brain/docker-compose.yml at main · alanfrigo/brain · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
name: brain

services:
  # Public-facing reverse proxy. Listens on host 80/443.
  # For tailnet-only deployment, see docker-compose.tailscale.yml.
  caddy:
    build:
      context: ./ops/caddy
      dockerfile: Dockerfile
    ports:
      - "80:80"
      - "443:443"
    networks:
      - internal
    depends_on:
      web:
        condition: service_healthy
    environment:
      DOMAIN: ${DOMAIN}
      ACME_EMAIL: ${ACME_EMAIL}
      CF_API_TOKEN: ${CF_API_TOKEN:-}
    volumes:
      - ./ops/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    restart: unless-stopped

  web:
    build:
      context: ./web
      dockerfile: Dockerfile
    environment:
      NEXTAUTH_URL: ${NEXTAUTH_URL}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET}
      ALLOWED_GITHUB_USER: ${ALLOWED_GITHUB_USER}
      INTERNAL_API_SECRET: ${INTERNAL_API_SECRET}
      API_BASE_URL: ${API_BASE_URL:-http://api:8000}
      NEXT_PUBLIC_DOMAIN: ${NEXT_PUBLIC_DOMAIN:-}
      NODE_ENV: production
      # Next.js 15 standalone server binds to $HOSTNAME (default = container
      # hostname only). Force bind on all interfaces so the in-container
      # healthcheck (http://localhost:3000) can reach it.
      HOSTNAME: 0.0.0.0
    networks:
      - internal
    depends_on:
      api:
        condition: service_healthy
    healthcheck:
      test: [ "CMD-SHELL", "node -e \"require('http').get('http://localhost:3000/signin', r => process.exit(r.statusCode < 500 ? 0 : 1)).on('error', () => process.exit(1))\"" ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  api:
    build:
      context: ./api
      dockerfile: Dockerfile
    environment:
      INTERNAL_API_SECRET: ${INTERNAL_API_SECRET}
      VAULT_PATH: ${VAULT_PATH:-/vault}
      CHROMA_PATH: /data/chroma
      VOYAGE_API_KEY: ${VOYAGE_API_KEY}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
      OPENROUTER_BASE_URL: ${OPENROUTER_BASE_URL:-https://openrouter.ai/api/v1}
      LLM_MODEL: ${LLM_MODEL:-anthropic/claude-sonnet-4}
      ADMIN_REINDEX_TOKEN: ${ADMIN_REINDEX_TOKEN}
      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:-http://web:3000}
      RATE_LIMIT_PER_MINUTE: ${RATE_LIMIT_PER_MINUTE:-60}
    volumes:
      - vault_data:/vault:ro
      - chroma_data:/data/chroma
    networks:
      - internal
    healthcheck:
      test: [ "CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/healthz')" ]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 20s
    restart: unless-stopped

  vault-syncer:
    build:
      context: ./ops/vault-syncer
      dockerfile: Dockerfile
    environment:
      VAULT_REPO: ${VAULT_REPO}
      VAULT_BRANCH: ${VAULT_BRANCH:-main}
      VAULT_GIT_TOKEN: ${VAULT_GIT_TOKEN}
      SYNC_INTERVAL_MIN: ${SYNC_INTERVAL_MIN:-5}
      ADMIN_REINDEX_TOKEN: ${ADMIN_REINDEX_TOKEN}
      API_URL: http://api:8000
    volumes:
      - vault_data:/vault
    networks:
      - internal
    depends_on:
      api:
        condition: service_healthy
    restart: unless-stopped

networks:
  internal:
    driver: bridge
    internal: false # api/caddy need egress (LLM, ACME); not exposed to host

volumes:
  vault_data:
  chroma_data:
  caddy-data:
  caddy-config: