docker-compose.yml

# UMA for Agents — the demo stack.
#   make init && make up && make smoke-test
# See docs/ARCHITECTURE.md for the system design.
#
# The tokens/passwords below are LOCAL LAB demo defaults, not secrets. Override
# them via a .env file (see .env.example) and never reuse them anywhere real or
# expose this stack on a public network.

services:
  dns:
    init: true
    image: docker.io/hickorydns/hickory-dns:0.25.2
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    volumes:
      - ./dns/named.toml:/etc/named.toml:ro
      - ./dns/uma.lab.zone:/var/named/uma.lab.zone:ro

  edge:
    init: true
    image: envoyproxy/envoy:v1.34-latest
    command: ["-c", "/etc/envoy/envoy.yaml", "--log-level", "warn"]
    ports:
      - "443:443"
    volumes:
      - ./edge/envoy.yaml:/etc/envoy/envoy.yaml:ro
      - ./certs/edge-server.pem:/certs/edge-server.pem:ro
      - ./certs/edge-server-key.pem:/certs/edge-server-key.pem:ro
    networks:
      default:
        aliases:
          - alice-as.uma.lab
          - keycloak.uma.lab
          - gateway.uma.lab
          - portal.uma.lab
          - grafana.uma.lab
          - ps.uma.lab
          - agent.uma.lab

  keycloak:
    init: true
    image: quay.io/keycloak/keycloak:26.4.5
    command: start-dev --import-realm --health-enabled=true
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD:-uma4agents-admin}
      KC_HEALTH_ENABLED: "true"
      KC_HOSTNAME: https://keycloak.uma.lab
      KC_HTTP_ENABLED: "true"
      KC_PROXY_HEADERS: xforwarded
    volumes:
      - ./keycloak/:/opt/keycloak/data/import:ro
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n' >&3 && head -1 <&3 | grep -q 200"]
      interval: 5s
      timeout: 10s
      retries: 30
      start_period: 30s

  uma-as:
    init: true
    build:
      context: .
      dockerfile: services/uma-as/Dockerfile
    environment:
      UMA_AS_RS_RESOURCE_URI: https://gateway.uma.lab/mcp
      UMA_AS_ISSUER: https://alice-as.uma.lab
      # The resource-server client the AS issues PATs to (client_credentials,
      # scope uma_protection). Alice's day-0 consent for it is seeded.
      UMA_AS_RS_CLIENT_ID: meridian-gateway
      UMA_AS_RS_CLIENT_SECRET: ${UMA_AS_RS_CLIENT_SECRET:-gateway-dev-secret}
      # Two independent credentials for one person: her browser session, and a
      # key her device holds. The portal uses the first; a personal AI holding
      # her key uses the second. Neither is a fallback for the other.
      UMA_AS_OWNER_AUTH: oidc,local-key
      UMA_AS_OWNER_ISSUER: https://keycloak.uma.lab/realms/alice
      UMA_AS_OWNER_KEY: /owner/owner-ed25519.pub
      UMA_AS_OWNER_AUTHORITY: alice-as.uma.lab
      # Her attention, in two lanes. Declared on the server *and* read from the
      # same variable by the check below, so the two cannot drift into a false
      # failure — a checker counting to a number the server does not enforce.
      UMA_AS_PEND_BUDGET: ${UMA_AS_PEND_BUDGET:-5}
      UMA_AS_PEND_BUDGET_ATTRIBUTED: ${UMA_AS_PEND_BUDGET_ATTRIBUTED:-40}
      UMA_AS_OWNER: alice
      # Trust bundle for verifying issuers' TLS (AAuth dwk discovery and the
      # realm's JWKS both ride https; the lab CA signs *.uma.lab).
      UMA4A_CA_BUNDLE: /certs/rootCA.pem
    volumes:
      - uma-as-keys:/keys
      - ./certs/rootCA.pem:/certs/rootCA.pem:ro
      # Only the public half. Her private key never leaves her side.
      - ./certs/owner-ed25519.pub:/owner/owner-ed25519.pub:ro
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import urllib.request;urllib.request.urlopen('http://localhost:9000/health')\""]
      interval: 3s
      timeout: 5s
      retries: 10

  uma-pep:
    init: true
    build:
      context: .
      dockerfile: services/uma-pep/Dockerfile
    environment:
      UMA_AS_PUBLIC: https://alice-as.uma.lab
      UMA_AS_INTERNAL: http://uma-as:9000
      UMA_AS_RS_CLIENT_ID: meridian-gateway
      UMA_AS_RS_CLIENT_SECRET: ${UMA_AS_RS_CLIENT_SECRET:-gateway-dev-secret}
      UMA_REALM: alice-vault
    volumes:
      - uma-pep-keys:/keys
    depends_on:
      uma-as:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import urllib.request;urllib.request.urlopen('http://localhost:9002/health')\""]
      interval: 3s
      timeout: 5s
      retries: 10

