version: "3.9"

# Bernstein cluster-mode deployment

#

# Roles:

# bernstein-server - task server + web dashboard (port 8052)

# bernstein-orchestrator - reads the backlog, spawns workers via HTTP

# bernstein-worker - claims and executes tasks (scale with --scale)

# prometheus - scrapes /metrics from bernstein-server (port 9090)

# grafana - pre-built agent dashboards (port 3000, admin/admin)

# postgres - shared relational state for the task store

# redis - distributed locks and bulletin board

#

# Usage:

# docker compose up -d

# docker compose up --scale bernstein-worker=4

#

# Dashboards:

# Bernstein web UI → http://localhost:8052/dashboard

# Prometheus → http://localhost:9090

# Grafana → http://localhost:3000 (admin / admin)

#

# Required env vars (copy .env.example → .env):

# ANTHROPIC_API_KEY, OPENAI_API_KEY, BERNSTEIN_AUTH_TOKEN

x-bernstein-common: &bernstein-common

image: bernstein:latest

build:

context: .

dockerfile: Dockerfile

environment:

BERNSTEIN_SERVER_URL: http://bernstein-server:8052

BERNSTEIN_AUTH_TOKEN: ${BERNSTEIN_AUTH_TOKEN:-changeme}

BERNSTEIN_BIND_HOST: "0.0.0.0"

BERNSTEIN_CLUSTER_ENABLED: "true"

# LLM provider keys - set in .env

ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}

OPENAI_API_KEY: ${OPENAI_API_KEY:-}

GOOGLE_API_KEY: ${GOOGLE_API_KEY:-}

OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}

TAVILY_API_KEY: ${TAVILY_API_KEY:-}

# Database / cache URLs

BERNSTEIN_DATABASE_URL: postgresql://bernstein:bernstein@postgres:5432/bernstein # NOSONAR - development-only default, not used in production

BERNSTEIN_REDIS_URL: redis://redis:6379/0

volumes:

- sdd-data:/workspace/.sdd

- project-data:/workspace/project

depends_on:

bernstein-server:

condition: service_healthy

restart: unless-stopped

services:

# ── Task server ────────────────────────────────────────────────────────────

# Runs uvicorn directly so the container's PID 1 is the server (not a wrapper).

# The BERNSTEIN_* env vars are read by the FastAPI app at module load time.

bernstein-server:

image: bernstein:latest

build:

context: .

dockerfile: Dockerfile

entrypoint: ["python", "-m", "uvicorn"]

command:

- "bernstein.core.server:app"

- "--host"

- "0.0.0.0"

- "--port"

- "8052"

environment:

BERNSTEIN_BIND_HOST: "0.0.0.0"

BERNSTEIN_CLUSTER_ENABLED: "true"

BERNSTEIN_AUTH_TOKEN: ${BERNSTEIN_AUTH_TOKEN:-changeme}

BERNSTEIN_DATABASE_URL: postgresql://bernstein:bernstein@postgres:5432/bernstein # NOSONAR - development-only default, not used in production

BERNSTEIN_REDIS_URL: redis://redis:6379/0

ports:

- "8052:8052"

volumes:

- sdd-data:/workspace/.sdd

depends_on:

postgres:

condition: service_healthy

redis:

condition: service_healthy

healthcheck:

test: ["CMD", "curl", "-f", "http://localhost:8052/health"]

interval: 10s

timeout: 5s

retries: 5

start_period: 15s

restart: unless-stopped

# ── Orchestrator ───────────────────────────────────────────────────────────

# Connects to bernstein-server via BERNSTEIN_SERVER_URL, claims tasks,

# and spawns CLI agents. Does NOT start its own server.

bernstein-orchestrator:

<<: *bernstein-common

entrypoint: ["python", "-m", "bernstein.core.orchestrator"]

command: []

depends_on:

bernstein-server:

condition: service_healthy

# ── Worker nodes (scale with: docker compose up --scale bernstein-worker=N) ─

# Each worker is an independent orchestrator instance that claims and executes

# tasks from the shared task server.

bernstein-worker:

<<: *bernstein-common

entrypoint: ["python", "-m", "bernstein.core.orchestrator"]

command: []

depends_on:

bernstein-server:

condition: service_healthy

# ── Monitoring ─────────────────────────────────────────────────────────────

# OTel Collector: receives OTLP from Bernstein agents, re-exports to Prometheus

# and optionally Jaeger/Datadog/New Relic.

# Profile: docker compose --profile otel up -d

otel-collector:

image: otel/opentelemetry-collector-contrib:0.152.1

profiles: [otel]

command: ["--config=/etc/otelcol/config.yaml"]

volumes:

- ./deploy/otel-collector/otel-collector-config.yaml:/etc/otelcol/config.yaml:ro

ports:

- "4317:4317" # OTLP gRPC

- "4318:4318" # OTLP HTTP

- "8888:8888" # Collector internal metrics (Prometheus)

- "8889:8889" # Bernstein metrics re-exported by collector

- "13133:13133" # Health check

- "55679:55679" # zPages debug UI

environment:

JAEGER_ENDPOINT: ${JAEGER_ENDPOINT:-jaeger:4317}

DATADOG_API_KEY: ${DATADOG_API_KEY:-}

DD_SITE: ${DD_SITE:-datadoghq.com}

NEWRELIC_API_KEY: ${NEWRELIC_API_KEY:-}

healthcheck:

test: ["CMD", "curl", "-f", "http://localhost:13133/healthz"]

interval: 10s

timeout: 5s

retries: 3

start_period: 10s

depends_on:

bernstein-server:

condition: service_healthy

restart: unless-stopped

# Jaeger all-in-one: receives traces from OTel Collector (profile: otel)

jaeger:

image: jaegertracing/all-in-one:1.60

profiles: [otel]

environment:

COLLECTOR_OTLP_ENABLED: "true"

ports:

- "16686:16686" # Jaeger UI

- "14317:4317" # OTLP gRPC (host port 14317 to avoid conflict with otel-collector)

restart: unless-stopped

prometheus:

image: prom/prometheus:v3.11.3

command:

- "--config.file=/etc/prometheus/prometheus.yml"

- "--storage.tsdb.path=/prometheus"

- "--storage.tsdb.retention.time=7d"

- "--web.enable-lifecycle"

volumes:

- ./deploy/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro

- prometheus-data:/prometheus

ports:

- "9090:9090"

depends_on:

bernstein-server:

condition: service_healthy

restart: unless-stopped

grafana:

image: grafana/grafana:13.0.1

environment:

GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}

GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}

GF_AUTH_ANONYMOUS_ENABLED: "true"

GF_AUTH_ANONYMOUS_ORG_ROLE: Viewer

GF_USERS_ALLOW_SIGN_UP: "false"

volumes:

- ./deploy/grafana/provisioning:/etc/grafana/provisioning:ro

- ./deploy/grafana/dashboard.json:/var/lib/grafana/dashboards/bernstein.json:ro

- ./deploy/grafana/dashboards:/var/lib/grafana/dashboards/extended:ro

- grafana-data:/var/lib/grafana

ports:

- "3000:3000"

depends_on:

- prometheus

restart: unless-stopped

# ── Infrastructure ─────────────────────────────────────────────────────────

postgres:

image: postgres:16-alpine

environment:

POSTGRES_USER: bernstein

POSTGRES_PASSWORD: bernstein # NOSONAR - development-only default, not used in production

POSTGRES_DB: bernstein

volumes:

- postgres-data:/var/lib/postgresql/data

healthcheck:

test: ["CMD-SHELL", "pg_isready -U bernstein"]

interval: 5s

timeout: 3s

retries: 5

restart: unless-stopped

redis:

image: redis:8-alpine

command: ["redis-server", "--appendonly", "yes"]

volumes:

- redis-data:/data

healthcheck:

test: ["CMD", "redis-cli", "ping"]

interval: 5s

timeout: 3s

retries: 5

restart: unless-stopped

volumes:

sdd-data:

driver: local

project-data:

driver: local

postgres-data:

driver: local

redis-data:

driver: local

prometheus-data:

driver: local

grafana-data:

driver: local