unless-stopped
    ports:
      - "80:80"   # HTTP for SSL ACME challenge routing
      - "443:443" # Hardened HTTPS for all team traffic
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - aethonex-ingress
    depends_on:
      - n8n
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # -----------------------------------------------------------------------
  # LAYER 2: DATA & VECTOR FOUNDATION (AIR-GAPPED INTERNAL NETWORK)
  # -----------------------------------------------------------------------
  # PostgreSQL: Enterprise relational storage. Hard-locked inside the internal
  # bridge network. No direct port exposure to the external internet.
  postgres:
    image: postgres:16-alpine
    container_name: aethonex-database
    restart: unless-stopped
    environment:
      - POSTGRES_DB=aethonex_sovereign
      - POSTGRES_USER=aethonex_admin
      - POSTGRES_PASSWORD=aethonex_sovereign_secure_2026 # In production, set via secure environment file
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - aethonex-internal # Quarantined from resolving external DNS queries
    logging:
      driver: "json-file"
      options:
        max-size: "10m"

  # Qdrant Vector Memory: Visual and text vector context storage. Used for RAG
  # (Retrieval-Augmented Generation) so the LLM remembers all agency briefs.
  # Telemetry explicitly disabled to prevent external phone-home events.
  qdrant:
    image: qdrant/qdrant:v1.9.0
    container_name: aethonex-vector-memory
    restart: unless-stopped
    environment:
      - QDRANT__TELEMETRY_DISABLED=true # STRICT PRIVACY SEVERANCE
    volumes:
      - qdrant_data:/qdrant/storage
    networks:
      - aethonex-internal
    logging:
      driver: "json-file"
      options:
        max-size: "10m"

  # -----------------------------------------------------------------------
  # LAYER 3: COGNITIVE INTELLIGENCE CORE
  # -----------------------------------------------------------------------
  # Ollama Inference Node: The localized brain. Runs LLMs locally on CPU
  # or GPU. No API call fees, zero data egress, HIPAA-compliant by design.
  ollama:
    image: ollama/ollama:latest
    container_name: aethonex-inference
    restart: unless-stopped
    volumes:
      - ollama_models:/root/.ollama
    networks:
      - aethonex-internal
    # For GPU acceleration (e.g., RTX 3090/4090), uncomment the hardware block below:
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: 1
    #           capabilities: [gpu]
    logging:
      driver: "json-file"
      options:
        max-size: "20m"

  # -----------------------------------------------------------------------
  # LAYER 4: ORCHESTRATION & WORKFLOW
  # -----------------------------------------------------------------------
  # n8n Automation Engine: Visual node editor replacing Zapier. Intercepts CRM
  # updates, triggers emails, runs AI agent loops, and generates weekly report PDFs.
  n8n:
    image: n8nio/n8n:1.39.1
    container_name: aethonex-automation-core
    restart: unless-stopped
    environment:
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=aethonex_dashboard_secure # In production, set via secure environment file
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=aethonex_sovereign
      - DB_POSTGRESDB_USER=aethonex_admin
      - DB_POSTGRESDB_PASSWORD=aethonex_sovereign_secure_2026
      - N8N_ENCRYPTION_KEY=aethonex-encryption-key-random-hash-2026
      - N8N_TELEMETRY_ENABLED=false # STRICT PRIVACY SEVERANCE
      - CHECK_MIGRATIONS_ON_STARTUP=true
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - aethonex-ingress
      - aethonex-internal
    depends_on:
      - postgres
      - qdrant
      - ollama
    logging:
      driver: "json-file"
      options:
        max-size: "10m"

# =========================================================================
# NETWORK TOPOLOGY & STORAGE VOLUMES
# =========================================================================
networks:
  # Public-facing routing channel (gateway talks to n8n surface)
  aethonex-ingress:
    name: aethonex_ingress_net
    driver: bridge

  # Fully-isolated private backplane (database, vectors, inference cannot hit internet)
  aethonex-internal:
    name: aethonex_internal_net
    driver: bridge
    internal: true # Hard air-gap protection from outbound exfiltration

volumes:
  caddy_data:
    name: aethonex_caddy_data
  caddy_config:
    name: aethonex_caddy_config
  postgres_data:
    name: aethonex_postgres_data
  qdrant_data:
    name: aethonex_qdrant_data
  ollama_models:
    name: aethonex_ollama_models
  n8n_data:
    name: aethonex_n8n_data