  agentgateway:
    image: ghcr.io/agentgateway/agentgateway:v1.4.0
    command: ["-f", "/etc/agentgateway/config.yaml"]
    volumes:
      - ./gateway/agw.yaml:/etc/agentgateway/config.yaml:ro
    depends_on:
      uma-pep:
        condition: service_healthy

  alice-vault-mcp:
    init: true
    build:
      context: .
      dockerfile: mcp/alice-vault/Dockerfile
    environment:
      # gateway (default): an ext_authz service ahead of this server carries
      # the FedAuthz obligations and this process holds no auth code.
      # embedded: the same enforcement core runs here as an MCP Extension, and
      # the gateway is not in the authorization path at all.
      ENFORCEMENT_MODE: ${ENFORCEMENT_MODE:-gateway}
      UMA_AS_PUBLIC: https://alice-as.uma.lab
      UMA_AS_INTERNAL: http://uma-as:9000
      UMA_AS_RS_CLIENT_ID: meridian-gateway
      UMA_AS_RS_CLIENT_SECRET: ${UMA_AS_RS_CLIENT_SECRET:-gateway-dev-secret}
      UMA_REALM: alice-vault
      UMA_EXPECTED_AUTHORITY: gateway.uma.lab
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import socket;socket.create_connection(('localhost',9020),2)\""]
      interval: 3s
      timeout: 5s
      retries: 10

  # Bob's agent operator's public web presence: the CIMD document Alice's AS
  # resolves for her approval dialog, and the Web Bot Auth key directory a
  # resource can consult before any relationship exists.
  agent-operator:
    init: true
    build: ./clients/agent-operator
    environment:
      AGENT_OPERATOR_ORIGIN: https://agent.uma.lab
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import urllib.request;urllib.request.urlopen('http://localhost:9030/health')\""]
      interval: 3s
      timeout: 5s
      retries: 10

  alice-portal:
    init: true
    build: ./services/alice-portal
    environment:
      UMA_AS_INTERNAL: http://uma-as:9000
      PORTAL_AUTH: ${PORTAL_AUTH:-oidc}
      OIDC_ISSUER: https://keycloak.uma.lab/realms/alice
      OIDC_CLIENT_ID: alice-portal
      PORTAL_SESSION_SECRET: ${PORTAL_SESSION_SECRET:-dev-session-secret}
      VAULT_MCP_URL: http://alice-vault-mcp:9020/mcp
      SSL_CERT_FILE: /certs/rootCA.pem
    volumes:
      - ./certs/rootCA.pem:/certs/rootCA.pem:ro
    depends_on:
      keycloak:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import urllib.request;urllib.request.urlopen('http://localhost:9010/health')\""]
      interval: 3s
      timeout: 5s
      retries: 10

  person-server:
    init: true
    build:
      context: ./aauth
      dockerfile: person-server.Dockerfile
    environment:
      AAUTH_DATABASE_URL: sqlite:////data/aauth.db
      AAUTH_PS_SIGNING_KEY_PATH: /data/.aauth/ps-signing-key.pem
      AAUTH_AS_SIGNING_KEY_PATH: /data/.aauth/as-signing-key.pem
      AAUTH_PS_PUBLIC_ORIGIN: https://ps.uma.lab
      AAUTH_AS_PUBLIC_ORIGIN: https://ps.uma.lab
      AAUTH_AS_SERVER_DOMAIN: ps.uma.lab
      AAUTH_PS_ADMIN_TOKEN: ${PS_ADMIN_TOKEN:-uma4agents-ps-admin}
      AAUTH_AS_PERSON_TOKEN: ${PS_ADMIN_TOKEN:-uma4agents-ps-admin}
      AAUTH_PS_INSECURE_DEV: "true"
      AAUTH_AS_INSECURE_DEV: "true"
    volumes:
      - ps-data:/data
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8765/.well-known/aauth-person.json"]
      interval: 5s
      timeout: 5s
      retries: 15

  loki:
    init: true
    image: grafana/loki:3.4.2
    command: ["-config.file=/etc/loki/local-config.yaml"]

  promtail:
    init: true
    image: grafana/promtail:3.4.2
    command: ["-config.file=/etc/promtail/promtail.yaml"]
    volumes:
      - ./observability/promtail.yaml:/etc/promtail/promtail.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on:
      - loki

  grafana:
    init: true
    image: grafana/grafana:11.6.0
    environment:
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Admin
      GF_SERVER_ROOT_URL: https://grafana.uma.lab
      GF_USERS_DEFAULT_THEME: dark
    volumes:
      - ./observability/grafana-datasources.yaml:/etc/grafana/provisioning/datasources/datasources.yaml:ro
      - ./observability/grafana-dashboards.yaml:/etc/grafana/provisioning/dashboards/dashboards.yaml:ro
      - ./observability/dashboards:/var/lib/grafana/dashboards:ro
    depends_on:
      - loki

