From 33e74403424ee666776dc02bb072a11a4a64a560 Mon Sep 17 00:00:00 2001 From: git-bridge Date: Fri, 17 Jul 2026 05:35:13 +0000 Subject: [PATCH 1/2] add authenticated Mem0 memory service --- .gitignore | 2 ++ docker-compose.yaml | 33 +++++++++++++++++++++++++++++++++ mem0/Dockerfile | 27 +++++++++++++++++++++++++++ mem0/README.md | 13 +++++++++++++ 4 files changed, 75 insertions(+) create mode 100644 mem0/Dockerfile create mode 100644 mem0/README.md diff --git a/.gitignore b/.gitignore index 0fe560c..fc08492 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,5 @@ litellm/.infra-litellm-state git-bridge/state/ litellm/.env +mem0/.env +mem0/history/ diff --git a/docker-compose.yaml b/docker-compose.yaml index 3c7c285..0e8de00 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -147,6 +147,39 @@ services: networks: - git_forge + mem0: + container_name: mem0 + build: + context: ./mem0 + dockerfile: Dockerfile + args: + MEM0_SOURCE_REF: 42cf18c4e6adb448e981aa1c7b55c1602b0cb670 + MEM0AI_VERSION: 2.0.12 + HTTP_PROXY: ${MEM0_BUILD_PROXY:-http://192.168.0.4:7890} + HTTPS_PROXY: ${MEM0_BUILD_PROXY:-http://192.168.0.4:7890} + NO_PROXY: localhost,127.0.0.1,postgres,litellm + restart: unless-stopped + stop_grace_period: 30s + env_file: + - ./mem0/.env + depends_on: + postgres: + condition: service_healthy + extra_hosts: + - host.docker.internal:host-gateway + volumes: + - ./mem0/history:/app/history + ports: + - "127.0.0.1:8888:8000" + healthcheck: + test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/openapi.json', timeout=3).read()"] + interval: 10s + timeout: 5s + retries: 18 + start_period: 30s + networks: + - git_forge + networks: git_forge: name: git_forge diff --git a/mem0/Dockerfile b/mem0/Dockerfile new file mode 100644 index 0000000..17dd21a --- /dev/null +++ b/mem0/Dockerfile @@ -0,0 +1,27 @@ +FROM python:3.12-slim-bookworm AS source + +ARG MEM0_SOURCE_REF=42cf18c4e6adb448e981aa1c7b55c1602b0cb670 +RUN apt-get update \ + && apt-get install -y --no-install-recommends ca-certificates git \ + && rm -rf /var/lib/apt/lists/* +WORKDIR /src +RUN git init \ + && git remote add origin https://github.com/mem0ai/mem0.git \ + && git fetch --depth 1 origin "${MEM0_SOURCE_REF}" \ + && test "$(git rev-parse FETCH_HEAD)" = "${MEM0_SOURCE_REF}" \ + && git checkout --detach FETCH_HEAD + +FROM python:3.12-slim-bookworm + +ARG MEM0AI_VERSION=2.0.12 +ENV PYTHONDONTWRITEBYTECODE=1 \ + PYTHONUNBUFFERED=1 +WORKDIR /app +COPY --from=source /src/server/requirements.txt /tmp/requirements.txt +RUN sed -i -E "s/^mem0ai.*/mem0ai==${MEM0AI_VERSION}/" /tmp/requirements.txt \ + && pip install --no-cache-dir -r /tmp/requirements.txt \ + && rm -f /tmp/requirements.txt +COPY --from=source /src/server/ /app/ +RUN mkdir -p /app/history +EXPOSE 8000 +CMD ["sh", "-c", "alembic upgrade head && exec uvicorn main:app --host 0.0.0.0 --port 8000"] diff --git a/mem0/README.md b/mem0/README.md new file mode 100644 index 0000000..8239bd1 --- /dev/null +++ b/mem0/README.md @@ -0,0 +1,13 @@ +# Mem0 + +Infra runs the authenticated Mem0 OSS REST API without the optional dashboard, +Neo4j, or Qdrant. PostgreSQL/pgvector stores data in isolated `mem0` and +`mem0_app` databases. Model traffic goes through the existing LiteLLM gateway: + +- memory extraction: `grok-fast` +- embeddings: `voyage-4`, 1024 dimensions + +The service is bound to `127.0.0.1:8888`. The OSS API paths do not use `/v1`. +Runtime secrets live in ignored `mem0/.env` with mode `0600`; no model-provider +credential is copied into Mem0. The image source is pinned to the upstream Mem0 +`v2.0.12` release commit. From 7fe78a06e956eaf0670bb12bd18deb1b73da22df Mon Sep 17 00:00:00 2001 From: git-bridge Date: Fri, 17 Jul 2026 05:49:19 +0000 Subject: [PATCH 2/2] limit Mem0 env file to runtime secrets --- docker-compose.yaml | 15 +++++++++++++++ mem0/README.md | 7 ++++--- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/docker-compose.yaml b/docker-compose.yaml index 0e8de00..d4275b2 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -162,6 +162,21 @@ services: stop_grace_period: 30s env_file: - ./mem0/.env + environment: + POSTGRES_HOST: postgres + POSTGRES_PORT: "5432" + POSTGRES_DB: mem0 + POSTGRES_USER: mem0 + POSTGRES_COLLECTION_NAME: mem0_bootstrap_unused + APP_DB_NAME: mem0_app + OPENAI_API_KEY: internal-litellm + OPENAI_BASE_URL: http://host.docker.internal:4000/v1 + MEM0_DEFAULT_LLM_MODEL: grok-fast + MEM0_DEFAULT_EMBEDDER_MODEL: voyage-4 + AUTH_DISABLED: "false" + MEM0_TELEMETRY: "false" + DASHBOARD_URL: http://127.0.0.1:8888 + HISTORY_DB_PATH: /app/history/history.db depends_on: postgres: condition: service_healthy diff --git a/mem0/README.md b/mem0/README.md index 8239bd1..2dfc0a0 100644 --- a/mem0/README.md +++ b/mem0/README.md @@ -8,6 +8,7 @@ Neo4j, or Qdrant. PostgreSQL/pgvector stores data in isolated `mem0` and - embeddings: `voyage-4`, 1024 dimensions The service is bound to `127.0.0.1:8888`. The OSS API paths do not use `/v1`. -Runtime secrets live in ignored `mem0/.env` with mode `0600`; no model-provider -credential is copied into Mem0. The image source is pinned to the upstream Mem0 -`v2.0.12` release commit. +Only `POSTGRES_PASSWORD`, `JWT_SECRET`, and `ADMIN_API_KEY` live in the ignored +`mem0/.env` with mode `0600`. Non-secret runtime settings stay in Compose, and no +model-provider credential is copied into Mem0. The image source is pinned to the +upstream Mem0 `v2.0.12` release commit.