services:

db:

image: pgvector/pgvector:pg16

environment:

POSTGRES_USER: statewave

POSTGRES_PASSWORD: statewave

POSTGRES_DB: statewave

ports:

- "${STATEWAVE_DB_HOST_PORT:-5432}:5432"

volumes:

- pgdata:/var/lib/postgresql/data

healthcheck:

test: ["CMD-SHELL", "pg_isready -U statewave"]

interval: 2s

timeout: 5s

retries: 10

api:

# Default to the published multi-arch image — `docker compose up -d` works

# without a local checkout. Pin a version with STATEWAVE_VERSION=1.3.0.

# Contributors who want to rebuild locally: `docker compose build api`

# rebuilds from the Dockerfile in this repo and tags the same name.

image: statewavedev/statewave:${STATEWAVE_VERSION:-latest}

build: .

ports:

- "${STATEWAVE_API_HOST_PORT:-8100}:8100"

# Load STATEWAVE_LITELLM_*, STATEWAVE_API_KEY, etc. from the host's .env.

# `.dockerignore` keeps .env OUT of the image — env_file injects values

# at runtime so the docker-compose `environment:` block below remains

# the single source of truth for connection-level wiring (DB URL, debug).

env_file:

- path: .env

required: false

environment:

# Override anything from .env that would point at host networking —

# inside the compose network, the database is reachable as `db`.

STATEWAVE_DATABASE_URL: postgresql+asyncpg://statewave:statewave@db:5432/statewave

# Human-readable console logs instead of JSON. It has no effect on

# authentication: whether the API key is checked depends only on

# STATEWAVE_API_KEY (see server/core/auth.py).

STATEWAVE_DEBUG: "true"

# Auto-bootstrap the Statewave Support docs pack on first start so

# the docs-grounded persona in statewave-web answers from real

# content out of the box. Idempotent — re-runs are no-ops once the

# subject is populated. Set to "false" to skip.

STATEWAVE_BOOTSTRAP_DOCS_PACK: "true"

STATEWAVE_DOCS_PATH: /docs

volumes:

# Read-only mount of the sibling statewave-docs checkout. The

# bootstrap script reads the markdown corpus from here. If the

# sibling repo isn't checked out, this resolves to an empty dir

# and start.sh's bootstrap step silently skips.

- ../statewave-docs:/docs:ro

depends_on:

db:

condition: service_healthy

admin:

# Statewave admin console — operator UI for browsing subjects, episodes,

# memories, starter packs. `docker compose up -d` brings it up alongside

# the API; reach it at http://localhost:8080.

#

# Optional: a contributor who doesn't want the admin running locally can

# start just the core stack with `docker compose up -d api db`.

image: statewavedev/statewave-admin:${STATEWAVE_ADMIN_VERSION:-latest}

ports:

- "${STATEWAVE_ADMIN_HOST_PORT:-8080}:8080"

environment:

# Talks to the api over the compose network — both containers see each

# other by service name. The browser hits the admin's own server, which

# proxies API calls server-side, so this URL never leaves the compose

# network.

STATEWAVE_API_URL: http://api:8100

# Reads STATEWAVE_API_KEY from your environment / .env, falling back to

# a local dev placeholder so a fresh `docker compose up -d` works with

# no setup: when no key is configured anywhere, the api leaves API-key

# auth switched off entirely (server/core/auth.py skips the check when

# the key is empty) and never looks at the placeholder value.

#

# Set STATEWAVE_API_KEY once, in the .env next to this file or in your

# shell, and compose hands the same value to both services: the api

# picks it up through env_file, the admin through the interpolation

# below. A wrong key is a 403 regardless of STATEWAVE_DEBUG, which

# does not relax authentication.

STATEWAVE_API_KEY: ${STATEWAVE_API_KEY:-dev-local-placeholder}

NODE_ENV: production

# Operator-console auth. The admin requires either a configured password

# OR an explicit auth-disabled flag. We default to disabled here for the

# same reason the api starts with auth off when no key is configured: a

# fresh `docker compose up -d` should work without you having to invent

# a password first.

#

# Production: override by setting ADMIN_AUTH_DISABLED= (empty) AND

# supplying ADMIN_PASSWORD + ADMIN_SESSION_SECRET via your env or .env

# file. The two operator-console-side variables flow through unchanged

# — there is no fallback if both are absent and ADMIN_AUTH_DISABLED is

# also empty, which is what surfaces the "Admin is not configured"

# screen.

ADMIN_AUTH_DISABLED: ${ADMIN_AUTH_DISABLED:-true}

ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}

ADMIN_SESSION_SECRET: ${ADMIN_SESSION_SECRET:-}

depends_on:

api:

condition: service_started

volumes:

pgdata: