docker-compose.yml

services:

  # keycloak.localtest.me resolves to 127.0.0.1 for the browser and to this container via the
  # network alias, so browser and backend see the same issuer. HTTPS cert is a local CA
  # (regenerate with generate-certs.sh); plain HTTP on 8080 is a backchannel for Core's jwksUrl.
  keycloak:
    image: quay.io/keycloak/keycloak:26.7
    command: >
      start-dev --import-realm
      --hostname=https://keycloak.localtest.me:8443
      --https-certificate-file=/opt/keycloak/certs/keycloak.crt
      --https-certificate-key-file=/opt/keycloak/certs/keycloak.key
    ports:
      - "8180:8080"
      - "8443:8443"
    networks:
      default:
        aliases:
          - keycloak.localtest.me
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: "admin"
      KC_BOOTSTRAP_ADMIN_PASSWORD: "admin"
    volumes:
      - ./docker_compose_files/keycloak/dial-dev-realm.json:/opt/keycloak/data/import/dial-dev-realm.json:ro
      # Leaf cert/key only — the CA private key stays out of the container.
      - ./docker_compose_files/keycloak/certs/keycloak.crt:/opt/keycloak/certs/keycloak.crt:ro
      - ./docker_compose_files/keycloak/certs/keycloak.key:/opt/keycloak/certs/keycloak.key:ro

  themes:
    image: epam/ai-dial-chat-themes:0.10.0
    ports:
      - "3011:3000"

  chat:
    ports:
      - "3010:3000"
    image: epam/ai-dial-chat:development-0.x
    depends_on:
      - themes
      - core
      - keycloak
    environment:
      NEXTAUTH_SECRET: "secret"
      # Without this, NextAuth infers the callback host from its internal port (3000) instead
      # of the published one (3010), sending Keycloak an unregistered redirect_uri.
      NEXTAUTH_URL: "http://localhost:3010"
      THEMES_CONFIG_HOST: "http://themes:8080"
      DIAL_API_HOST: "http://core:8080"
      DIAL_API_KEY: "dial_api_key"
      ENABLED_FEATURES: "voice-input,conversations-section,prompts-section,top-settings,top-clear-conversation,top-chat-info,top-chat-model-settings,empty-chat-settings,header,footer,request-api-key,report-an-issue,likes,conversations-sharing,prompts-sharing,input-files,attachments-manager,conversations-publishing,prompts-publishing,custom-logo,input-links,custom-applications,message-templates,marketplace,code-apps,applications-sharing,marketplace-table-view,edit-last-assistant-message,edit-all-assistant-message,toolsets,dislike-comment,code-interpreter,live-chat-interaction"
      AUTH_DEBUG_ENABLED: "true"
      PROXY_LANGUAGE_HEADER: "accept-language"
      # dev users: admin-dev/admin-dev, user-dev/user-dev
      AUTH_KEYCLOAK_CLIENT_ID: "dial-local"
      AUTH_KEYCLOAK_SECRET: "dial-local-dev-secret"
      AUTH_KEYCLOAK_HOST: "https://keycloak.localtest.me:8443/realms/dial-dev"
      AUTH_KEYCLOAK_ADMIN_ROLE_NAMES: "admin"
      AUTH_KEYCLOAK_DIAL_ROLES_FIELD: "realm_access.roles"
      NODE_EXTRA_CA_CERTS: "/certs/ca.crt"
    volumes:
      - ./docker_compose_files/keycloak/certs/ca.crt:/certs/ca.crt:ro

  # New NestJS-based chat-api/SPA build, run alongside legacy `chat` above (see PR #519).
  chat-new:
    image: epam/ai-dial-chat:development
    ports:
      - "3012:5000"
    restart: on-failure
    depends_on:
      - themes
      - core
      - keycloak
    environment:
      AUTH_SESSION_SECRET: "48c69bd559cffffb2cbee3951430f324e0cd0c79fd8a83de0a991648cae706c8"
      AUTH_CALLBACK_BASE_URL: "http://localhost:3012"
      AUTH_POST_LOGOUT_REDIRECT_URI: "http://localhost:3012"
      AUTH_COOKIE_SECURE: "false"
      CORS_ORIGIN: "http://localhost:3012"
      DIAL_CORE_URL: "http://core:8080"
      DIAL_API_KEY: "dial_api_key"
      THEMES_CONFIG_URL: "http://themes:8080"
      AUTH_KEYCLOAK_CLIENT_ID: "dial-local"
      AUTH_KEYCLOAK_SECRET: "dial-local-dev-secret"
      AUTH_KEYCLOAK_HOST: "keycloak.localtest.me:8443/realms/dial-dev"
      AUTH_KEYCLOAK_ADMIN_ROLE_NAMES: "admin"
      AUTH_KEYCLOAK_DIAL_ROLES_FIELD: "realm_access.roles"
      NODE_EXTRA_CA_CERTS: "/certs/ca.crt"
      # Points the Settings-step iframe at the local quickapps-frontend service.
      DEV_QUICKAPPS_EDITOR_URL: "http://localhost:4600"
      # Required or chat-api's CSP frame-src blocks the iframe above.
      ALLOWED_IFRAME_ORIGINS: "http://localhost:4600"
    volumes:
      - ./docker_compose_files/keycloak/certs/ca.crt:/certs/ca.crt:ro

  # Quick Apps 2.0 settings editor (https://github.com/epam/ai-dial-quickapps-frontend),
  # embedded by chat-new's Settings step over postMessage.
  quickapps-frontend:
    image: epam/ai-dial-quickapps-frontend:development
    platform: linux/amd64
    ports:
      - "4600:5000"
    restart: on-failure
    depends_on:
      - themes
      - core
      - keycloak
    environment:
      NEXTAUTH_SECRET: "0e5b1c4f9a2d47e8b3c6f1a894d2e7b5c0a3f6d9e2b5c8a1f4d7e0b3c6a9f2d5"
      NEXTAUTH_URL: "http://localhost:4600"
      AUTH_KEYCLOAK_ISSUER: "https://keycloak.localtest.me:8443/realms/dial-dev"
      AUTH_KEYCLOAK_CLIENT_ID: "dial-local"
      AUTH_KEYCLOAK_CLIENT_SECRET: "dial-local-dev-secret"
      DIAL_CORE_URL: "http://core:8080"
      # CSP frame-ancestors + postMessage origin, both as the browser sees chat-new.
      ALLOWED_FRAME_ANCESTORS: "http://localhost:3012"
      ALLOWED_ORIGIN: "http://localhost:3012"
      DIAL_CHAT_URL: "http://localhost:3012"
      THEMES_URL: "http://themes:8080/config.json"
      NODE_EXTRA_CA_CERTS: "/certs/ca.crt"
    volumes:
      - ./docker_compose_files/keycloak/certs/ca.crt:/certs/ca.crt:ro

  redis:
    image: redis:7.4.1-alpine3.20
    restart: always
    mem_limit: 2200M
    command: >
      redis-server --maxmemory 2000mb --maxmemory-policy volatile-lfu --save "" --appendonly no --loglevel warning

  admin-export-init:
    image: busybox:1.37
    volumes:
      - ./docker_compose_files/core/admin-export:/export
    command: >
      sh -c "mkdir -p /export
      && (test -f /export/out.json || echo '{}' > /export/out.json)
      && chmod -R 777 /export"
    restart: "no"

  core:
    ports:
      - "8090:8080"
    image: epam/ai-dial-core:development
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/health || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 90s
    environment:
      'AIDIAL_SETTINGS': '/opt/configuration/settings/settings.json'
      'JAVA_OPTS': '-Dgflog.config=/opt/configuration/settings/gflog.xml'
      'LOG_DIR': '/app/log'
      'STORAGE_DIR': '/app/data'
      'AIDIAL_LOG_LEVEL': 'INFO'
      'aidial.config.files': |-
        [
          "/opt/configuration/generated/models.json",
          "/opt/configuration/application-schemas.json",
          "/opt/configuration/applications.json",
          "/opt/configuration/chathub/anthropic.json",
          "/opt/configuration/chathub/gemini.json",
          "/opt/configuration/chathub/openai.json",
          "/opt/configuration/toolsets.json",
          "/opt/admin-export/out.json"
        ]
      'aidial.redis.singleServerConfig.address': 'redis://redis:6379'
    depends_on:
      admin-export-init:
        condition: service_completed_successfully
      redis:
        condition: service_started
    volumes:
      - ./docker_compose_files/core/configuration:/opt/configuration
      - ./docker_compose_files/core/admin-export:/opt/admin-export:ro
      - ./docker_compose_files/core/logs/:/app/log
      - ./docker_compose_files/core/data/:/app/data

  adapter-dial:
    image: epam/ai-dial-adapter-dial:development
    environment:
      DIAL_URL: "http://core:8080"
      LOG_LEVEL: "INFO"

  memory:
    ports:
      - "8000:8000"
    image: epam/ai-dial-memory-backend:development
    environment:
      DIAL_URL: "http://core:8080"
      LOG_LEVEL: "INFO"

  # If you want to run Quick Apps in Docker instead of on the host, uncomment the following section and update the quick-apps host in application-schemas.json.
  # quick-apps:
  #   build:
  #       context: .
  #       dockerfile: ./Dockerfile
  #   environment:
  #     DIAL_URL: "http://core:8080"
  #     SHOW_USAGE_STATISTICS: "true"
  #     QUICKAPP_LOG_LEVEL: "DEBUG"

  # DIAL Admin (optional). Enable with: docker compose --profile admin up -d
  # Or set COMPOSE_PROFILES=admin in .env
  admin-backend:
    profiles: ["admin"]
    image: epam/ai-dial-admin-backend:development
    ports:
      - "8092:8080"
    depends_on:
      core:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/api/v1/health || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 120s
    volumes:
      - admin-backend-data:/app/data
      - ./docker_compose_files/core/configuration:/opt/core-config:ro
      - ./docker_compose_files/core/admin-export:/app/data/export
    environment:
      CONFIG_REST_SECURITY_MODE: "none"
      DISABLE_SWAGGER_AUTHORIZATION: "true"
      CORE_CLIENT_URL: "http://core:8080"
      CORE_CONFIG_VERSION: "latest"
      ENABLE_CORE_CONFIG_VERSION_AUTO_DETECT: "true"
      CORE_AUTH_METHOD: "api-key"
      CORE_AUTH_API_KEY_VALUE: "dial_api_key"
      ENABLE_CONFIG_AUTO_IMPORT_ON_BOOTSTRAP: "true"
      IMPORT_AUTO_BOOTSTRAP_FILE_PATHS: "/opt/core-config/applications.json,/opt/core-config/application-schemas.json,/opt/core-config/toolsets.json,/opt/core-config/chathub/anthropic.json,/opt/core-config/chathub/gemini.json,/opt/core-config/chathub/openai.json,/opt/core-config/generated/models.json"
      IMPORT_AUTO_BOOTSTRAP_STRATEGY: "MERGE_JSON"
      CONFIG_EXPORT_ENABLED: "true"
      CONFIG_EXPORT_STORAGETYPE: "LOCAL_FILE"
      CONFIG_EXPORT_OUTPUTFILE_PATH: "data/export/out.json"
      ENABLE_CONFIG_RELOAD: "true"
      OTEL_SDK_DISABLED: "true"
      METRICS_ENABLED: "false"
      H2_FILE: "./data/testdb"
      H2_DATASOURCE_PASSWORD: "password"
      H2_DATASOURCE_MASTER_KEY: "t8+npcgNMiipR+kHMb8zXAjgA3IedCXC"
      H2_DATASOURCE_ENCRYPTED_FILE_KEY: "9vW1l/Eg+1J3YXpCsyR6AUI4ptMtI6pjkktePuUQts+wKVAauoP5CG21z5WTzp91xBcEww=="

  admin-frontend:
    profiles: ["admin"]
    image: epam/ai-dial-admin-frontend:development
    ports:
      - "3020:3000"
    depends_on:
      admin-backend:
        condition: service_healthy
      core:
        condition: service_healthy
      themes:
        condition: service_started
      keycloak:
        condition: service_started
    environment:
      DIAL_ADMIN_API_URL: "http://admin-backend:8080/"
      NEXTAUTH_SECRET: "secret"
      NEXTAUTH_URL: "http://localhost:3020"
      DIAL_CORE_API_URL: "http://core:8080"
      THEMES_CONFIG_URL: "http://themes:8080"
      DIAL_LINK: "http://localhost:3010"
      DEPLOYMENTS_ENABLED: "true"
      MCP_REGISTRY_ENABLED: "false"
      NIM_ENABLED: "false"
      HF_ENABLED: "false"
      AUTH_KEYCLOAK_CLIENT_ID: "dial-local"
      AUTH_KEYCLOAK_SECRET: "dial-local-dev-secret"
      AUTH_KEYCLOAK_HOST: "https://keycloak.localtest.me:8443/realms/dial-dev"
      AUTH_KEYCLOAK_ADMIN_ROLE_NAMES: "admin"
      AUTH_KEYCLOAK_DIAL_ROLES_FIELD: "realm_access.roles"
      NODE_EXTRA_CA_CERTS: "/certs/ca.crt"
    volumes:
      - ./docker_compose_files/keycloak/certs/ca.crt:/certs/ca.crt:ro

volumes:
  admin-backend-data: