quickstart-services-ai-debug.yml

version: '3.7'

volumes:
  alkemio_dev_postgres:
  tmpvolume:
  rabbitmq_data:
    driver: local
  alkemio_dev_synapse:

networks:
  alkemio_dev_net:

services:
  traefik:
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    container_name: alkemio_dev_traefik
    image: traefik:v2.9.6
    restart: always
    ports:
      - 8888:8080
      - 8088:8088
      - 8280:8280
      - 3000:80
      - 5432:5432
      - 8008:8008
      - 4436:4436
      - 4437:4437
      - 1025:1025
      - 5672:5672
      - 15672:15672
      - 6379:6379
      - 8188:8188
    networks:
      - alkemio_dev_net
    environment:
      - TZ=Europe/Amsterdam
    volumes:
      - type: bind
        source: ./.build/traefik/
        target: /etc/traefik/

  kratos-migrate:
    container_name: alkemio_dev_kratos_migrate
    image: oryd/kratos:v26.2.0
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      - DSN=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
    restart: on-failure
    networks:
      - alkemio_dev_net
    volumes:
      - type: bind
        source: ./.build/ory/kratos
        target: /etc/config/kratos
    command: -c /etc/config/kratos/kratos.yml migrate sql -e --yes

  kratos:
    container_name: alkemio_dev_kratos
    image: oryd/kratos:v26.2.0
    depends_on:
      kratos-migrate:
        condition: service_completed_successfully
    ports:
      - 4433
      - 4434
    restart: unless-stopped
    environment:
      - DSN=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
      - LOG_LEVEL=trace
    networks:
      - alkemio_dev_net
    volumes:
      - type: bind
        source: ./.build/ory/kratos
        target: /etc/config/kratos
    command: serve -c /etc/config/kratos/kratos.yml --dev --watch-courier

  hydra-migrate:
    container_name: alkemio_dev_hydra_migrate
    image: oryd/hydra:v26.2.0
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      - DSN=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/hydra?sslmode=disable&max_conns=20&max_idle_conns=4
    command: migrate sql -e --yes
    networks:
      - alkemio_dev_net
    restart: on-failure

  hydra:
    container_name: alkemio_dev_hydra
    image: oryd/hydra:v26.2.0
    depends_on:
      hydra-migrate:
        condition: service_completed_successfully
    ports:
      - 4444
      - 4445
    environment:
      - DSN=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/hydra?sslmode=disable&max_conns=20&max_idle_conns=4&max_conn_lifetime=30m&max_conn_idle_time=5m
      - SECRETS_SYSTEM=${HYDRA_SYSTEM_SECRET}
      - URLS_SELF_PUBLIC=${HYDRA_PUBLIC_URL}/
      - URLS_SELF_ISSUER=${HYDRA_PUBLIC_URL}/
      - URLS_LOGIN=${HYDRA_PUBLIC_URL}/oidc/login
      - URLS_CONSENT=${HYDRA_PUBLIC_URL}/oidc/consent
      - URLS_SELF_ADMIN=http://hydra:4445/
      - SERVE_PUBLIC_CORS_ENABLED=true
      - SERVE_ADMIN_CORS_ENABLED=true
      - OAUTH2_ALLOWED_TOP_LEVEL_CLAIMS=email,email_verified,given_name,family_name
      - LOG_LEVEL=debug
    command: serve all --dev
    networks:
      - alkemio_dev_net
    restart: unless-stopped

  hydra-client-setup:
    container_name: alkemio_dev_hydra_client_setup
    image: curlimages/curl:8.1.2
    depends_on:
      - hydra
    environment:
      - HYDRA_ADMIN_URL=http://hydra:4445
      - SYNAPSE_OIDC_CLIENT_ID
      - SYNAPSE_OIDC_CLIENT_SECRET
      - SYNAPSE_PUBLIC_URL
    networks:
      - alkemio_dev_net
    restart: on-failure
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        echo "Waiting for Hydra to be ready..."
        until curl -sf $$HYDRA_ADMIN_URL/health/ready > /dev/null 2>&1; do
          echo "Hydra not ready yet, waiting..."
          sleep 2
        done
        echo "Hydra is ready, checking if client exists..."

        # Check if client already exists
        if curl -sf $$HYDRA_ADMIN_URL/admin/clients/$$SYNAPSE_OIDC_CLIENT_ID > /dev/null 2>&1; then
          echo "Client $$SYNAPSE_OIDC_CLIENT_ID already exists, updating it..."
          curl -X PUT $$HYDRA_ADMIN_URL/admin/clients/$$SYNAPSE_OIDC_CLIENT_ID \
            -H "Content-Type: application/json" \
            -d "{
              \"client_id\": \"$$SYNAPSE_OIDC_CLIENT_ID\",
              \"client_name\": \"Synapse Matrix Server\",
              \"client_secret\": \"$$SYNAPSE_OIDC_CLIENT_SECRET\",
              \"grant_types\": [\"authorization_code\", \"refresh_token\"],
              \"response_types\": [\"code\"],
              \"redirect_uris\": [\"$$SYNAPSE_PUBLIC_URL/_synapse/client/oidc/callback\"],
              \"scope\": \"openid profile email\",
              \"token_endpoint_auth_method\": \"client_secret_basic\"
            }"
          echo "Client updated successfully"
          exit 0
        fi

        echo "Registering Synapse OAuth2 client..."
        curl -X POST $$HYDRA_ADMIN_URL/admin/clients \
          -H "Content-Type: application/json" \
          -d "{
            \"client_id\": \"$$SYNAPSE_OIDC_CLIENT_ID\",
            \"client_name\": \"Synapse Matrix Server\",
            \"client_secret\": \"$$SYNAPSE_OIDC_CLIENT_SECRET\",
            \"grant_types\": [\"authorization_code\", \"refresh_token\"],
            \"response_types\": [\"code\"],
            \"redirect_uris\": [\"$$SYNAPSE_PUBLIC_URL/_synapse/client/oidc/callback\"],
            \"scope\": \"openid profile email\",
            \"token_endpoint_auth_method\": \"client_secret_basic\"
          }"

        if [ $$? -eq 0 ]; then
          echo "Successfully registered Synapse OAuth2 client"
        else
          echo "Failed to register Synapse client"
          exit 1
        fi

        # Register client-web OAuth2 client (for OIDC-based frontend flows)
        if [ -n "$$CLIENT_WEB_OIDC_CLIENT_ID" ] && [ -n "$$CLIENT_WEB_OIDC_CLIENT_SECRET" ] && [ -n "$$CLIENT_WEB_PUBLIC_URL" ]; then
          echo "Registering client-web OAuth2 client..."
          curl -X POST $$HYDRA_ADMIN_URL/admin/clients \
            -H "Content-Type: application/json" \
            -d "{
              \"client_id\": \"$$CLIENT_WEB_OIDC_CLIENT_ID\",
              \"client_name\": \"Alkemio Client Web\",
              \"client_secret\": \"$$CLIENT_WEB_OIDC_CLIENT_SECRET\",
              \"grant_types\": [\"authorization_code\", \"refresh_token\"],
              \"response_types\": [\"code\"],
              \"redirect_uris\": [\"$$CLIENT_WEB_PUBLIC_URL/oidc/callback\"],
              \"scope\": \"openid profile email\",
              \"token_endpoint_auth_method\": \"client_secret_basic\"
            }"

          if [ $$? -eq 0 ]; then
            echo "Successfully registered client-web OAuth2 client"
          else
            echo "Failed to register client-web client"
            exit 1
          fi
        else
          echo "Skipping client-web OAuth2 client registration (CLIENT_WEB_OIDC_CLIENT_ID/SECRET or CLIENT_WEB_PUBLIC_URL not set)"
        fi

  oidc-service:
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    container_name: alkemio_dev_oidc_service
    image: docker.io/alkemio/oidc-service:v0.7.3
    depends_on:
      - hydra
      - kratos
    environment:
      - OIDC_ALLOW_INSECURE_HTTP=true
      - OIDC_HYDRA_ADMIN_URL
      - OIDC_KRATOS_ADMIN_URL
      - OIDC_KRATOS_PUBLIC_URL
      - OIDC_KRATOS_BROWSER_URL=http://localhost:3000/ory/kratos/public
      - OIDC_WEB_BASE_URL=http://localhost:3000
      - OIDC_ALKEMIO_SERVER_URL
      - OIDC_ALKEMIO_IDENTITY_RESOLVE_PATH
      - DATABASE_HOST
      - DATABASE_PORT
      - DATABASE_USERNAME
      - DATABASE_PASSWORD
      - DATABASE_NAME=alkemio
    networks:
      - alkemio_dev_net
    ports:
      - 8080
    restart: unless-stopped

  oathkeeper:
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    container_name: alkemio_dev_oathkeeper
    image: oryd/oathkeeper:v26.2.0
    restart: always
    depends_on:
      - kratos
    ports:
      - 4455
      - 4456
    environment:
      - LOG_LEVEL=debug
    networks:
      - alkemio_dev_net
    volumes:
      - ./.build/ory/oathkeeper:/etc/config/oathkeeper
    command: serve proxy -c "/etc/config/oathkeeper/oathkeeper.yml"

  mailslurper:
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    container_name: alkemio_dev_kratos_mailslurper
    image: oryd/mailslurper:latest-smtps
    restart: always
    ports:
      - 4436
      - 4437
      - 1025
    networks:
      - alkemio_dev_net

  synapse:
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    container_name: alkemio_dev_synapse
    image: matrixdotorg/synapse:v1.132.0
    depends_on:
      - postgres
    restart: always
    environment:
      - SYNAPSE_NO_TLS=true
      - SYNAPSE_ENABLE_REGISTRATION=true
      - SYNAPSE_HOMESERVER_NAME
      - SYNAPSE_SERVER_URL
      - SYNAPSE_SERVER_SHARED_SECRET
      - PYTHONPATH=/data/modules
    networks:
      - alkemio_dev_net
    ports:
      - 8008
    volumes:
      - type: bind
        source: ./.build/synapse
        target: /data
      - type: volume
        source: alkemio_dev_synapse
        target: /data/keys
        read_only: false

  postgres:
    container_name: alkemio_dev_postgres
    image: postgres:17.5
    networks:
      - alkemio_dev_net
    environment:
      - POSTGRES_DB=synapse
      - POSTGRES_USER
      - POSTGRES_PASSWORD
      - POSTGRES_INITDB_ARGS=--encoding=UTF8 --lc-collate=C --lc-ctype=C
      - POSTGRES_MULTIPLE_DATABASES
    entrypoint: [ "bash", "/usr/local/bin/entrypoint-wrapper.sh" ]
    restart: always
    ports:
      - 5432
    volumes:
      - alkemio_dev_postgres:/var/lib/postgresql
      - ./.build/postgres/init-multiple-databases.sh:/docker-entrypoint-initdb.d/init-multiple-databases.sh
      - ./.build/postgres/entrypoint-wrapper.sh:/usr/local/bin/entrypoint-wrapper.sh:ro
    healthcheck:
      test: >
        bash -c "databases=\"$$POSTGRES_DB,$$POSTGRES_MULTIPLE_DATABASES\"; for db in $$(echo \"$$databases\" | tr ',' ' '); do [ -z \"$$db\" ] && continue; pg_isready -U \"$$POSTGRES_USER\" -d \"$$db\" -h localhost || exit 1; done"
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 5s

  rabbitmq:
    container_name: alkemio_dev_rabbitmq
    image: rabbitmq:3.9.13-management
    restart: always
    networks:
      - alkemio_dev_net
    ports:
      - 5672
      - 15672
    environment:
      - RABBITMQ_SECURE_PASSWORD=yes
      - RABBITMQ_DEFAULT_USER=alkemio-admin
      - RABBITMQ_DEFAULT_PASS=alkemio!
    healthcheck:
      test: rabbitmq-diagnostics check_port_connectivity
      interval: 30s
      timeout: 30s
      retries: 10
    volumes:
      - ~/.docker-conf/rabbitmq/data/:/var/lib/rabbitmq/mnesia
      - ~/.docker-conf/rabbitmq/log/:/var/log/rabbitmq
    command:
      [
        'bash',
        '-c',
        'chmod 400 /var/lib/rabbitmq/.erlang.cookie; rabbitmq-server --hostname rmq',
      ]

  matrix-adapter:
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    container_name: alkemio_dev_matrix_adapter
    hostname: matrix-adapter
    image: alkemio/matrix-adapter-go:v0.8.14
    depends_on:
      - rabbitmq
    environment:
      - RABBITMQ_HOST
      - RABBITMQ_USER
      - RABBITMQ_PASSWORD
      - SYNAPSE_HOMESERVER_NAME
      - SYNAPSE_SERVER_URL
      - SYNAPSE_SERVER_NAME
      - SYNAPSE_SERVER_SHARED_SECRET
      - MATRIX_AS_TOKEN
      - MATRIX_HS_TOKEN
      #      - MATRIX_BOT_ACTOR_ID
      - LOGGING_CONSOLE_ENABLED
      - LOGGING_LEVEL_CONSOLE=debug
      - ENVIRONMENT=dev
      - WAIT_HOSTS=host.docker.internal:3000
      - WAIT_TIMEOUT=300
      - WAIT_SLEEP_INTERVAL=30
      - WAIT_HOST_CONNECT_TIMEOUT=30
      - WAIT_COMMAND=/app/matrix-adapter
      - DATABASE_HOST
      - DATABASE_PORT
      - DATABASE_USERNAME
      - DATABASE_PASSWORD
      - DATABASE_NAME=alkemio
      - ACTOR_ID_MAPPER_ENABLED=false
    restart: always
    networks:
      - alkemio_dev_net
    ports:
      - 8280
    entrypoint: ["/wait"]

  redis:
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    container_name: alkemio_dev_redis
    hostname: redis
    image: redis:7.0.2
    restart: always
    networks:
      - alkemio_dev_net
    ports:
      - 6379

  virtual_contributor_engine_guidance:
    container_name: alkemio_dev_virtual_contributor_engine_guidance
    hostname: virtual-contributor-engine-guidance
    build:
      context: '../virtual-contributor-engine-guidance'
      dockerfile: ../virtual-contributor-engine-guidance/Dockerfile
    platform: linux/amd64
    restart: always
    volumes:
       - /dev/shm:/dev/shm
       - ~/alkemio/data:${AI_LOCAL_PATH:-/home/alkemio/data}
    networks:
      - alkemio_dev_net
    depends_on:
      rabbitmq:
        condition: "service_healthy"
    environment:
      - RABBITMQ_HOST
      - RABBITMQ_USER
      - RABBITMQ_PASSWORD
      - ENVIRONMENT=dev
      - EMBEDDINGS_DEPLOYMENT_NAME
      - AZURE_OPENAI_API_KEY
      - AZURE_OPENAI_ENDPOINT
      - OPENAI_API_VERSION
      - AI_MODEL_TEMPERATURE
      - AI_SOURCE_WEBSITE
      - AI_SOURCE_WEBSITE2
      - AI_WEBSITE_REPO
      - AI_WEBSITE_REPO2
      - AI_LOCAL_PATH
      - AI_GITHUB_USER
      - AI_GITHUB_PAT
      - LLM_DEPLOYMENT_NAME
      - LANGCHAIN_TRACING_V2
      - LANGCHAIN_ENDPOINT
      - LANGCHAIN_API_KEY
      - LANGCHAIN_PROJECT=virtual-contributor-engine-guidance

  # virtual-contributor-engine-community-manager:
  #   container_name: alkemio_dev_community_manager
  #   hostname: virtual-contributor-engine-community-manager
  #   build:
  #     context: '../virtual-contributor-engine-community-manager'
  #     dockerfile: ../virtual-contributor-engine-community-manager/Dockerfile
  #   platform: linux/amd64
  #   restart: always
  #   volumes:
  #      - /dev/shm:/dev/shm
  #      - ~/alkemio/data:${AI_LOCAL_PATH:-/home/alkemio/data}
  #   networks:
  #     - alkemio_dev_net
  #   depends_on:
  #     rabbitmq:
  #       condition: "service_healthy"
  #   environment:
  #     - RABBITMQ_HOST
  #     - RABBITMQ_USER
  #     - RABBITMQ_PASSWORD
  #     - RABBITMQ_QUEUE=virtual-contributor-engine-community-manager
  #     - ENVIRONMENT=dev
  #     - LOG_LEVEL=DEBUG
  #     - EMBEDDINGS_DEPLOYMENT_NAME
  #     - AZURE_OPENAI_API_KEY
  #     - AZURE_OPENAI_ENDPOINT
  #     - OPENAI_API_VERSION
  #     - AI_MODEL_TEMPERATURE
  #     - AI_LOCAL_PATH
  #     - LLM_DEPLOYMENT_NAME
  #     - LANGCHAIN_TRACING_V2
  #     - LANGCHAIN_ENDPOINT
  #     - LANGCHAIN_API_KEY
  #     - LANGCHAIN_PROJECT=virtual-contributor-engine-community-manager

  virtual_contributor_ingest_space:
    container_name: alkemio_dev_virtual_contributor_ingest_space
    hostname: virtual-contributor-ingest-space
    build:
      dockerfile: ../virtual-contributor-ingest-space/Dockerfile
      context: '../virtual-contributor-ingest-space/'
    platform: linux/amd64
    restart: always
    volumes:
       - /dev/shm:/dev/shm
       - ~/alkemio/data:${AI_LOCAL_PATH:-/home/alkemio/data}
    networks:
      - alkemio_dev_net
    depends_on:
      rabbitmq:
        condition: "service_healthy"
    environment:
      - RABBITMQ_HOST
      - RABBITMQ_USER
      - RABBITMQ_PASSWORD
      - RABBITMQ_PORT
      - RABBITMQ_QUEUE=virtual-contributor-ingest-space
      - ENVIRONMENT=dev
      - LOG_LEVEL=DEBUG
      - EMBEDDINGS_DEPLOYMENT_NAME
      - AZURE_OPENAI_API_KEY
      - AZURE_OPENAI_ENDPOINT
      - OPENAI_API_VERSION
      - AI_MODEL_TEMPERATURE
      - AI_LOCAL_PATH
      - LLM_DEPLOYMENT_NAME
      - LANGCHAIN_TRACING_V2
      - LANGCHAIN_ENDPOINT
      - LANGCHAIN_API_KEY
      - LANGCHAIN_PROJECT=virtual-contributor-ingest-space
      - VECTOR_DB_HOST
      - VECTOR_DB_PORT
      - AUTH_ADMIN_EMAIL
      - AUTH_ADMIN_PASSWORD
      - API_ENDPOINT_PRIVATE_GRAPHQL=http://host.docker.internal:3000/api/private/non-interactive/graphql
      - AUTH_ORY_KRATOS_PUBLIC_BASE_URL=http://host.docker.internal:3000/ory/kratos/public

  virtual_contributor_engine_expert:
    container_name: alkemio_dev_virtual-contributor-engine-expert
    hostname: virtual-contributor-engine-expert
    build:
      dockerfile: ../virtual-contributor-engine-expert//Dockerfile
      context: '../virtual-contributor-engine-expert/'
    platform: linux/amd64
    restart: always
    volumes:
      - /dev/shm:/dev/shm
    networks:
      - alkemio_dev_net
    depends_on:
      rabbitmq:
        condition: "service_healthy"
    environment:
      - RABBITMQ_HOST
      - RABBITMQ_USER
      - RABBITMQ_PASSWORD
      - RABBITMQ_PORT
      - RABBITMQ_QUEUE=virtual-contributor-engine-expert
      - API_ENDPOINT_PRIVATE_GRAPHQL=http://host.docker.internal:3000/api/private/non-interactive/graphql
      - AUTH_ORY_KRATOS_PUBLIC_BASE_URL=http://host.docker.internal:3000/ory/kratos/public
      - AUTH_ADMIN_EMAIL
      - AUTH_ADMIN_PASSWORD
      - OPENAI_API_VERSION
      - AI_MODEL_TEMPERATURE
      - LOG_LEVEL=DEBUG
      - AZURE_OPENAI_ENDPOINT=https://alkemio-gpt.openai.azure.com
      - AZURE_OPENAI_API_KEY
      - LLM_DEPLOYMENT_NAME=deploy-gpt-35-turbo
      - EMBEDDINGS_DEPLOYMENT_NAME=embedding
      - LANGCHAIN_TRACING_V2
      - LANGCHAIN_ENDPOINT
      - LANGCHAIN_API_KEY
      - LANGCHAIN_PROJECT=virtual-contributor-engine-expert
      - VECTOR_DB_PORT
      - VECTOR_DB_HOST
      - AI_LOCAL_PATH=./

  kratos-hooks:
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    container_name: alkemio_dev_kratos_hooks
    hostname: kratos-hooks
    image: alkemio/kratos-webhooks:v0.2.1
    depends_on:
      rabbitmq:
        condition: service_healthy
      redis:
        condition: service_started
    environment:
      - PORT=8080
      - LOG_LEVEL=info
      - LOG_FORMAT=json
      - REDIS_URL=redis://redis:6379/0
      - RABBITMQ_URL=amqp://${RABBITMQ_USER}:${RABBITMQ_PASSWORD}@rabbitmq:5672/
      - PLATFORM_URL=http://host.docker.internal:4000
      - MAINTENANCE_MODE=false
      - CORRELATION_ID_HEADER=X-Request-ID
      - LOGIN_BACKOFF_MAX_IDENTIFIER_ATTEMPTS=10
      - LOGIN_BACKOFF_MAX_IP_ATTEMPTS=20
      - LOGIN_BACKOFF_IDENTIFIER_LOCKOUT_SECONDS=120
      - LOGIN_BACKOFF_IP_LOCKOUT_SECONDS=120
      - KRATOS_INTERNAL_URL=http://kratos:4433
    restart: unless-stopped
    networks:
      - alkemio_dev_net
    ports:
      - 8080