my-NexusTradingForexBot/docker-compose.yml

services:
  # ============================================================
  # Nexus Scalp Engine — Docker Compose (canonical dev/ops stack)
  # ============================================================
  # Default `docker compose up -d` starts the minimum viable healthy
  # project: the Nexus core (engine + Web UI + API) in container-safe
  # PAPER mode with persistent volumes for the SQLite databases and
  # model/research artifacts.
  #
  # Redis is FUTURE-ONLY infrastructure (nothing in src/ uses it yet):
  # it is NOT started by default. To start it, opt in explicitly:
  #     docker compose --profile redis up -d redis
  #
  # There is NO PostgreSQL dependency: the project's authoritative
  # persistence is per-domain SQLite (artifacts/audit.db, news.db,
  # candle_intel.db) plus the settings DB. The old postgres service was a
  # dead end (nothing in src/ ever connected to it) and has been removed.
  #
  # Runtime configuration remains authoritative (settings DB + YAML). The
  # environment variables declared here are BOOTSTRAP/DEVELOPMENT knobs
  # only — see .env.example and docs/docker.md for the full contract.
  # ============================================================

  # ------------------------------------------------------------
  # core — the engine + Web UI + REST API (single container)
  # ------------------------------------------------------------
  core:
    build:
      context: .
      dockerfile: Dockerfile
    image: nexus-scalp-engine:local
    container_name: nexus-scalp-core
    restart: unless-stopped
    user: "10001:10001"
    environment:
      NSE_EXECUTION__MODE: ${NSE_EXECUTION__MODE:-PAPER}
      NSE_EXECUTION__SYMBOL: ${NSE_EXECUTION__SYMBOL:-XAUUSD}
      NSE_MODEL__MODEL_ARTIFACT_PATH: ${NSE_MODEL__MODEL_ARTIFACT_PATH:-artifacts/models/scalp/XAUUSD/70d_liquidity/model.pt}
      NSE_RISK__MAX_ACCOUNT_DRAWDOWN_PCT: ${NSE_RISK__MAX_ACCOUNT_DRAWDOWN_PCT:-2.0}
      NSE_RISK__RISK_PER_TRADE_PCT: ${NSE_RISK__RISK_PER_TRADE_PCT:-0.5}
      NSE_NEWS__ENABLED: ${NSE_NEWS__ENABLED:-true}
      NSE_TELEGRAM__ENABLED: ${NSE_TELEGRAM__ENABLED:-false}
      NSE_LOG_LEVEL: ${NSE_LOG_LEVEL:-INFO}
      TZ: ${TZ:-UTC}
      # Containerized engine always binds the API to all interfaces.
      NSE_WEB_HOST: 0.0.0.0
      NSE_WEB_PORT: ${NSE_WEB_PORT:-9090}
      # AUDIT-B1: the control-plane web server requires a bearer token.
      # Operator MUST set NSE_WEB_AUTH_TOKEN in .env (fail-closed: without
      # it the server 500s every protected route instead of running open).
      # UI/API clients send: Authorization: Bearer <token> (or X-NSE-Token).
      NSE_WEB_AUTH_TOKEN: ${NSE_WEB_AUTH_TOKEN:?set NSE_WEB_AUTH_TOKEN in .env}
    volumes:
      - nexus-artifacts:/app/artifacts
      - nexus-data:/app/data
    ports:
      - "${NSE_WEB_PORT:-9090}:9090"
    healthcheck:
      test: ["CMD", "/app/docker/healthcheck.sh"]
      interval: 15s
      timeout: 5s
      start_period: 10s
      retries: 6
    stop_grace_period: 30s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  # ------------------------------------------------------------
  # redis — FUTURE-ONLY telemetry/cache (nothing in src/ uses it yet)
  # NOT started by default. Opt in with:
  #     docker compose --profile redis up -d redis
  # Never exposed to the host.
  # ------------------------------------------------------------
  redis:
    profiles: ["redis"]
    image: redis:7-alpine
    container_name: nexus-redis
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "no", "--save", ""]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10
    volumes:
      - redis-data:/data
    logging:
      driver: json-file
      options:
        max-size: "5m"
        max-file: "2"

  # ------------------------------------------------------------
  # postgres — OPTIONAL PostgreSQL development database
  # (DATABASE PORTABILITY, 2026-08-20)
  # ------------------------------------------------------------
  # Not started by default. Run with:
  #     docker compose --profile postgres up -d postgres
  # The application keeps SQLite as its default; this service exists so
  # PostgreSQL mode/migrations/tests have a real target.
  postgres:
    profiles: ["postgres"]
    image: postgres:16-alpine
    container_name: nexus-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${NSE_PG_DATABASE:-nse_audit}
      POSTGRES_USER: ${NSE_PG_USER:-nse_user}
      # AUDIT-B3: no silent default password — the operator MUST set
      # NSE_PG_PASSWORD. Compose fails fast with this empty default.
      POSTGRES_PASSWORD: ${NSE_PG_PASSWORD:?set NSE_PG_PASSWORD in .env}
    volumes:
      - nexus-postgres-data:/var/lib/postgresql/data
    # AUDIT-B3: NO host port mapping. Postgres is reachable only from the
    # nexus-scalp-net internal network (service name: postgres:5432).
    # If you truly need host access for debugging, override in a
    # docker-compose.override.yml and keep it out of git.
    expose:
      - "5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${NSE_PG_USER:-nse_user} -d ${NSE_PG_DATABASE:-nse_audit}"]
      interval: 5s
      timeout: 5s
      retries: 10

networks:
  default:
    name: nexus-scalp-net
    driver: bridge

volumes:
  nexus-artifacts:
  nexus-data:
  redis-data:
  nexus-postgres-data: