Add self-host compose stack (Postgres, MinIO, backend, Caddy)

One env-driven compose stack stands up the whole system per ARCHITECTURE §2/§12. Postgres uses the pgvector image (pgvector + pg_trgm in contrib); MinIO is the S3-compatible store; Caddy reverse-proxies /api/* and /health* to the backend with an env-driven site address (':80' local, a domain for auto-HTTPS, or plain HTTP behind a Cloudflare Tunnel). Healthchecks and depends_on gate startup order.

.env.example documents twelve-factor config (DB, S3, SMTP, Caddy, model keys) with placeholders; no secrets in the repo. Verified end-to-end on the deploy target: all services healthy, /health/ready green against real Postgres.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

deploy/.env.example

@@ -0,0 +1,37 @@
+# Provenance configuration — copy to `.env` and fill in. Never commit `.env`.
+# Everything is twelve-factor; no endpoints or secrets live in code.
+
+# --- Core ---
+APP_ENV=development
+
+# --- Database (Postgres) ---
+POSTGRES_USER=provenance
+POSTGRES_PASSWORD=change-me
+POSTGRES_DB=provenance
+# Backend connection string (async driver). Host 'postgres' = compose service.
+DATABASE_URL=postgresql+asyncpg://provenance:change-me@postgres:5432/provenance
+
+# --- Object storage (S3-compatible / MinIO) ---
+MINIO_ROOT_USER=provenance
+MINIO_ROOT_PASSWORD=change-me-too
+S3_ENDPOINT_URL=http://minio:9000
+S3_BUCKET=provenance
+S3_ACCESS_KEY=provenance
+S3_SECRET_KEY=change-me-too
+S3_REGION=us-east-1
+
+# --- Edge (Caddy) ---
+# Local: ':80' (http://localhost). Production: 'provenance.example.com' for auto-HTTPS.
+PROVENANCE_SITE_ADDRESS=:80
+
+# --- Email (SMTP) — wired in a later phase ---
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USERNAME=
+SMTP_PASSWORD=
+SMTP_FROM=
+
+# --- Model providers — wired in Phase 4 (AI assistant). BYO key. ---
+# ANTHROPIC_API_KEY=
+# OPENAI_API_KEY=
+# XAI_API_KEY=

deploy/Caddyfile

@@ -0,0 +1,25 @@
+# Provenance edge. Site address is env-driven: ':80' for local http://localhost,
+# a domain in production for automatic HTTPS. Behind a Cloudflare Tunnel you can
+# keep this on plain HTTP and let the tunnel terminate TLS.
+
+{$PROVENANCE_SITE_ADDRESS::80} {
+	encode gzip
+
+	# Versioned API surface (FastAPI). The assistant mounts under /assistant later.
+	handle /api/* {
+		reverse_proxy backend:8000
+	}
+
+	# Liveness/readiness probes, proxied for external monitoring.
+	handle /health* {
+		reverse_proxy backend:8000
+	}
+
+	# Frontend (Next.js) — not yet deployed in Phase 0. Uncomment when it lands.
+	# handle {
+	#	reverse_proxy frontend:3000
+	# }
+	handle {
+		respond "Provenance — Phase 0. Backend health at /health; frontend not yet deployed." 200
+	}
+}

deploy/docker-compose.yml

@@ -0,0 +1,81 @@
+name: provenance
+
+# One stack stands up the whole system. Configuration is entirely env-driven
+# (see .env.example). Run from this directory: `docker compose up -d`.
+
+services:
+  postgres:
+    # pgvector image = Postgres + pgvector; pg_trgm ships in contrib.
+    image: pgvector/pgvector:pg17
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-provenance}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-provenance}
+      POSTGRES_DB: ${POSTGRES_DB:-provenance}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-provenance} -d ${POSTGRES_DB:-provenance}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    restart: unless-stopped
+
+  minio:
+    image: minio/minio:latest
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-provenance}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-change-me-too}
+    volumes:
+      - miniodata:/data
+    healthcheck:
+      test: ["CMD-SHELL", "mc ready local || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    restart: unless-stopped
+
+  backend:
+    build:
+      context: ../backend
+      dockerfile: Dockerfile
+    environment:
+      APP_ENV: ${APP_ENV:-development}
+      DATABASE_URL: ${DATABASE_URL:-postgresql+asyncpg://provenance:provenance@postgres:5432/provenance}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >-
+          python -c "import urllib.request,sys;
+          sys.exit(0 if urllib.request.urlopen('http://localhost:8000/health').status==200 else 1)"
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    restart: unless-stopped
+
+  caddy:
+    image: caddy:2
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      # Local default ':80' -> http://localhost. Set to a domain in production
+      # for automatic HTTPS (or run plain HTTP behind a Cloudflare Tunnel).
+      PROVENANCE_SITE_ADDRESS: ${PROVENANCE_SITE_ADDRESS:-:80}
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddydata:/data
+      - caddyconfig:/config
+    depends_on:
+      - backend
+    restart: unless-stopped
+
+volumes:
+  pgdata:
+  miniodata:
+  caddydata:
+  caddyconfig: