docker-compose.yml

x-redis-cluster-node: &redis-cluster-node
  image: redis:7-alpine
  command:
    - redis-server
    - --port
    - "6379"
    - --bind
    - "0.0.0.0"
    - --requirepass
    - redispassword
    - --masterauth
    - redispassword
    - --cluster-enabled
    - "yes"
    - --cluster-config-file
    - nodes.conf
    - --cluster-node-timeout
    - "5000"
    - --appendonly
    - "no"
    - --save
    - ""
  healthcheck:
    test: ["CMD", "redis-cli", "-p", "6379", "-a", "redispassword", "ping"]
    interval: 2s
    timeout: 3s
    retries: 10

x-valkey-cluster-node: &valkey-cluster-node
  image: valkey/valkey:9.0.3-alpine
  command:
    - valkey-server
    - --port
    - "6379"
    - --bind
    - "0.0.0.0"
    - --requirepass
    - redispassword
    - --masterauth
    - redispassword
    - --cluster-enabled
    - "yes"
    - --cluster-config-file
    - nodes.conf
    - --cluster-node-timeout
    - "5000"
    - --appendonly
    - "no"
    - --save
    - ""
  healthcheck:
    test: ["CMD", "valkey-cli", "-p", "6379", "-a", "redispassword", "ping"]
    interval: 2s
    timeout: 3s
    retries: 10

services:
  fides:
    container_name: fides${CONTAINER_SUFFIX:-}
    image: ethyca/fides:local${IMAGE_SUFFIX:-}
    command: python -m uvicorn --host 0.0.0.0 --port 8080 --reload --reload-dir src --reload-dir data --reload-include='*.yml' fides.api.main:app
    healthcheck:
      test: ["CMD", "curl", "-f", "http://0.0.0.0:8080/health"]
      interval: 20s
      timeout: 5s
      retries: 10
    ports:
      - "${API_PORT:-8080}:8080"
    depends_on:
      fides-db:
        condition: service_healthy
      redis:
        condition: service_started
    expose:
      - 8080
    env_file:
      - .env
    environment:
      # Use pre-built venv at /opt/fides so "uv run" does not create/sync .venv (avoids C extension rebuilds)
      UV_PROJECT_ENVIRONMENT: /opt/fides
      FIDES__CONFIG_PATH: ${FIDES__CONFIG_PATH:-/fides/.fides/fides.toml}
      FIDES__CLI__ANALYTICS_ID: ${FIDES__CLI__ANALYTICS_ID-}
      FIDES__CLI__SERVER_HOST: "fides"
      FIDES__CLI__SERVER_PORT: "8080"
      FIDES__DATABASE__SERVER: "fides-db"
      FIDES__DEV_MODE: "True"
      FIDES__LOGGING__COLORIZE: "True"
      FIDES__USER__ANALYTICS_OPT_OUT: "True"
      # Default auth rate limit; override via env for tests/perf as needed
      FIDES__SECURITY__AUTH_RATE_LIMIT: ${FIDES__SECURITY__AUTH_RATE_LIMIT:-10/minute}
      FIDES__SECURITY__BASTION_SERVER_HOST: ${FIDES__SECURITY__BASTION_SERVER_HOST-}
      FIDES__SECURITY__BASTION_SERVER_SSH_USERNAME: ${FIDES__SECURITY__BASTION_SERVER_SSH_USERNAME-}
      FIDES__SECURITY__BASTION_SERVER_SSH_PRIVATE_KEY: ${FIDES__SECURITY__BASTION_SERVER_SSH_PRIVATE_KEY-}
      SAAS_OP_SERVICE_ACCOUNT_TOKEN: ${SAAS_OP_SERVICE_ACCOUNT_TOKEN-}
      SAAS_SECRETS_OP_VAULT_ID: ${SAAS_SECRETS_OP_VAULT_ID-}
    volumes:
      - type: bind
        source: .
        target: /fides
        read_only: False

  fides-ui:
    image: ethyca/fides:local-ui${IMAGE_SUFFIX:-}
    container_name: fides-ui${CONTAINER_SUFFIX:-}
    command: npm run dev-admin-ui
    expose:
      - 3000
    ports:
      - "${ADMIN_UI_PORT:-3000}:3000"
    volumes:
      - type: bind
        source: .
        target: /fides
        read_only: False
      # do not volume mount over the node_modules
      - /fides/clients/node_modules
      - /fides/clients/admin-ui/node_modules
    environment:
      - NEXT_PUBLIC_FIDESCTL_API_SERVER=http://fides:8080

  fides-pc:
    image: ethyca/fides:local-pc${IMAGE_SUFFIX:-}
    container_name: fides-pc${CONTAINER_SUFFIX:-}
    command: npm run dev-pc
    expose:
      - 3001
    ports:
      - "${PRIVACY_CENTER_PORT:-3001}:3001"
    volumes:
      - type: bind
        source: .
        target: /fides
        read_only: False
      # do not volume mount over the node_modules
      - /fides/clients/node_modules
      - /fides/clients/privacy-center/node_modules

  fides-db:
    image: postgres:16
    container_name: fides-db${CONTAINER_SUFFIX:-}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 15s
      timeout: 5s
      retries: 5
    volumes:
      - postgres:/var/lib/postgresql/data
    expose:
      - 5432
    ports:
      - "${DB_PORT:-5432}:5432"
    environment:
      POSTGRES_USER: "postgres"
      POSTGRES_PASSWORD: "fides"
      POSTGRES_DB: "fides"
    deploy:
      placement:
        constraints:
          - node.labels.fides.app-db-data == true

  docs:
    build:
      context: .
      dockerfile: docs/fides/Dockerfile
    volumes:
      - ./docs/fides:/docs
      - ./:/fides
    expose:
      - 8000
    ports:
      - "8000:8000"
    environment:
      FIDES__DEV_MODE: True
      FIDES__CLI__ANALYTICS_ID: ${FIDES__CLI__ANALYTICS_ID-}

      # Required security env vars
      FIDES__SECURITY__APP_ENCRYPTION_KEY: OLMkv91j8DHiDAULnK5Lxx3kSCov30b3
      FIDES__SECURITY__OAUTH_ROOT_CLIENT_ID: fidesadmin
      FIDES__SECURITY__OAUTH_ROOT_CLIENT_SECRET: fidesadminsecret
      FIDES__SECURITY__DRP_JWT_SECRET: secret

  worker-other:
    image: ethyca/fides:local${IMAGE_SUFFIX:-}
    command: fides worker --reload --reload-dir src --reload-dir data --exclude-queues=fides.dsr,fides.privacy_preferences,fides.privacy_request_exports,fides.privacy_request_ingestion,fidesplus.discovery_monitors_detection,fidesplus.discovery_monitors_classification,fidesplus.discovery_monitors_promotion # exclude DSRs, privacy preferences, and discovery monitor queues
    depends_on:
      redis:
        condition: service_started
    restart: always
    healthcheck:
      test: ["CMD", "/opt/fides/bin/python", "-m", "celery", "-A", "fides.api.tasks", "inspect", "ping"]
      start_period: 60s
      interval: 20s
      timeout: 20s
      retries: 10
    env_file:
      - .env
    environment:
      FIDES__CONFIG_PATH: ${FIDES__CONFIG_PATH:-/fides/.fides/fides.toml}
      FIDES__LOGGING__COLORIZE: "True"
      FIDES__USER__ANALYTICS_OPT_OUT: "True"
      # The default HTTP health check port is 9000, override it here to ensure that
      # the override works as expected.
      FIDES__CELERY__HEALTHCHECK_PORT: "9001"
    expose:
        - 9001
    volumes:
      - type: bind
        source: ./
        target: /fides
        read_only: False
      - /fides/src/fides.egg-info

  worker-privacy-preferences:
    extends:
      service: worker-other
    command: fides worker --reload --reload-dir src --reload-dir data --queues=fides.privacy_preferences,fides.privacy_request_exports,fides.privacy_request_ingestion

  worker-dsr:
    extends:
      service: worker-other
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9001/"]
    command: fides worker --reload --reload-dir src --reload-dir data --queues=fides.dsr

  redis:
    image: "redis:8.0-alpine"
    container_name: fides-redis${CONTAINER_SUFFIX:-}
    # AUTH option #1: no authentication at all
    # command: redis-server
    # AUTH option #2: require password
    command: redis-server --requirepass redispassword
    # AUTH option #3: Redis ACL defined in redis.conf
    # command: redis-server /usr/local/etc/redis/redis.conf
    expose:
      - 6379
    ports:
      - "0.0.0.0:${REDIS_PORT:-6379}:6379"
    volumes:
      # Mount a redis.conf file for configuration
      # NOTE: Only used by "AUTH option #3" above!
      - type: bind
        source: ./docker/redis
        target: /usr/local/etc/redis
        read_only: False

  flower:
    image: mher/flower:2.0
    command: celery flower --broker=redis://:redispassword@redis:6379/0
    ports:
      - "5555:5555"
    depends_on:
      - redis
    environment:
      - CELERY_BROKER_URL=redis://:redispassword@redis:6379/0
      - CELERY_RESULT_BACKEND=redis://:redispassword@redis:6379/0

  # Redis Cluster (3 nodes) for cluster-mode testing. Standalone redis above for regular use.
  # Cluster forms with Docker hostnames so nodes can reach each other. Run cluster tests
  # FROM INSIDE the stack so the client can reach all nodes: docker compose run --rm fides
  #   env FIDES__REDIS__CLUSTER_ENABLED=true FIDES__REDIS__HOST=redis-cluster-node-1
  #   FIDES__REDIS__PORT=6379 FIDES__REDIS__PASSWORD=redispassword
  #   uv run pytest tests/ops/util/test_cache.py::TestRedisClusterMode -v
  # After any change here: docker compose down && docker compose up -d.
  redis-cluster-node-1:
    <<: *redis-cluster-node
    ports:
      - "6380:6379"
      - "16380:16379"

  redis-cluster-node-2:
    <<: *redis-cluster-node
    ports:
      - "6381:6379"
      - "16381:16379"

  redis-cluster-node-3:
    <<: *redis-cluster-node
    ports:
      - "6382:6379"
      - "16382:16379"

  redis-cluster-init:
    image: redis:7-alpine
    command: >
      sh -c "
        echo 'Waiting for Redis cluster nodes...' &&
        until redis-cli -h redis-cluster-node-1 -p 6379 -a redispassword ping 2>/dev/null; do sleep 1; done &&
        until redis-cli -h redis-cluster-node-2 -p 6379 -a redispassword ping 2>/dev/null; do sleep 1; done &&
        until redis-cli -h redis-cluster-node-3 -p 6379 -a redispassword ping 2>/dev/null; do sleep 1; done &&
        if redis-cli -h redis-cluster-node-1 -p 6379 -a redispassword cluster info 2>/dev/null | grep -q 'cluster_state:ok'; then
          echo 'Cluster already exists, skipping create.';
        else
          echo 'Resetting any existing cluster state...' &&
          redis-cli -h redis-cluster-node-1 -p 6379 -a redispassword cluster reset soft 2>/dev/null || true &&
          redis-cli -h redis-cluster-node-2 -p 6379 -a redispassword cluster reset soft 2>/dev/null || true &&
          redis-cli -h redis-cluster-node-3 -p 6379 -a redispassword cluster reset soft 2>/dev/null || true &&
          sleep 2 &&
          echo 'Creating cluster...' &&
          redis-cli -a redispassword --cluster create redis-cluster-node-1:6379 redis-cluster-node-2:6379 redis-cluster-node-3:6379 --cluster-yes &&
          echo 'Redis Cluster ready.';
        fi
      "
    depends_on:
      redis-cluster-node-1: { condition: service_healthy }
      redis-cluster-node-2: { condition: service_healthy }
      redis-cluster-node-3: { condition: service_healthy }
    restart: "no"

