chore(shared): port assignments standardization

apps/agenstra/backend-agent-controller/.start-containers.env.example

@@ -1,9 +1,19 @@
+# Local-only defaults for the container stack. Replace placeholders before exposing it.
+HOST=0.0.0.0
+PORT=3100
+NODE_ENV=development
+DB_HOST=postgres
+DB_PORT=5432
+DB_USERNAME=postgres
+DB_PASSWORD=postgres
+DB_DATABASE=postgres
+
 # Environment variables for the provisioning providers
 HETZNER_API_TOKEN=
 DIGITALOCEAN_API_TOKEN=
 
 # Environment variables for encryption
-ENCRYPTION_KEY=
+ENCRYPTION_KEY=MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDE=
 
 # Client workspace endpoint SSRF guardrails (agent-manager base URLs stored per client)
 # Production: set CLIENT_ENDPOINT_ALLOWED_HOSTS to comma-separated hostnames or * (see docs).
@@ -13,9 +23,10 @@ ENCRYPTION_KEY=
 # CLIENT_ENDPOINT_TLS_REJECT_UNAUTHORIZED=true
 
 # CORS (HTTP uses CORS_ORIGIN; Socket.IO/VNC resolve WEBSOCKET_CORS_ORIGIN → CORS_ORIGIN → *)
-# Example: CORS_ORIGIN=http://localhost:4200
-CORS_ORIGIN=
+# Example: CORS_ORIGIN=http://localhost:4100
+CORS_ORIGIN=http://localhost:4100
 WEBSOCKET_CORS_ORIGIN=
+WEBSOCKET_NAMESPACE=socket/clients
 
 # Environment variables for the authentication method
 # AUTHENTICATION_METHOD: api-key | keycloak | users (default: api-key when STATIC_API_KEY set, else keycloak)
@@ -30,18 +41,20 @@ DISABLE_SIGNUP=false
 DISABLE_FORCE_LOGIN_2FA=false
 
 # Environment variables for static API key authentication (when AUTHENTICATION_METHOD=api-key)
-STATIC_API_KEY=
+STATIC_API_KEY=local-development-agent-controller-api-key
 
 # Environment variables for users authentication (when AUTHENTICATION_METHOD=users)
-JWT_SECRET=
+JWT_SECRET=local-development-agent-controller-jwt-secret-change-before-deployment
 # TOTP issuer shown in authenticator apps (otpauth label). Defaults to Forepath when unset.
 PRODUCT_NAME=Agenstra
 
 # SMTP configuration (MailHog when using docker-compose)
 # SMTP_HOST=mailhog and SMTP_PORT=1025 are used by default when running in Docker
 # For production SMTP: set SMTP_USER and SMTP_PASSWORD; use port 465 for SMTPS
-SMTP_HOST=
-SMTP_PORT=
+SMTP_HOST=mailhog
+SMTP_PORT=1025
+SMTP_HOST_PORT=1025
+MAILHOG_HOST_PORT=8025
 SMTP_USER=
 SMTP_PASSWORD=
 EMAIL_FROM=noreply@localhost
@@ -84,9 +97,9 @@ SEARCH_REINDEX_BATCH_SIZE=100
 OTEL_ENABLED=false
 OTEL_USERNAME=
 OTEL_PASSWORD=
-# OTEL_METRICS_PATH=/otel/metrics
-# OTEL_SERVICE_NAME=
-# OTEL_EXPORTER_OTLP_ENDPOINT=
+OTEL_METRICS_PATH=/otel/metrics
+OTEL_SERVICE_NAME=
+OTEL_EXPORTER_OTLP_ENDPOINT=
 
 # Application version and update checks
 VERSION=
@@ -97,4 +110,39 @@ UPDATE_CHECK_TIMEZONE=Europe/Berlin
 
 # MCP authentication callback security
 MCP_OAUTH_PUBLIC_BASE_URL=http://localhost:3100
-MCP_OAUTH_CALLBACK_SECRET=
+MCP_OAUTH_CALLBACK_SECRET=local-development-mcp-callback-secret-change-before-deployment
+
+# Remaining explicit Compose defaults
+AUTO_ENRICH_ENABLED_GLOBAL=true
+AUTO_ENRICH_VECTOR_ENABLED=true
+AUTO_ENRICH_MAX_SECTIONS=6
+AUTO_ENRICH_MAX_CHARS=12000
+AUTO_ENRICH_VECTOR_TOP_K=20
+AUTO_ENRICH_VECTOR_MAX_COSINE_DISTANCE=1
+KNOWLEDGE_EMBEDDINGS_REINDEX_INTERVAL_MS=3600000
+CONTEXT_IMPORT_SCHEDULER_INTERVAL_MS=120000
+CONTEXT_IMPORT_SCHEDULER_CONFIG_BATCH=3
+CONTEXT_IMPORT_ITEM_BUDGET=25
+FILTER_RULES_SYNC_INTERVAL_MS=30000
+FILTER_RULES_SYNC_BATCH_SIZE=10
+AUTONOMOUS_TICKET_SCHEDULER_INTERVAL_MS=60000
+AUTONOMOUS_TICKET_SCHEDULER_BATCH_SIZE=5
+DYNAMIC_PROVISIONING_PROVIDERS=
+DYNAMIC_CONTEXT_IMPORT_PROVIDERS=
+DYNAMIC_PROVIDERS_FAIL_FAST=false
+DYNAMIC_PROVIDER_PLUGIN_PATH=
+DYNAMIC_PROVIDER_PLUGIN_INSTALL=
+CLIENT_ENDPOINT_ALLOWED_HOSTS=
+CLIENT_ENDPOINT_ALLOW_INSECURE_HTTP=false
+CLIENT_ENDPOINT_ALLOW_INTERNAL_HOST=false
+CLIENT_ENDPOINT_TLS_REJECT_UNAUTHORIZED=true
+KEYCLOAK_SERVER_URL=
+KEYCLOAK_AUTH_SERVER_URL=
+KEYCLOAK_REALM=
+KEYCLOAK_CLIENT_ID=
+KEYCLOAK_CLIENT_SECRET=
+KEYCLOAK_TOKEN_VALIDATION=online
+OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m
+RATE_LIMIT_ENABLED=
+RATE_LIMIT_TTL=60
+RATE_LIMIT_LIMIT=100

apps/agenstra/backend-agent-controller/README.md

@@ -192,7 +192,7 @@ CORS_ORIGIN="https://agenstra.com,https://app.agenstra.com"
 
 # Development: Allow all origins (default, no configuration needed)
 # Or restrict to specific origins:
-CORS_ORIGIN="http://localhost:4200,http://localhost:3000"
+CORS_ORIGIN="http://localhost:4100"
 ```
 
 ## Environment Variables
@@ -276,8 +276,9 @@ nx docker:api agenstra-backend-agent-controller
 
 ```bash
 # Run with docker-compose (recommended)
-cd apps/agenstra-backend-agent-controller
-docker compose up -d
+cd apps/agenstra/backend-agent-controller
+cp .start-containers.env.example .start-containers.env
+docker compose --env-file .start-containers.env up -d
 
 # Or run directly
 docker run \

apps/agenstra/backend-agent-controller/docker-compose.yaml

@@ -54,7 +54,7 @@ x-backend-agent-controller-environment: &backend-agent-controller-environment
   DISABLE_FORCE_LOGIN_2FA: ${DISABLE_FORCE_LOGIN_2FA:-false}
   STATIC_API_KEY: ${STATIC_API_KEY:-}
   ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
-  CORS_ORIGIN: ${CORS_ORIGIN:-}
+  CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:4100}
   RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-}
   RATE_LIMIT_TTL: ${RATE_LIMIT_TTL:-60}
   RATE_LIMIT_LIMIT: ${RATE_LIMIT_LIMIT:-100}
@@ -255,8 +255,8 @@ services:
     image: mailhog/mailhog:latest
     container_name: agent-controller-mailhog
     ports:
-      - '${SMTP_PORT:-1025}:${SMTP_PORT:-1025}'
-      - '${MAILHOG_PORT:-8025}:${MAILHOG_PORT:-8025}'
+      - '${SMTP_HOST_PORT:-1025}:${SMTP_PORT:-1025}'
+      - '${MAILHOG_HOST_PORT:-8025}:8025'
     networks:
       - agent-controller-network
     restart: unless-stopped

apps/agenstra/backend-agent-controller/project.json

@@ -168,7 +168,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/agenstra/backend-agent-controller",
-        "command": "docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-backend-agent-controller"
+        "command": "docker compose --env-file .start-containers.env up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-backend-agent-controller"
       }
     },
     "openapi-client-js": {

apps/agenstra/backend-agent-manager/.start-containers.env.example

@@ -1,3 +1,14 @@
+# Local-only defaults for the container stack. Replace placeholders before exposing it.
+HOST=0.0.0.0
+PORT=3000
+NODE_ENV=development
+WEBSOCKET_NAMESPACE=socket/agents
+DB_HOST=postgres
+DB_PORT=5432
+DB_USERNAME=postgres
+DB_PASSWORD=postgres
+DB_DATABASE=postgres
+
 # Environment variables for the cursor-agent
 CURSOR_API_KEY=
 
@@ -8,7 +19,7 @@ GIT_TOKEN=
 GIT_PRIVATE_KEY=
 
 # Environment variables for encryption (base64-encoded 32-byte AES-256 key)
-ENCRYPTION_KEY=
+ENCRYPTION_KEY=MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDE=
 
 # Worker image (must run `opencode serve`). Rebuild locally after Dockerfile.worker changes:
 #   docker build -f apps/agenstra/backend-agent-manager/Dockerfile.worker \
@@ -18,17 +29,17 @@ AGENT_DEFAULT_IMAGE=ghcr.io/forepath/agenstra-manager-worker:latest
 OPENCODE_AGENT_DOCKER_IMAGE=ghcr.io/forepath/agenstra-manager-worker:latest
 
 # CORS (HTTP uses CORS_ORIGIN; Socket.IO/VNC resolve WEBSOCKET_CORS_ORIGIN → CORS_ORIGIN → *)
-# Example: CORS_ORIGIN=http://localhost:4200
-CORS_ORIGIN=
+# Example: CORS_ORIGIN=http://localhost:4100
+CORS_ORIGIN=http://localhost:4100
 WEBSOCKET_CORS_ORIGIN=
 
 # Environment variables for static API key authentication
 # If STATIC_API_KEY is set, API key authentication is used (no Keycloak fallback)
 # If STATIC_API_KEY is not set, Keycloak authentication is used
-STATIC_API_KEY=
+STATIC_API_KEY=local-development-agent-manager-api-key
 
 # Environment variables for users authentication (when AUTHENTICATION_METHOD=users)
-JWT_SECRET=
+JWT_SECRET=local-development-agent-manager-jwt-secret-change-before-deployment
 
 # Application version (reported by GET /api/instance-status)
 VERSION=
@@ -39,6 +50,25 @@ AGENT_MANAGER_ROLE=api
 OTEL_ENABLED=false
 OTEL_USERNAME=
 OTEL_PASSWORD=
-# OTEL_METRICS_PATH=/otel/metrics
-# OTEL_SERVICE_NAME=
-# OTEL_EXPORTER_OTLP_ENDPOINT=
+OTEL_METRICS_PATH=/otel/metrics
+OTEL_SERVICE_NAME=
+OTEL_EXPORTER_OTLP_ENDPOINT=
+
+# Remaining explicit Compose defaults
+AGENT_DOCKER_NETWORK=agent-manager-network
+DOCKER_HOST_GATEWAY=host.docker.internal
+DYNAMIC_PIPELINE_PROVIDERS=
+DYNAMIC_CHAT_FILTERS=
+DYNAMIC_PROVIDERS_FAIL_FAST=false
+DYNAMIC_PROVIDER_PLUGIN_PATH=
+DYNAMIC_PROVIDER_PLUGIN_INSTALL=
+GIT_PASSWORD=
+KEYCLOAK_SERVER_URL=
+KEYCLOAK_AUTH_SERVER_URL=
+KEYCLOAK_REALM=
+KEYCLOAK_CLIENT_ID=
+KEYCLOAK_CLIENT_SECRET=
+KEYCLOAK_TOKEN_VALIDATION=online
+RATE_LIMIT_ENABLED=
+RATE_LIMIT_TTL=60
+RATE_LIMIT_LIMIT=100

apps/agenstra/backend-agent-manager/README.md

@@ -192,7 +192,7 @@ CORS_ORIGIN="https://agenstra.com,https://app.agenstra.com"
 
 # Development: Allow all origins (default, no configuration needed)
 # Or restrict to specific origins:
-CORS_ORIGIN="http://localhost:4200,http://localhost:3000"
+CORS_ORIGIN="http://localhost:4100"
 ```
 
 ## Environment Variables
@@ -246,8 +246,9 @@ When running the API container, you must mount the Docker socket to enable Docke
 
 ```bash
 # Run with docker-compose (recommended)
-cd apps/agenstra-backend-agent-manager
-docker compose up -d
+cd apps/agenstra/backend-agent-manager
+cp .start-containers.env.example .start-containers.env
+docker compose --env-file .start-containers.env up -d
 
 # Or run directly with Docker socket mount
 docker run -v /var/run/docker.sock:/var/run/docker.sock \

apps/agenstra/backend-agent-manager/docker-compose.yaml

@@ -57,7 +57,7 @@ services:
       # CORS configuration (comma-separated list of allowed origins)
       # In production: CORS is disabled by default. Set CORS_ORIGIN to allow specific origins.
       # In development: CORS allows all origins by default.
-      CORS_ORIGIN: ${CORS_ORIGIN:-}
+      CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:4100}
       # Rate limiting configuration
       RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-}
       RATE_LIMIT_TTL: ${RATE_LIMIT_TTL:-60}

apps/agenstra/backend-agent-manager/project.json

@@ -179,7 +179,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/agenstra/backend-agent-manager",
-        "command": "docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-backend-agent-manager"
+        "command": "docker compose --env-file .start-containers.env up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-backend-agent-manager"
       }
     },
     "openapi-client-js": {

apps/agenstra/frontend-agent-console/Dockerfile.server

@@ -4,9 +4,9 @@
 # Registry:   ghcr.io/forepath/agenstra-console-server
 # Base:       node:24.14.1-alpine
 # User:       node (APP_UID / APP_GID, default 1000)
-# Exposes:    4200 (Express static server)
+# Exposes:    4100 (Express static server)
 # Build:      npx nx run frontend-agent-console:server-container-image
-# Run:        nx docker:run agenstra-frontend-agent-console -p 4200:4200
+# Run:        nx docker:run agenstra-frontend-agent-console -p 4100:4100
 # Notes:      —
 # -----------------------------------------------------------------------------
 #
@@ -18,7 +18,7 @@ ARG VERSION=0.0.0
 ENV VERSION=${VERSION}
 
 ENV HOST=0.0.0.0
-ENV PORT=4200
+ENV PORT=4100
 
 WORKDIR /app
 

apps/agenstra/frontend-agent-console/docker-compose.yaml

@@ -6,13 +6,13 @@ services:
     environment:
       # Frontend server configuration
       HOST: ${HOST:-0.0.0.0}
-      PORT: ${PORT:-4200}
+      PORT: ${PORT:-4100}
       NODE_ENV: ${NODE_ENV:-production}
       DEFAULT_LOCALE: ${DEFAULT_LOCALE:-en}
       CSP_ENFORCE: ${CSP_ENFORCE:-true}
       CSP_CONNECT_SRC_EXTRA: ${CSP_CONNECT_SRC_EXTRA:-http://host.docker.internal:3100}
     ports:
-      - '${PORT:-4200}:${PORT:-4200}'
+      - '${PORT:-4100}:${PORT:-4100}'
     networks:
       - agent-console-network
     restart: unless-stopped

apps/agenstra/frontend-agent-console/project.json

@@ -116,7 +116,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4200
+        "port": 4100
       },
       "configurations": {
         "development": {
@@ -159,7 +159,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "agenstra-frontend-agent-console:build",
-        "port": 4200,
+        "port": 4100,
         "staticFilePath": "dist/apps/agenstra/frontend-agent-console/browser",
         "spa": true
       }

apps/agenstra/frontend-agent-console/src/server.ts

@@ -17,7 +17,7 @@ import {
 import express from 'express';
 
 const app = express();
-const port = parseInt(process.env['PORT'] || '4200', 10);
+const port = parseInt(process.env['PORT'] || '4100', 10);
 
 app.use(createSecurityHeadersMiddleware());
 registerRuntimeConfigEndpoint(app);

apps/agenstra/frontend-billing-console/project.json

@@ -121,7 +121,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4500
+        "port": 4103
       },
       "configurations": {
         "development": {
@@ -164,7 +164,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "agenstra-frontend-billing-console:build",
-        "port": 4500,
+        "port": 4103,
         "staticFilePath": "dist/apps/agenstra/frontend-billing-console/browser",
         "spa": true
       }
@@ -245,7 +245,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/decabill/frontend-billing-console",
-        "command": "BILLING_CONSOLE_SERVER_IMAGE=ghcr.io/forepath/agenstra-billing-console-server:latest BILLING_CONSOLE_SERVER_CONTAINER_NAME=agenstra-billing-console-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-frontend-billing-console"
+        "command": "PORT=4103 BILLING_CONSOLE_SERVER_IMAGE=ghcr.io/forepath/agenstra-billing-console-server:latest BILLING_CONSOLE_SERVER_CONTAINER_NAME=agenstra-billing-console-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-frontend-billing-console"
       }
     },
     "sbom": {

apps/agenstra/frontend-docs/project.json

@@ -151,7 +151,7 @@
       "executor": "@angular-devkit/build-angular:dev-server",
       "options": {
         "hmr": false,
-        "port": 4400
+        "port": 4102
       },
       "configurations": {
         "production": {
@@ -194,7 +194,7 @@
       "executor": "@nx/web:file-server",
       "options": {
         "buildTarget": "agenstra-frontend-docs:build",
-        "port": 4400,
+        "port": 4102,
         "staticFilePath": "dist/apps/agenstra/frontend-docs/browser",
         "spa": true
       }
@@ -248,7 +248,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "apps/shared/frontend-docs",
-        "command": "DOCS_SERVER_IMAGE=ghcr.io/forepath/agenstra-docs-server:latest DOCS_SERVER_CONTAINER_NAME=agenstra-docs-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-frontend-docs"
+        "command": "PORT=4102 DOCS_SERVER_IMAGE=ghcr.io/forepath/agenstra-docs-server:latest DOCS_SERVER_CONTAINER_NAME=agenstra-docs-server docker compose up -d --force-recreate --remove-orphans && docker image prune --force --filter label=io.forepath.one.test-project=agenstra-frontend-docs"
       }
     },
     "sbom": {