bridge/compose.local.yml

# Lux Bridge — LOCAL compose.
#
# Boots the full local development topology: identity provider (Casdoor)
# + Postgres for both Casdoor and bridge. NO NATS, NO Consul, NO Vault —
# the bridge backend no longer needs pub/sub or service discovery for
# MPC (HTTP to mpcd does it in one round-trip; per-swap state lives in
# Postgres).
#
# For TRUE bare-minimum standalone (just bridge + Postgres, no auth),
# use compose.standalone.yml instead.
#
# To enable native m-chain (threshold MPC) at boot, run the canonical
# Lux MPC daemon out-of-band:
#   make install-mpc           # go install github.com/luxfi/mpc/cmd/mpcd
#   make start-mpc-nodes       # 3-node local cluster
#   export BRIDGE_MPC_URL=http://localhost:6000
#
# Same pattern for Lux KMS (~/work/lux/kms) — point BRIDGE_KMS_URL at it.

services:
  # Identity provider (Casdoor-based unified authentication).
  # Brand-neutral container name + service id — tenants can point any
  # OIDC provider here without renaming.
  iam:
    image: casbin/casdoor:latest
    container_name: bridge-iam
    ports:
      - "8000:8000"
    environment:
      - RUNNING_IN_DOCKER=true
    volumes:
      - ./config/casdoor/app.conf:/conf/app.conf
      - iam-data:/var/lib/casdoor
    networks:
      - bridge-network
    depends_on:
      iam-db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8000"]
      interval: 5s
      timeout: 3s
      retries: 5

  # Identity provider database.
  iam-db:
    image: ghcr.io/hanzoai/sql:latest
    container_name: bridge-iam-db
    environment:
      - POSTGRES_USER=casdoor
      - POSTGRES_PASSWORD=${IAM_DB_PASSWORD:-changeme}
      - POSTGRES_DB=casdoor
    volumes:
      - iam-db-data:/var/lib/postgresql/data
    ports:
      - "5434:5432"
    networks:
      - bridge-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U casdoor"]
      interval: 5s
      timeout: 3s
      retries: 5

  # Bridge swap state (canonical, via Prisma).
  postgres:
    image: ghcr.io/hanzoai/sql:latest
    container_name: bridge-postgres
    environment:
      - POSTGRES_USER=bridge
      - POSTGRES_PASSWORD=bridge
      - POSTGRES_DB=bridge
    volumes:
      - postgres-data:/var/lib/postgresql
      - ./scripts/init.sql:/docker-entrypoint-initdb.d/init.sql
    ports:
      - "5433:5432"
    networks:
      - bridge-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U bridge"]
      interval: 5s
      timeout: 3s
      retries: 5

  # mpcd (the canonical Lux threshold-MPC daemon) and the KMS service
  # are NOT in this compose. Run them out-of-band:
  #
  #   # mpcd — github.com/luxfi/mpc
  #   make install-mpc
  #   make start-mpc-nodes        # 3-node local cluster on :6000-6002
  #
  #   # KMS — github.com/luxfi/kms
  #   cd ~/work/lux/kms && make dev
  #
  # Then point the bridge backend at them:
  #   export BRIDGE_MPC_URL=http://localhost:6000
  #   export BRIDGE_KMS_URL=http://localhost:8080
  #
  # The bridge runs in standalone mode (clean error on sign calls)
  # until those are set — no crash at startup.

volumes:
  iam-data:
  iam-db-data:
  postgres-data:

networks:
  bridge-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.25.0.0/16