naruon/docker-compose.yml at develop · ContextualWisdomLab/naruon · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
services:
  db:
    image: pgvector/pgvector:pg16
    environment:
      POSTGRES_DB: ai_email
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    entrypoint:
      - sh
      - -c
      - |
        : "$${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env before running Docker Compose}"
        exec docker-entrypoint.sh postgres
    ports:
      - "127.0.0.1:15432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\""]
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - postgres-data:/var/lib/postgresql/data

  ollama:
    build:
      context: .
      dockerfile: Dockerfile.ollama
    environment:
      OLLAMA_NO_CLOUD: "true"
    ports:
      - "11434:11434"

  # NewsDOM PDF DOM recognition sidecar, built from a commit-pinned git
  # context (no submodule: the PR-scope security gate fails closed on gitlink
  # entries, and a URL context keeps the default checkout self-contained).
  # Optional: the backend degrades gracefully (PDFs stay pending) when this
  # service is absent or unconfigured.
  #
  # Gated behind the "newsdom" profile so the default `docker compose build`
  # / `config` path (e.g. the coverage-evidence CI gate) never builds the
  # sidecar. Bring it up intentionally with:
  #   docker compose --profile newsdom up
  # (or COMPOSE_PROFILES=newsdom).
  newsdom:
    profiles:
      - newsdom
    build:
      # Commit-pinned for reproducible builds; bump deliberately.
      context: https://github.com/ContextualWisdomLab/newsdom-api.git#6558a4238b1614c39f7e96a961815747ac4d49ef
      dockerfile: Dockerfile
    # No host `ports` mapping: the sidecar has no authentication on /parse, so
    # it must stay on the internal compose network only. The backend reaches it
    # via the service name (ALLOWED_NEWSDOM_HOSTS: newsdom). Do not publish it
    # to the host.
    expose:
      - "8000"
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/health').status==200 else 1)\""]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  backend:
    build:
      context: .
      dockerfile: Dockerfile
      target: backend-runtime
    environment:
      DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD}@db:5432/ai_email
      READONLY_DATABASE_URL: ${READONLY_DATABASE_URL:-}
      DEBUG: "false"
      ALLOW_LOCAL_LLM_PROVIDERS: "true"
      ALLOWED_LLM_BASE_URL_HOSTS: ollama
      # NewsDOM sidecar allowlist. The actual base_url + bearer token are
      # configured per-organization in the database (NewsdomProvider), NOT here;
      # this only authorizes the container hostname for the SSRF-safe client.
      ALLOW_LOCAL_NEWSDOM_PROVIDERS: "true"
      ALLOWED_NEWSDOM_HOSTS: newsdom
      AUTH_SESSION_HMAC_SECRET: ${AUTH_SESSION_HMAC_SECRET}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
      OPENAI_API_KEY: ollama
      OPENAI_BASE_URL: http://ollama:11434/v1
      OPENAI_EMBEDDING_MODEL: embeddinggemma
      OPENAI_MODEL: gemma4:e2b-it-qat
    depends_on:
      db:
        condition: service_healthy
      ollama:
        condition: service_started
      # Optional sidecar (see the "newsdom" profile above). required: false so
      # that when the profile is inactive the dependency is dropped from the
      # graph instead of failing config/build; the backend degrades gracefully
      # (PDFs stay pending). When the profile is active, the backend still waits
      # for the sidecar to start.
      newsdom:
        condition: service_started
        required: false
    ports:
      - "8000:8000"
    command:
      - sh
      - -c
      - |
        : "$${AUTH_SESSION_HMAC_SECRET:?Set AUTH_SESSION_HMAC_SECRET in .env before running Docker Compose}"
        : "$${ENCRYPTION_KEY:?Set ENCRYPTION_KEY in .env before running Docker Compose}"
        python scripts/migrate_db.py && python scripts/start_backend.py --host 0.0.0.0 --port 8000

  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
    environment:
      # The browser uses same-origin /api/*. The Next.js route handler resolves
      # the backend through this Docker-network URL at runtime.
      BACKEND_INTERNAL_URL: http://backend:8000
      ALLOW_DOCKER_BACKEND_INTERNAL_URL: "1"
    depends_on:
      - backend
    ports:
      - "3000:3000"

volumes:
  postgres-data: