MatCreator/docker-compose.server.yml at main · AI4MS/MatCreator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
# Server mode: multi-user deployment with per-user Docker worker containers.
#
# Each registered user gets a dedicated worker container that runs the ADK API
# server and has its own isolated ~/.matcreator tree (session DB, knowledge
# graph, workspace, memory, config).
#
# Admin session visibility: the control plane mounts the server data root and
# reads users/<user_id>/.matcreator/.adk/session.db without requiring the worker
# to be running. Workers mount only their own user directory read-write.
#
# Usage:
#   export MATCREATOR_HOST_DATA_ROOT="$(pwd)/server-data"
#   export MATCREATOR_HOST_CONFIG_PATH="$(pwd)/config.yaml"   # optional; default shown
#   docker compose -f docker-compose.server.yml build control-plane worker-image
#   docker compose -f docker-compose.server.yml up -d
#
# Prerequisites:
#   - Build the control-plane and worker images with the command above.
#   - Put service defaults in ${MATCREATOR_HOST_CONFIG_PATH:-./config.yaml}

x-worker-defaults: &worker-defaults
  image: ${MATCREATOR_WORKER_IMAGE:-matcreator-worker:latest}
  restart: unless-stopped
  environment:
    - MATCREATOR_MODE=server
    - MATCREATOR_WORKER_CONNECT_MODE=network
  networks:
    - matcreator-net

services:

  # Build-only service for the dynamically provisioned per-user worker image.
  # It is profile-gated so normal `up` never creates a shared worker container.
  worker-image:
    build:
      context: .
      target: worker
    image: ${MATCREATOR_WORKER_IMAGE:-matcreator-worker:latest}
    profiles: ["build"]

  # --------------------------------------------------------------------------
  # Reverse proxy — routes browser traffic to the control plane
  # --------------------------------------------------------------------------
  # Nginx reverse proxy — routes browser traffic to the control plane.
  # The nginx config template is processed by envsubst at container startup,
  # replacing ${MATCREATOR_WEB_PORT} and ${MATCREATOR_SERVER_PROXY_PORT} with
  # the values set in the environment below.
  proxy:
    image: nginx:stable-alpine
    command: >
      sh -c "envsubst '$$MATCREATOR_WEB_PORT $$MATCREATOR_SERVER_PROXY_PORT' < /etc/nginx/conf.d/default.conf.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"
    ports:
      - "${MATCREATOR_SERVER_PROXY_HOST_PORT:-80}:${MATCREATOR_SERVER_PROXY_PORT:-80}"
    volumes:
      - ./deploy/nginx.server.conf.template:/etc/nginx/conf.d/default.conf.template:ro
    environment:
      - MATCREATOR_WEB_PORT=${MATCREATOR_WEB_PORT:-8001}
      - MATCREATOR_SERVER_PROXY_PORT=${MATCREATOR_SERVER_PROXY_PORT:-80}
    depends_on:
      - control-plane
    networks:
      - matcreator-net
    restart: unless-stopped

  # --------------------------------------------------------------------------
  # Control plane — auth, session management, worker lifecycle, admin API
  #
  # Mounts the server data root so admin can query all users' session DBs.
  # Mounts /var/run/docker.sock so it can spawn/stop worker containers.
  # --------------------------------------------------------------------------
  control-plane:
    build:
      context: .
      target: control-plane
    image: ${MATCREATOR_CONTROL_PLANE_IMAGE:-matcreator-control-plane:latest}
    environment:
      - MATCREATOR_MODE=server
      - MATCREATOR_DATA_ROOT=/data/matcreator
      - MATCREATOR_HOME=/data/matcreator/control-plane/.matcreator
      - MATCREATOR_CONFIG_PATH=/app/config.yaml
      - MATCREATOR_HOST_DATA_ROOT=${MATCREATOR_HOST_DATA_ROOT:-${PWD}/server-data}
      # Optional: use a curated default skill directory instead of the image's
      # bundled module skills. The path must exist inside both the control-plane
      # container and worker containers. For host skills, mount the directory at
      # the same container path for both, then set this value to that path.
      # Example: export MATCREATOR_MODULE_SKILLS_ROOT=/app/custom-skills
      - MATCREATOR_MODULE_SKILLS_ROOT=${MATCREATOR_MODULE_SKILLS_ROOT:-}
      - MATCREATOR_WORKER_CONNECT_MODE=network
      - MATCREATOR_WORKER_NETWORK=matcreator-net
      - MATCREATOR_WORKER_IMAGE=${MATCREATOR_WORKER_IMAGE:-matcreator-worker:latest}
      # Worker resource controls. Empty CPU/memory values mean "Docker default".
      - MATCREATOR_WORKER_IDLE_TIMEOUT_SECONDS=${MATCREATOR_WORKER_IDLE_TIMEOUT_SECONDS:-1800}
      - MATCREATOR_WORKER_MEM_LIMIT=${MATCREATOR_WORKER_MEM_LIMIT:-}
      - MATCREATOR_WORKER_CPUS=${MATCREATOR_WORKER_CPUS:-}
      - MATCREATOR_WORKER_PIDS_LIMIT=${MATCREATOR_WORKER_PIDS_LIMIT:-}
      # Extra worker bind mounts, comma-separated: host_path:container_path[:ro|rw]
      # Example: ${PWD}/share:/share:ro
      - MATCREATOR_WORKER_SHARED_MOUNTS=${MATCREATOR_WORKER_SHARED_MOUNTS:-}
      # Port configuration — control-plane port and worker port range.
      - MATCREATOR_ADK_PORT=${MATCREATOR_ADK_PORT:-8000}
      - ADK_LOCAL_PORT=${MATCREATOR_ADK_PORT:-8000}
      - MATCREATOR_WEB_PORT=${MATCREATOR_WEB_PORT:-8001}
      - MATCREATOR_WORKER_BASE_PORT=${MATCREATOR_WORKER_BASE_PORT:-9001}
    volumes:
      # Control-plane state plus read-only/admin view of user data.
      - ${MATCREATOR_HOST_DATA_ROOT:-./server-data}:/data/matcreator
      # Server-wide MatCreator defaults. Set MATCREATOR_HOST_CONFIG_PATH to override.
      - ${MATCREATOR_HOST_CONFIG_PATH:-./config.yaml}:/app/config.yaml:ro
      # Optional host-mounted curated skills. Keep the container path aligned
      # with MATCREATOR_MODULE_SKILLS_ROOT and add the same bind to
      # MATCREATOR_WORKER_SHARED_MOUNTS so spawned workers can read it too.
      # - ${MATCREATOR_HOST_SKILLS_ROOT:-./selected-skills}:/app/custom-skills:ro
      # Docker socket so control plane can manage worker containers
      - /var/run/docker.sock:/var/run/docker.sock
      - ./logs:/app/logs
    ports:
      - "${MATCREATOR_WEB_HOST_PORT:-8001}:${MATCREATOR_WEB_PORT:-8001}"
    networks:
      - matcreator-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:${MATCREATOR_WEB_PORT:-8001}/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # --------------------------------------------------------------------------
  # Worker template (example for user "alice" — real workers are spawned
  # dynamically by the control plane via the Docker API on first login).
  #
  # Each worker gets:
  #   - /root/.matcreator mounted from
  #     ${MATCREATOR_HOST_DATA_ROOT}/users/<user_id>/.matcreator
  #   - No public host port by default; the control plane reaches it through
  #     the matcreator-net Docker network.
  # --------------------------------------------------------------------------
  # worker-alice:
  #   <<: *worker-defaults
  #   command: matcreator api-server --host 0.0.0.0 --port ${MATCREATOR_ADK_PORT:-8000}
  #   volumes:
  #     - ${MATCREATOR_HOST_DATA_ROOT}/users/alice/.matcreator:/root/.matcreator
  #   environment:
  #     - MATCREATOR_MODE=server
  #     - MATCREATOR_USER_ID=alice

networks:
  matcreator-net:
    name: matcreator-net
    driver: bridge