  # Valkey standalone for cache/Celery tests (Redis-compatible).
  # Run same tests with FIDES__REDIS__HOST=valkey FIDES__REDIS__CLUSTER_ENABLED=false.
  valkey:
    image: valkey/valkey:9.0.3-alpine
    container_name: fides-valkey${CONTAINER_SUFFIX:-}
    command: valkey-server --requirepass redispassword
    expose:
      - 6379
    ports:
      - "0.0.0.0:6399:6379"
    healthcheck:
      test: ["CMD", "valkey-cli", "-p", "6379", "-a", "redispassword", "ping"]
      interval: 2s
      timeout: 3s
      retries: 10

  # Valkey Cluster (3 nodes) for cluster-mode testing alongside Redis cluster.
  # Same test suite as Redis cluster; run with FIDES__REDIS__CLUSTER_ENABLED=true
  # FIDES__REDIS__HOST=valkey-cluster-node-1 FIDES__REDIS__PORT=6379.
  valkey-cluster-node-1:
    <<: *valkey-cluster-node
    ports:
      - "6390:6379"
      - "16390:16379"

  valkey-cluster-node-2:
    <<: *valkey-cluster-node
    ports:
      - "6391:6379"
      - "16391:16379"

  valkey-cluster-node-3:
    <<: *valkey-cluster-node
    ports:
      - "6392:6379"
      - "16392:16379"

  valkey-cluster-init:
    image: valkey/valkey:9.0.3-alpine
    command: >
      sh -c "
        echo 'Waiting for Valkey cluster nodes...' &&
        until valkey-cli -h valkey-cluster-node-1 -p 6379 -a redispassword ping 2>/dev/null; do sleep 1; done &&
        until valkey-cli -h valkey-cluster-node-2 -p 6379 -a redispassword ping 2>/dev/null; do sleep 1; done &&
        until valkey-cli -h valkey-cluster-node-3 -p 6379 -a redispassword ping 2>/dev/null; do sleep 1; done &&
        if valkey-cli -h valkey-cluster-node-1 -p 6379 -a redispassword cluster info 2>/dev/null | grep -q 'cluster_state:ok'; then
          echo 'Valkey cluster already exists, skipping create.';
        else
          echo 'Resetting any existing cluster state...' &&
          valkey-cli -h valkey-cluster-node-1 -p 6379 -a redispassword cluster reset soft 2>/dev/null || true &&
          valkey-cli -h valkey-cluster-node-2 -p 6379 -a redispassword cluster reset soft 2>/dev/null || true &&
          valkey-cli -h valkey-cluster-node-3 -p 6379 -a redispassword cluster reset soft 2>/dev/null || true &&
          sleep 2 &&
          echo 'Creating Valkey cluster...' &&
          valkey-cli -a redispassword --cluster create valkey-cluster-node-1:6379 valkey-cluster-node-2:6379 valkey-cluster-node-3:6379 --cluster-replicas 0 --cluster-yes &&
          echo 'Valkey Cluster ready.';
        fi
      "
    depends_on:
      valkey-cluster-node-1: { condition: service_healthy }
      valkey-cluster-node-2: { condition: service_healthy }
      valkey-cluster-node-3: { condition: service_healthy }
    restart: "no"

  # Cluster services for nginx load balancing
  fides-1:
    container_name: fides-1
    image: ethyca/fides:local${IMAGE_SUFFIX:-}
    command: python -m uvicorn --host 0.0.0.0 --port 8080 --reload --reload-dir src --reload-dir data --reload-include='*.yml' fides.api.main:app
    healthcheck:
      test: ["CMD", "curl", "-f", "http://0.0.0.0:8080/health"]
      interval: 20s
      timeout: 5s
      retries: 10
    ports:
      - "8081:8080"
    depends_on:
      fides-db:
        condition: service_healthy
      redis:
        condition: service_started
    expose:
      - 8080
    env_file:
      - .env
    environment:
      FIDES__CONFIG_PATH: ${FIDES__CONFIG_PATH:-/fides/.fides/fides.toml}
      FIDES__CLI__ANALYTICS_ID: ${FIDES__CLI__ANALYTICS_ID-}
      FIDES__CLI__SERVER_HOST: "fides"
      FIDES__CLI__SERVER_PORT: "8080"
      FIDES__DATABASE__SERVER: "fides-db"
      FIDES__DEV_MODE: "True"
      FIDES__LOGGING__COLORIZE: "True"
      FIDES__USER__ANALYTICS_OPT_OUT: "True"
      FIDES__SECURITY__BASTION_SERVER_HOST: ${FIDES__SECURITY__BASTION_SERVER_HOST-}
      FIDES__SECURITY__BASTION_SERVER_SSH_USERNAME: ${FIDES__SECURITY__BASTION_SERVER_SSH_USERNAME-}
      FIDES__SECURITY__BASTION_SERVER_SSH_PRIVATE_KEY: ${FIDES__SECURITY__BASTION_SERVER_SSH_PRIVATE_KEY-}
      SAAS_OP_SERVICE_ACCOUNT_TOKEN: ${SAAS_OP_SERVICE_ACCOUNT_TOKEN-}
      SAAS_SECRETS_OP_VAULT_ID: ${SAAS_SECRETS_OP_VAULT_ID-}
    volumes:
      - type: bind
        source: .
        target: /fides
        read_only: False

  fides-2:
    container_name: fides-2
    image: ethyca/fides:local${IMAGE_SUFFIX:-}
    command: python -m uvicorn --host 0.0.0.0 --port 8080 --reload --reload-dir src --reload-dir data --reload-include='*.yml' fides.api.main:app
    healthcheck:
      test: ["CMD", "curl", "-f", "http://0.0.0.0:8080/health"]
      interval: 20s
      timeout: 5s
      retries: 10
    ports:
      - "8082:8080"
    depends_on:
      fides-db:
        condition: service_healthy
      redis:
        condition: service_started
    expose:
      - 8080
    env_file:
      - .env
    environment:
      FIDES__CONFIG_PATH: ${FIDES__CONFIG_PATH:-/fides/.fides/fides.toml}
      FIDES__CLI__ANALYTICS_ID: ${FIDES__CLI__ANALYTICS_ID-}
      FIDES__CLI__SERVER_HOST: "fides"
      FIDES__CLI__SERVER_PORT: "8080"
      FIDES__DATABASE__SERVER: "fides-db"
      FIDES__DEV_MODE: "True"
      FIDES__LOGGING__COLORIZE: "True"
      FIDES__USER__ANALYTICS_OPT_OUT: "True"
      FIDES__SECURITY__BASTION_SERVER_HOST: ${FIDES__SECURITY__BASTION_SERVER_HOST-}
      FIDES__SECURITY__BASTION_SERVER_SSH_USERNAME: ${FIDES__SECURITY__BASTION_SERVER_SSH_USERNAME-}
      FIDES__SECURITY__BASTION_SERVER_SSH_PRIVATE_KEY: ${FIDES__SECURITY__BASTION_SERVER_SSH_PRIVATE_KEY-}
      SAAS_OP_SERVICE_ACCOUNT_TOKEN: ${SAAS_OP_SERVICE_ACCOUNT_TOKEN-}
      SAAS_SECRETS_OP_VAULT_ID: ${SAAS_SECRETS_OP_VAULT_ID-}
    volumes:
      - type: bind
        source: .
        target: /fides
        read_only: False

  fides-proxy:
    container_name: fides-proxy
    image: nginx:latest
    ports:
      - "8083:8080"
    volumes:
      - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      fides-1:
        condition: service_healthy
      fides-2:
        condition: service_healthy

volumes:
  postgres: null

networks:
  fides_network: