docker-compose.yml

services:
  # WebApp - SvelteKit frontend for RAG system
  webapp:
    build:
      context: ./services/webapp
      dockerfile: Dockerfile
    restart: unless-stopped
    ports:
      - "8000:3000"
    environment:
      - ORIGIN=http://localhost:8000
      - RAG_SERVER_URL=http://rag-server:8001
      - EVALS_SERVICE_URL=http://evals:8002
      - MAX_UPLOAD_SIZE=80
    depends_on:
      rag-server:
        condition: service_healthy
    networks:
      - public
      - private

  # RAG Server - API service for document processing and querying
  rag-server:
    build:
      context: .
      dockerfile: ./services/rag_server/Dockerfile
    user: "1000:1000"
    restart: unless-stopped
    ports:
      - "8001:8001"
    secrets:
      - OPENAI_API_KEY
      - ANTHROPIC_API_KEY
      - RAG_SERVER_DB_USER
      - RAG_SERVER_DB_PASSWORD
    environment:
      - DATABASE_HOST=postgres
      - DATABASE_PORT=5432
      - DATABASE_NAME=ragbench
      - CHROMADB_HOST=chromadb
      - CHROMADB_PORT=8000
      - OLLAMA_URL=http://host.docker.internal:11434
      - LOG_LEVEL=WARNING
      - MAX_UPLOAD_SIZE=80
      - SHARED_UPLOAD_DIR=/tmp/shared
      - USE_CACHED_RERANKER=true
      - ANONYMIZED_TELEMETRY=False
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      postgres:
        condition: service_healthy
      chromadb:
        condition: service_started
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8001/health', timeout=2)"]
      interval: 2s
      timeout: 3s
      retries: 5
      start_period: 10s
    networks:
      - private
      - public
    volumes:
      - ./config.yml:/app/config.yml             # Model configuration (read-write for settings)
      - ./data/indexed_documents:/app/documents
      - docs_repo:/tmp/shared
      - ./.cache/huggingface:/home/appuser/.cache/huggingface

  # PostgreSQL 17 with pg_textsearch (BM25)
  postgres:
    build:
      context: ./services/postgres
      dockerfile: Dockerfile
    environment:
      POSTGRES_USER_FILE: /run/secrets/POSTGRES_SUPERUSER
      POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_SUPERPASSWORD
      POSTGRES_DB: ragbench
    secrets:
      - POSTGRES_SUPERUSER
      - POSTGRES_SUPERPASSWORD
      - RAG_SERVER_DB_USER
      - RAG_SERVER_DB_PASSWORD
    volumes:
      - postgres_data:/var/lib/postgresql
      - ./services/postgres/00-roles.sh:/docker-entrypoint-initdb.d/00-roles.sh:ro
      - ./services/postgres/init.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
      - ./services/postgres/02-grants.sh:/docker-entrypoint-initdb.d/02-grants.sh:ro
    command: postgres -c max_connections=200
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $(cat /run/secrets/POSTGRES_SUPERUSER) -d ragbench"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - private
    restart: unless-stopped

  # ChromaDB - Vector database for embeddings
  chromadb:
    image: chromadb/chroma:latest
    environment:
      - ANONYMIZED_TELEMETRY=False
      - LOG_LEVEL=WARNING
    volumes:
      - chroma_data:/data
    networks:
      - private
    restart: unless-stopped

  # Task Worker - Async document processing via SKIP LOCKED
  task-worker:
    build:
      context: .
      dockerfile: ./services/rag_server/Dockerfile
    command: [".venv/bin/python", "-m", "infrastructure.tasks.task_worker"]
    user: "1000:1000"
    restart: unless-stopped
    secrets:
      - OPENAI_API_KEY
      - ANTHROPIC_API_KEY
      - RAG_SERVER_DB_USER
      - RAG_SERVER_DB_PASSWORD
    environment:
      - DATABASE_HOST=postgres
      - DATABASE_PORT=5432
      - DATABASE_NAME=ragbench
      - CHROMADB_HOST=chromadb
      - CHROMADB_PORT=8000
      - OLLAMA_URL=http://host.docker.internal:11434
      - LOG_LEVEL=WARNING
      - MAX_UPLOAD_SIZE=80
      - SHARED_UPLOAD_DIR=/tmp/shared
      - USE_CACHED_RERANKER=true
      - ANONYMIZED_TELEMETRY=False
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      postgres:
        condition: service_healthy
      chromadb:
        condition: service_started
      rag-server:
        condition: service_healthy
    networks:
      - private
      - public
    volumes:
      - ./config.yml:/app/config.yml             # Model configuration (read-write for settings)
      - ./data/indexed_documents:/app/documents
      - docs_repo:/tmp/shared
      - ./.cache/huggingface:/home/appuser/.cache/huggingface

  # Evals Service - API (port 8002) + CLI
  evals:
    build:
      context: .
      dockerfile: ./services/evals/Dockerfile
    restart: unless-stopped
    ports:
      - "8002:8002"
    environment:
      - RAG_SERVER_URL=http://rag-server:8001
      - LOG_LEVEL=WARNING
    volumes:
      - ./config.yml:/app/config.yml:ro
      - ./services/evals/evals/data:/app/evals/data
      - ./data/eval_runs:/app/data/eval_runs
      - ./.cache/huggingface:/home/appuser/.cache/huggingface
      - ./.cache/datasets:/app/data/dataset_cache
    secrets:
      - OPENAI_API_KEY
      - ANTHROPIC_API_KEY
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8002/health', timeout=2)"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    networks:
      - public
      - private
    depends_on:
      rag-server:
        condition: service_healthy

# Network configuration for security isolation
networks:
  public:
    driver: bridge
  private:
    driver: bridge
    internal: true # full isolation of services on this network
    external: false # =true if the network is defined outside of this file

# Persistent volumes
volumes:
  postgres_data:
    driver: local
  chroma_data:
    driver: local
  docs_repo:
    driver: local

secrets:
  OPENAI_API_KEY:
    file: secrets/OPENAI_API_KEY
  ANTHROPIC_API_KEY:
    file: secrets/ANTHROPIC_API_KEY
  POSTGRES_SUPERUSER:
    file: secrets/POSTGRES_SUPERUSER
  POSTGRES_SUPERPASSWORD:
    file: secrets/POSTGRES_SUPERPASSWORD
  RAG_SERVER_DB_USER:
    file: secrets/RAG_SERVER_DB_USER
  RAG_SERVER_DB_PASSWORD:
    file: secrets/RAG_SERVER_DB_PASSWORD