services:
  # Config generator for agentgateway
  configgen-agentgateway:
    image: duosecurity/authorization-connector:v1.0.0@sha256:fc715f713073be4fec466ab98dc51b64612c9b000b11d2a83cb0b29eb6858d54
    container_name: configgen-agentgateway
    profiles: [agentgateway]
    volumes:
      - ./quickstart.conf:/quickstart.conf:ro
      - generated-config:/home/nonroot/output
    command:
      - "-config-gen"
      - "-gateway-type=agentgateway"
      - "-config-gen-input=/quickstart.conf"
      - "-config-gen-output=/home/nonroot/output/agentgateway.conf"
    networks:
      - mcp-network

  # Config generator for envoy
  configgen-envoy:
    image: duosecurity/authorization-connector:v1.0.0@sha256:fc715f713073be4fec466ab98dc51b64612c9b000b11d2a83cb0b29eb6858d54
    container_name: configgen-envoy
    profiles: [envoy]
    volumes:
      - ./quickstart.conf:/quickstart.conf:ro
      - generated-config:/home/nonroot/output
    command:
      - "-config-gen"
      - "-gateway-type=envoy"
      - "-config-gen-input=/quickstart.conf"
      - "-config-gen-output=/home/nonroot/output/envoy.conf"
    networks:
      - mcp-network

  # Config generator for authz-bridge
  configgen-authz-bridge:
    image: duosecurity/authorization-connector:v1.0.0@sha256:fc715f713073be4fec466ab98dc51b64612c9b000b11d2a83cb0b29eb6858d54
    container_name: configgen-authz-bridge
    volumes:
      - ./quickstart.conf:/quickstart.conf:ro
      - generated-config:/home/nonroot/output
    command:
      - "-config-gen"
      - "-gateway-type=authz-bridge"
      - "-config-gen-input=/quickstart.conf"
      - "-config-gen-output=/home/nonroot/output/authz-bridge.conf"
    networks:
      - mcp-network

  # Duo Authorization Connector - ext_authz gRPC service
  authz-bridge:
    image: duosecurity/authorization-connector:v1.0.0@sha256:fc715f713073be4fec466ab98dc51b64612c9b000b11d2a83cb0b29eb6858d54
    container_name: authz-connector
    ports:
      - "9001:9001"
    volumes:
      - generated-config:/config:ro
    secrets:
      - duo_skey
    read_only: true
    depends_on:
      configgen-authz-bridge:
        condition: service_completed_successfully
    networks:
      - mcp-network
    healthcheck:
      test: ["CMD", "/app/ext-authz", "-healthcheck"]
      interval: 10s
      timeout: 5s
      retries: 3

  # Agent Gateway - MCP Gateway with OAuth + ext_authz support
  agentgateway:
    image: cr.agentgateway.dev/agentgateway:0.12.0@sha256:5f66ed5e05c1d51f007448195d939f9adb2bb4ddd70c0a415af38d4a498066a1
    container_name: agentgateway
    profiles: [agentgateway]
    ports:
      - "${GATEWAY_PORT:-3000}:${GATEWAY_PORT:-3000}" # Client-facing MCP endpoint
      - "3001:3001" # Admin/metrics
      - "15021:15021" # health check endpoint
    volumes:
      - generated-config:/config:ro
    environment:
      - RUST_LOG=info
    depends_on:
      authz-bridge:
        condition: service_healthy
      configgen-agentgateway:
        condition: service_completed_successfully
    networks:
      - mcp-network
    command: ["-f", "/config/agentgateway.conf"]

  # Envoy AI Gateway - MCP gateway with OAuth + ext_authz + CEL authorization
  envoy:
    image: envoyproxy/ai-gateway-cli:latest@sha256:d9ab5473a468b79a585969dcb38156299d587a6af7d7cc3d29e4bcc3074ba4b5
    container_name: envoy
    profiles: [envoy]
    command:
      [
        "run",
        "/config/envoy.conf",
        "--debug",
        "--admin-port=9901",
        "--run-id=0",
      ]
    ports:
      - "${GATEWAY_PORT:-3000}:${GATEWAY_PORT:-3000}" # Client-facing MCP endpoint
      - "9901:9901" # health check endpoint
    volumes:
      - generated-config:/config:ro
    depends_on:
      authz-bridge:
        condition: service_healthy
      configgen-envoy:
        condition: service_completed_successfully
    networks:
      - mcp-network

networks:
  mcp-network:
    name: mcp_gateway
    driver: bridge
    ipam:
      config:
        - subnet: 172.100.0.0/24

volumes:
  generated-config:

secrets:
  duo_skey:
    file: ./secrets/duo_skey

name: mcp_gateway
