Docker Compose stack skeleton (Traefik + 7 services + Dockerfiles)

[Ryan-Atkinson87]

Spec: §2 (High-level architecture / compose stack), §7.1 (container boundary).

The local stack mirroring Spec §2: Traefik ingress plus one service per concern. Some services may be skeletons (Langfuse from its upstream image; agent-runner a placeholder) — the deliverable is the topology, routing, and that orchestrator-api builds and routes behind Traefik.

Acceptance criteria

• docker-compose.yml defines all Spec §2 services: traefik, orchestrator-ui, orchestrator-api, langfuse, langfuse-db, agent-runner, egress-proxy.
• Traefik configured as ingress/TLS/routing; orchestrator-api routed behind it.
• Dockerfile for orchestrator-api builds the FastAPI app from FastAPI application skeleton with health endpoint and settings loading #2.
• orchestrator-ui service present (placeholder build acceptable until Phase 6).
• langfuse + langfuse-db (Postgres) wired to upstream requirements (skeleton config).
• Services receive secrets via env_file: .env (gitignored); .env.example lists the names (ties to Secrets-by-reference resolution and .env.example #5).
• docker compose config validates; the orchestrator-api health endpoint is reachable through Traefik when the stack is up.
• README documents bringing the stack up locally.

Notes

agent-runner network lockdown + egress allowlist + mount boundary are deliberately split into #8.

Dependencies

Depends on: #2