  # Headless walker for the demo acts (same grant code path as the agent-shim).
  demo-driver:
    image: python:3.12-slim
    entrypoint:
      - /bin/bash
      - -c
      - pip install -q httpx 'pyjwt[crypto]' 'aauth==0.3.2' && exec python /driver/driver.py --cacert /driver/rootCA.pem "$$@"
      - --
    environment:
      PYTHONPATH: /driver/lib
      PYTHONUNBUFFERED: "1"
      PS_ADMIN_TOKEN: ${PS_ADMIN_TOKEN:-uma4agents-ps-admin}
    volumes:
      - ./clients/demo-driver/driver.py:/driver/driver.py:ro
      - ./lib:/driver/lib:ro
      - ./certs/rootCA.pem:/driver/rootCA.pem:ro
      # Bob's agent's long-term (stable) key survives runs, so the agent
      # server recognizes the agent and Alice's connection stays standing.
      - driver-keys:/driver/keys
    working_dir: /driver
    profiles: ["demo"]

  # Four agents, four identity regimes, one unchanged owner. Verifies that
  # nothing about who the agent is reaches Alice's authorization decision.
  intent-check:
    image: python:3.12-slim
    entrypoint:
      - /bin/bash
      - -c
      - pip install -q httpx 'pyjwt[crypto]' && exec python /driver/intent_check.py
    environment:
      PYTHONPATH: /driver/lib
      PYTHONUNBUFFERED: "1"
      UMA_AS_MAX_REASON: ${UMA_AS_MAX_REASON:-512}
    volumes:
      - ./clients/demo-driver/intent_check.py:/driver/intent_check.py:ro
      - ./lib:/driver/lib:ro
      - ./certs/rootCA.pem:/driver/rootCA.pem:ro
      - driver-keys:/driver/keys
    profiles: ["test"]

  assurance-check:
    image: python:3.12-slim
    entrypoint:
      - /bin/bash
      - -c
      - pip install -q httpx 'pyjwt[crypto]' && exec python /driver/assurance_check.py
    environment:
      PYTHONPATH: /driver/lib
      PYTHONUNBUFFERED: "1"
      UMA_AS_PEND_BUDGET: ${UMA_AS_PEND_BUDGET:-5}
    volumes:
      - ./clients/demo-driver/assurance_check.py:/driver/assurance_check.py:ro
      - ./lib:/driver/lib:ro
      - ./certs/rootCA.pem:/driver/rootCA.pem:ro
      - driver-keys:/driver/keys
    profiles: ["test"]

  # The U4A adapter as a service: the same shim Bob runs beside Claude Code,
  # reachable over the network so an agent that is not a local process can use
  # it. Off by default; `make adapter` starts it.
  agent-shim:
    init: true
    image: python:3.12-slim
    entrypoint:
      - /bin/bash
      - -c
      - pip install -q 'mcp>=2,<3' httpx 'pyjwt[crypto]' && exec python /shim/shim.py
    environment:
      UMA4A_SHIM_TRANSPORT: streamable-http
      UMA4A_SHIM_HOST: 0.0.0.0
      UMA4A_SHIM_PORT: "9030"
      UMA4A_GATEWAY: https://gateway.uma.lab/mcp
      UMA4A_CACERT: /certs/rootCA.pem
      UMA4A_KEYSTORE: /keys/agent-key.pem
      # No interactive client above it, so Alice's terms are decided by Bob's
      # standing configuration — bounded, and set by a person in advance.
      UMA4A_STANDING_MAX_EXPIRES: "604800"
      PYTHONPATH: /shim/lib
      PYTHONUNBUFFERED: "1"
    volumes:
      - ./clients/agent-shim/shim.py:/shim/shim.py:ro
      - ./lib:/shim/lib:ro
      - ./certs/rootCA.pem:/certs/rootCA.pem:ro
      - driver-keys:/keys
    profiles: ["adapter"]

  adapter-check:
    image: python:3.12-slim
    entrypoint:
      - /bin/bash
      - -c
      - pip install -q 'mcp>=2,<3' httpx && exec python /driver/adapter_check.py
    environment:
      UMA4A_SHIM_URL: http://agent-shim:9030/mcp
      PYTHONUNBUFFERED: "1"
    volumes:
      - ./clients/demo-driver/adapter_check.py:/driver/adapter_check.py:ro
      - ./certs/rootCA.pem:/driver/rootCA.pem:ro
    profiles: ["adapter"]

  flow-check:
    image: python:3.12-slim
    entrypoint:
      - /bin/bash
      - -c
      - pip install -q httpx 'pyjwt[crypto]' 'aauth==0.3.2' && exec python /driver/flow_check.py
    environment:
      PYTHONPATH: /driver/lib
      PYTHONUNBUFFERED: "1"
      PS_ADMIN_TOKEN: ${PS_ADMIN_TOKEN:-uma4agents-ps-admin}
    volumes:
      - ./clients/demo-driver/flow_check.py:/driver/flow_check.py:ro
      - ./lib:/driver/lib:ro
      - ./certs/rootCA.pem:/driver/rootCA.pem:ro
      - driver-keys:/driver/keys
    working_dir: /driver
    profiles: ["test"]

  # Kwaai's pAI-OS, with the U4A ability installed under abilities/.
  #
  # A personal AI running beside the rest of the lab, holding Alice's key and
  # answering her authorization server when somebody else's agent asks for
  # something of hers. Built from a pinned upstream ref by `make
  # fetch-upstream`, with one directory added — which is how pAI-OS takes an
  # extension.
  paios:
    init: true
    build:
      context: .
      dockerfile: kwaai/Dockerfile
    environment:
      PAIOS_HOST: 0.0.0.0
      U4A_AUTHORITY_URL: https://alice-as.uma.lab
      U4A_AUTHORITY_NAME: alice-as.uma.lab
      U4A_OWNER_KEY: /owner/owner-ed25519.pem
      U4A_CA_BUNDLE: /certs/rootCA.pem
      # Her standing consent, set by her. Without it the ability denies
      # everything, because pAI-OS gives it no way to ask her.
      U4A_AUTO_TIERS: ${PAIOS_AUTO_TIERS:-tier1}
      SSL_CERT_FILE: /certs/rootCA.pem
    volumes:
      # Her private key. Only this container and she have it; her
      # authorization server holds the public half.
      - ./certs/owner-ed25519.pem:/owner/owner-ed25519.pem:ro
      - ./certs/rootCA.pem:/certs/rootCA.pem:ro
      - paios-data:/opt/paios/data
    depends_on:
      uma-as:
        condition: service_healthy
    profiles: ["kwaai"]

  # The personal-AI binding against the full stack: her authority, her portal,
  # the gateway and the vault all as they really are — and a personal AI
  # holding her key instead of a browser session.
  kwaai-check:
    image: python:3.12-slim
    entrypoint:
      - /bin/bash
      - -c
      - pip install -q httpx 'pyjwt[crypto]' cryptography && exec python /kwaai/check.py
    environment:
      PYTHONPATH: /driver/lib
      PYTHONUNBUFFERED: "1"
    volumes:
      - ./kwaai:/kwaai:ro
      - ./lib:/driver/lib:ro
      - ./certs/rootCA.pem:/driver/rootCA.pem:ro
      - ./certs/owner-ed25519.pem:/owner/owner-ed25519.pem:ro
      - driver-keys:/driver/keys
    working_dir: /driver
    profiles: ["test"]

  # Verifies the four-beat grant against a resource that protects itself:
  # ENFORCEMENT_MODE=embedded, no gateway and no ext_authz in the path.
  embedded-check:
    image: python:3.12-slim
    entrypoint:
      - /bin/bash
      - -c
      - pip install -q httpx 'pyjwt[crypto]' && exec python /driver/embedded_check.py
    environment:
      PYTHONPATH: /driver/lib
      PYTHONUNBUFFERED: "1"
    volumes:
      - ./clients/demo-driver/embedded_check.py:/driver/embedded_check.py:ro
      - ./lib:/driver/lib:ro
      - ./certs/rootCA.pem:/driver/rootCA.pem:ro
      - driver-keys:/driver/keys
    working_dir: /driver
    profiles: ["test"]

  # Headless verification of the agent-shim under a scripted MCP client.
  shim-test:
    image: python:3.12-slim
    entrypoint:
      - /bin/bash
      - -c
      - pip install -q 'mcp>=2,<3' httpx 'pyjwt[crypto]' && exec python /repo/clients/agent-shim/test_shim.py
    environment:
      PYTHONUNBUFFERED: "1"
    volumes:
      - ./:/repo:ro
    profiles: ["test"]

volumes:
  paios-data:
  uma-as-keys:
  uma-pep-keys:
  ps-data:
  driver-keys: