compose.yaml

name: fastrag

x-app-environment: &app-environment
  FASTRAG_ENVIRONMENT: production
  FASTRAG_RELEASE: ${FASTRAG_RELEASE:-dev}
  FASTRAG_QUERY_API_KEY: ${FASTRAG_QUERY_API_KEY:?set FASTRAG_QUERY_API_KEY}
  FASTRAG_ADMIN_API_KEY: ${FASTRAG_ADMIN_API_KEY:?set FASTRAG_ADMIN_API_KEY}
  FASTRAG_LLM_BASE_URL: ${FASTRAG_LLM_BASE_URL:?set FASTRAG_LLM_BASE_URL}
  FASTRAG_LLM_API_KEY: ${FASTRAG_LLM_API_KEY:?set FASTRAG_LLM_API_KEY}
  FASTRAG_LLM_MODEL: ${FASTRAG_LLM_MODEL:?set FASTRAG_LLM_MODEL}
  FASTRAG_DENSE_MODEL_REVISION: ${FASTRAG_DENSE_MODEL_REVISION:?pin embedding revision}
  FASTRAG_DENSE_MODEL_SHA256: ${FASTRAG_DENSE_MODEL_SHA256:?pin embedding artifact}
  FASTRAG_DENSE_MODEL_PATH: /models/dense
  FASTRAG_RERANKER_REVISION: ${FASTRAG_RERANKER_REVISION:?pin reranker revision}
  FASTRAG_RERANKER_SHA256: ${FASTRAG_RERANKER_SHA256:?pin reranker artifact}
  FASTRAG_RERANKER_MODEL_PATH: /models/reranker
  FASTRAG_QDRANT_URL: http://qdrant:6333
  FASTRAG_REDIS_URL: redis://:${APP_REDIS_PASSWORD}@app-redis:6379/0
  FASTRAG_DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/fastrag
  FASTRAG_LANGFUSE_PUBLIC_KEY: ${LANGFUSE_PUBLIC_KEY}
  FASTRAG_LANGFUSE_SECRET_KEY: ${LANGFUSE_SECRET_KEY}
  FASTRAG_LANGFUSE_BASE_URL: ${LANGFUSE_BASE_URL:-https://cloud.langfuse.com}
  FASTRAG_DATA_DIR: /data

# Only consumed by the optional `langfuse` profile. Langfuse Cloud's free tier
# covers the same need without ClickHouse, MinIO, and a second Redis, so the
# default stack points FASTRAG_LANGFUSE_BASE_URL there instead.
x-langfuse-environment: &langfuse-environment
  NEXTAUTH_URL: https://${LANGFUSE_DOMAIN:-langfuse.localhost}
  DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/langfuse
  SALT: ${LANGFUSE_SALT:-}
  ENCRYPTION_KEY: ${LANGFUSE_ENCRYPTION_KEY:-}
  CLICKHOUSE_MIGRATION_URL: clickhouse://clickhouse:9000
  CLICKHOUSE_URL: http://clickhouse:8123
  CLICKHOUSE_USER: clickhouse
  CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-replace-me}
  CLICKHOUSE_CLUSTER_ENABLED: "false"
  REDIS_HOST: langfuse-redis
  REDIS_PORT: "6379"
  REDIS_AUTH: ${LANGFUSE_REDIS_PASSWORD:-}
  LANGFUSE_S3_EVENT_UPLOAD_BUCKET: langfuse
  LANGFUSE_S3_EVENT_UPLOAD_REGION: auto
  LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID: minio
  LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
  LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT: http://minio:9000
  LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE: "true"
  LANGFUSE_S3_MEDIA_UPLOAD_BUCKET: langfuse
  LANGFUSE_S3_MEDIA_UPLOAD_REGION: auto
  LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID: minio
  LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
  LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT: http://minio:9000
  LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE: "true"
  TELEMETRY_ENABLED: "false"

services:
  proxy:
    image: caddy:2.10.0-alpine
    restart: unless-stopped
    environment:
      FASTRAG_DOMAIN: ${FASTRAG_DOMAIN:-localhost}
      LANGFUSE_DOMAIN: ${LANGFUSE_DOMAIN:-langfuse.localhost}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./deploy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
    depends_on:
      api:
        condition: service_healthy

  api:
    build: .
    image: fastrag:${FASTRAG_RELEASE:-dev}
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment: *app-environment
    volumes:
      - rag_data:/data
      - model_data:/models:ro
      - ./config/calibration.json:/app/config/calibration.json:ro
    depends_on:
      app-redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
      qdrant:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health/live')"]
      interval: 10s
      timeout: 3s
      retries: 10
    read_only: true
    tmpfs: [/tmp]
    security_opt: [no-new-privileges:true]

  worker:
    image: fastrag:${FASTRAG_RELEASE:-dev}
    restart: unless-stopped
    command: ["rq", "worker", "--url", "redis://:${APP_REDIS_PASSWORD}@app-redis:6379/0", "ingestion"]
    environment: *app-environment
    volumes:
      - rag_data:/data
      - model_data:/models:ro
    depends_on:
      app-redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
      qdrant:
        condition: service_healthy
    security_opt: [no-new-privileges:true]

  model-init:
    profiles: [tools]
    image: fastrag:${FASTRAG_RELEASE:-dev}
    command: ["python", "-m", "fastrag.download_models"]
    environment: *app-environment
    user: "0:0"
    volumes:
      - model_data:/models

  qdrant:
    image: qdrant/qdrant:v1.15.4
    restart: unless-stopped
    volumes:
      - qdrant_data:/qdrant/storage
    healthcheck:
      test: ["CMD-SHELL", "bash -c ':> /dev/tcp/127.0.0.1/6333'"]
      interval: 10s
      timeout: 3s
      retries: 10

  app-redis:
    image: redis:8.2.1-alpine
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${APP_REDIS_PASSWORD}", "--maxmemory-policy", "volatile-lfu"]
    volumes:
      - app_redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${APP_REDIS_PASSWORD}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

  postgres:
    image: postgres:17.6-alpine
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
      TZ: UTC
      PGTZ: UTC
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./deploy/postgres-init.sql:/docker-entrypoint-initdb.d/00-init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 3s
      retries: 20

  langfuse-web:
    profiles: [langfuse]
    image: langfuse/langfuse:3.185.0
    restart: unless-stopped
    environment:
      <<: *langfuse-environment
      NEXTAUTH_SECRET: ${LANGFUSE_NEXTAUTH_SECRET:-}
      LANGFUSE_INIT_ORG_ID: fastrag
      LANGFUSE_INIT_ORG_NAME: FastRAG
      LANGFUSE_INIT_PROJECT_ID: fastrag-production
      LANGFUSE_INIT_PROJECT_NAME: FastRAG Production
      LANGFUSE_INIT_PROJECT_PUBLIC_KEY: ${LANGFUSE_PUBLIC_KEY}
      LANGFUSE_INIT_PROJECT_SECRET_KEY: ${LANGFUSE_SECRET_KEY}
      LANGFUSE_INIT_USER_EMAIL: ${LANGFUSE_INIT_USER_EMAIL}
      LANGFUSE_INIT_USER_PASSWORD: ${LANGFUSE_INIT_USER_PASSWORD}
      LANGFUSE_INIT_USER_NAME: FastRAG Admin
    depends_on: &langfuse-dependencies
      postgres: {condition: service_healthy}
      clickhouse: {condition: service_healthy}
      langfuse-redis: {condition: service_healthy}
      minio: {condition: service_healthy}
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:3000/api/public/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 20

  langfuse-worker:
    profiles: [langfuse]
    image: langfuse/langfuse-worker:3.185.0
    restart: unless-stopped
    environment: *langfuse-environment
    depends_on: *langfuse-dependencies

  clickhouse:
    profiles: [langfuse]
    image: clickhouse/clickhouse-server:25.12
    restart: unless-stopped
    user: "101:101"
    environment:
      CLICKHOUSE_USER: clickhouse
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-replace-me}
    volumes:
      - clickhouse_data:/var/lib/clickhouse
      - clickhouse_logs:/var/log/clickhouse-server
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:8123/ping || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 20

  langfuse-redis:
    profiles: [langfuse]
    image: redis:7.4.5-alpine
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${LANGFUSE_REDIS_PASSWORD}", "--maxmemory-policy", "noeviction"]
    volumes:
      - langfuse_redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${LANGFUSE_REDIS_PASSWORD}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

  minio:
    profiles: [langfuse]
    image: quay.io/minio/minio:RELEASE.2025-04-22T22-12-26Z
    restart: unless-stopped
    command: server --address :9000 --console-address :9001 /data
    environment:
      MINIO_ROOT_USER: minio
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-}
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 5s
      timeout: 5s
      retries: 10

  prometheus:
    image: prom/prometheus:v3.5.0
    restart: unless-stopped
    command: ["--config.file=/etc/prometheus/prometheus.yml", "--storage.tsdb.retention.time=30d"]
    volumes:
      - ./deploy/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./deploy/alerts.yml:/etc/prometheus/alerts.yml:ro
      - prometheus_data:/prometheus
    depends_on:
      api: {condition: service_healthy}

  grafana:
    image: grafana/grafana:12.1.0
    restart: unless-stopped
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?set GRAFANA_ADMIN_PASSWORD}
      GF_USERS_ALLOW_SIGN_UP: "false"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./deploy/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./deploy/grafana/dashboards:/var/lib/grafana/dashboards:ro
    depends_on:
      prometheus: {condition: service_started}

volumes:
  rag_data:
  qdrant_data:
  app_redis_data:
  postgres_data:
  clickhouse_data:
  clickhouse_logs:
  langfuse_redis_data:
  minio_data:
  prometheus_data:
  grafana_data:
  caddy_data:
  model_data: