name: k1412-agent

services:
  web:
    build:
      context: .
      dockerfile: docker/web.Dockerfile
    image: ${WEB_IMAGE:-k1412-agent-web:dev}
    restart: unless-stopped
    ports:
      - "${WEB_PORT:-3000}:8080"
    environment:
      WEBUI_URL: ${WEBUI_URL:-http://localhost:3000}
      WEBUI_NAME: K1412 Agent
      K1412_REMOVE_UPSTREAM_BRANDING: ${K1412_REMOVE_UPSTREAM_BRANDING:-false}
      WEBUI_FAVICON_URL: /static/favicon.png
      CORS_ALLOW_ORIGIN: ${CORS_ALLOW_ORIGIN:-http://localhost:3000}
      WEBUI_AUTH: "true"
      WEBUI_SECRET_KEY: ${WEBUI_SECRET_KEY:?WEBUI_SECRET_KEY is required}
      WEBUI_ADMIN_EMAIL: ${WEBUI_ADMIN_EMAIL:?WEBUI_ADMIN_EMAIL is required}
      WEBUI_ADMIN_PASSWORD: ${WEBUI_ADMIN_PASSWORD:?WEBUI_ADMIN_PASSWORD is required}
      WEBUI_ADMIN_NAME: Administrator
      WEBUI_SESSION_COOKIE_SAME_SITE: lax
      WEBUI_SESSION_COOKIE_SECURE: ${WEBUI_COOKIE_SECURE:-false}
      WEBUI_AUTH_COOKIE_SAME_SITE: lax
      WEBUI_AUTH_COOKIE_SECURE: ${WEBUI_COOKIE_SECURE:-false}
      JWT_EXPIRES_IN: 7d
      ENABLE_SIGNUP: "true"
      DEFAULT_USER_ROLE: pending
      ENABLE_SIGNUP_PASSWORD_CONFIRMATION: "true"
      ENABLE_FORWARD_USER_INFO_HEADERS: "true"
      FORWARD_USER_INFO_HEADER_JWT_SECRET: ${OPENWEBUI_FORWARD_JWT_SECRET:?OPENWEBUI_FORWARD_JWT_SECRET is required}
      FORWARD_USER_INFO_HEADER_JWT_EXPIRES_SECONDS: "300"
      K1412_GATEWAY_URL: http://gateway:8001
      K1412_GATEWAY_KEY: ${INTERNAL_GATEWAY_KEY:?INTERNAL_GATEWAY_KEY is required}
      OPENAI_API_BASE_URL: http://runtime:8000/v1
      OPENAI_API_KEY: ${INTERNAL_PROVIDER_KEY:?INTERNAL_PROVIDER_KEY is required}
      DEFAULT_MODELS: chat-medium
      TASK_MODEL: chat-light
      ENABLE_TITLE_GENERATION: "false"
      ENABLE_FOLLOW_UP_GENERATION: "false"
      ENABLE_TAGS_GENERATION: "false"
      ENABLE_SEARCH_QUERY_GENERATION: "false"
      ENABLE_RETRIEVAL_QUERY_GENERATION: "false"
      ENABLE_AUTOCOMPLETE_GENERATION: "false"
      ENABLE_IMAGE_PROMPT_GENERATION: "false"
      ENABLE_OLLAMA_API: "false"
      ENABLE_DIRECT_CONNECTIONS: "false"
      ENABLE_PERSISTENT_CONFIG: "false"
      ENABLE_VERSION_UPDATE_CHECK: "false"
      SAFE_MODE: "true"
      ENABLE_COMMUNITY_SHARING: "false"
      ENABLE_WEB_SEARCH: "false"
      ENABLE_IMAGE_GENERATION: "false"
      ENABLE_CODE_EXECUTION: "false"
      ENABLE_CODE_INTERPRETER: "false"
      ENABLE_MEMORIES: "false"
      ENABLE_NOTES: "false"
      ENABLE_CHANNELS: "false"
      ENABLE_CALENDAR: "false"
      ENABLE_AUTOMATIONS: "false"
      ENABLE_EVALUATION_ARENA_MODELS: "false"
      ENABLE_USER_STATUS: "false"
      RAG_EMBEDDING_ENGINE: openai
      RAG_EMBEDDING_MODEL: disabled
      RAG_OPENAI_API_BASE_URL: http://runtime:8000/v1
      RAG_OPENAI_API_KEY: ${INTERNAL_PROVIDER_KEY:?INTERNAL_PROVIDER_KEY is required}
      RAG_EMBEDDING_MODEL_AUTO_UPDATE: "false"
      RAG_RERANKING_MODEL_AUTO_UPDATE: "false"
      ENABLE_RAG_HYBRID_SEARCH: "false"
      BYPASS_EMBEDDING_AND_RETRIEVAL: "true"
      VECTOR_DB: disabled
      STORAGE_PROVIDER: local
      USER_PERMISSIONS_WORKSPACE_MODELS_ACCESS: "false"
      USER_PERMISSIONS_WORKSPACE_KNOWLEDGE_ACCESS: "false"
      USER_PERMISSIONS_WORKSPACE_PROMPTS_ACCESS: "false"
      USER_PERMISSIONS_WORKSPACE_TOOLS_ACCESS: "false"
      USER_PERMISSIONS_WORKSPACE_SKILLS_ACCESS: "false"
      USER_PERMISSIONS_CHAT_CONTROLS: "false"
      USER_PERMISSIONS_CHAT_VALVES: "false"
      USER_PERMISSIONS_CHAT_SYSTEM_PROMPT: "false"
      USER_PERMISSIONS_CHAT_PARAMS: "false"
      USER_PERMISSIONS_CHAT_MULTIPLE_MODELS: "false"
      USER_PERMISSIONS_CHAT_SHARE: "false"
      USER_PERMISSIONS_CHAT_ALLOW_PUBLIC_SHARING: "false"
      USER_PERMISSIONS_FEATURES_DIRECT_TOOL_SERVERS: "false"
      USER_PERMISSIONS_FEATURES_WEB_SEARCH: "false"
      USER_PERMISSIONS_FEATURES_IMAGE_GENERATION: "false"
      USER_PERMISSIONS_FEATURES_CODE_INTERPRETER: "false"
      USER_PERMISSIONS_FEATURES_API_KEYS: "false"
      USER_PERMISSIONS_FEATURES_MEMORIES: "false"
      USER_PERMISSIONS_FEATURES_AUTOMATIONS: "false"
      USER_PERMISSIONS_FEATURES_CHANNELS: "false"
      USER_PERMISSIONS_FEATURES_CALENDAR: "false"
      USER_PERMISSIONS_FEATURES_NOTES: "false"
      USER_PERMISSIONS_SETTINGS_INTERFACE: "false"
      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-agent}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/${POSTGRES_DB:-agent}
      REDIS_URL: redis://redis:6379/0
    volumes:
      - openwebui-data:/app/backend/data
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      runtime:
        condition: service_healthy
    networks:
      - internal
      - public
    healthcheck:
      test: ["CMD", "curl", "--silent", "--fail", "http://127.0.0.1:8080/health"]
      interval: 15s
      timeout: 5s
      retries: 20

  runtime:
    build:
      context: .
      dockerfile: docker/runtime.Dockerfile
    image: ${RUNTIME_IMAGE:-k1412-agent-runtime:dev}
    restart: unless-stopped
    environment:
      MODEL_API_BASE_URL: ${MODEL_API_BASE_URL:-https://api.k1412.top}
      MODEL_API_KEY: ${MODEL_API_KEY:?MODEL_API_KEY is required}
      OPENWEBUI_FORWARD_JWT_SECRET: ${OPENWEBUI_FORWARD_JWT_SECRET:?OPENWEBUI_FORWARD_JWT_SECRET is required}
      INTERNAL_PROVIDER_KEY: ${INTERNAL_PROVIDER_KEY:?INTERNAL_PROVIDER_KEY is required}
      INTERNAL_GATEWAY_KEY: ${INTERNAL_GATEWAY_KEY:?INTERNAL_GATEWAY_KEY is required}
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-agent}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/${POSTGRES_DB:-agent}
      GATEWAY_URL: http://gateway:8001
    depends_on:
      postgres:
        condition: service_healthy
      gateway:
        condition: service_healthy
    networks:
      - internal
      - egress
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=128m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  gateway:
    build:
      context: .
      dockerfile: docker/gateway.Dockerfile
    image: ${GATEWAY_IMAGE:-k1412-agent-gateway:dev}
    restart: unless-stopped
    environment:
      OPENWEBUI_FORWARD_JWT_SECRET: ${OPENWEBUI_FORWARD_JWT_SECRET:?OPENWEBUI_FORWARD_JWT_SECRET is required}
      INTERNAL_GATEWAY_KEY: ${INTERNAL_GATEWAY_KEY:?INTERNAL_GATEWAY_KEY is required}
      EXECUTION_PROVIDER: ${EXECUTION_PROVIDER:-local-docker}
      WORKSPACE_IMAGE: ${WORKSPACE_IMAGE:-k1412-agent-workspace:dev}
      WORKSPACE_NETWORK_ENABLED: ${WORKSPACE_NETWORK_ENABLED:-true}
      WORKSPACE_MEMORY_LIMIT: ${WORKSPACE_MEMORY_LIMIT:-2g}
      WORKSPACE_CPU_LIMIT: ${WORKSPACE_CPU_LIMIT:-2}
      WORKSPACE_PIDS_LIMIT: ${WORKSPACE_PIDS_LIMIT:-512}
      WORKSPACE_SSH_HOST: ${WORKSPACE_SSH_HOST:-}
      WORKSPACE_DOWNLOAD_MAX_BYTES: ${WORKSPACE_DOWNLOAD_MAX_BYTES:-134217728}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - internal
      - egress
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=128m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  bootstrap:
    build:
      context: .
      dockerfile: docker/runtime.Dockerfile
    image: ${RUNTIME_IMAGE:-k1412-agent-runtime:dev}
    restart: "no"
    command: ["python", "-m", "agent_platform.bootstrap"]
    environment:
      OPENWEBUI_INTERNAL_URL: http://web:8080
      WEBUI_ADMIN_EMAIL: ${WEBUI_ADMIN_EMAIL:?WEBUI_ADMIN_EMAIL is required}
      WEBUI_ADMIN_PASSWORD: ${WEBUI_ADMIN_PASSWORD:?WEBUI_ADMIN_PASSWORD is required}
      INTERNAL_GATEWAY_KEY: ${INTERNAL_GATEWAY_KEY:?INTERNAL_GATEWAY_KEY is required}
      GATEWAY_URL: http://gateway:8001
    depends_on:
      web:
        condition: service_healthy
      gateway:
        condition: service_healthy
    networks:
      - internal

  postgres:
    image: postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-agent}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      POSTGRES_DB: ${POSTGRES_DB:-agent}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-agent} -d ${POSTGRES_DB:-agent}"]
      interval: 5s
      timeout: 5s
      retries: 20

  redis:
    image: redis:8-alpine@sha256:8096655e437712b07503796fb64d81359256cfcff0ab29d95a7da72863786efb
    restart: unless-stopped
    command: ["redis-server", "--save", "60", "1", "--appendonly", "yes"]
    volumes:
      - redis-data:/data
    networks:
      - internal
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20

  workspace-image:
    build:
      context: .
      dockerfile: docker/workspace.Dockerfile
    image: ${WORKSPACE_IMAGE:-k1412-agent-workspace:dev}
    command: ["true"]
    profiles: ["build-only"]

networks:
  public:
  egress:
  internal:
    internal: true

volumes:
  openwebui-data:
  postgres-data:
  redis-data: