From 7fe78a06e956eaf0670bb12bd18deb1b73da22df Mon Sep 17 00:00:00 2001
From: git-bridge <git-bridge@local.invalid>
Date: Fri, 17 Jul 2026 05:49:19 +0000
Subject: [PATCH] limit Mem0 env file to runtime secrets

---
 docker-compose.yaml | 15 +++++++++++++++
 mem0/README.md      |  7 ++++---
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index 0e8de00..d4275b2 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -162,6 +162,21 @@ services:
     stop_grace_period: 30s
     env_file:
       - ./mem0/.env
+    environment:
+      POSTGRES_HOST: postgres
+      POSTGRES_PORT: "5432"
+      POSTGRES_DB: mem0
+      POSTGRES_USER: mem0
+      POSTGRES_COLLECTION_NAME: mem0_bootstrap_unused
+      APP_DB_NAME: mem0_app
+      OPENAI_API_KEY: internal-litellm
+      OPENAI_BASE_URL: http://host.docker.internal:4000/v1
+      MEM0_DEFAULT_LLM_MODEL: grok-fast
+      MEM0_DEFAULT_EMBEDDER_MODEL: voyage-4
+      AUTH_DISABLED: "false"
+      MEM0_TELEMETRY: "false"
+      DASHBOARD_URL: http://127.0.0.1:8888
+      HISTORY_DB_PATH: /app/history/history.db
     depends_on:
       postgres:
         condition: service_healthy
diff --git a/mem0/README.md b/mem0/README.md
index 8239bd1..2dfc0a0 100644
--- a/mem0/README.md
+++ b/mem0/README.md
@@ -8,6 +8,7 @@ Neo4j, or Qdrant. PostgreSQL/pgvector stores data in isolated `mem0` and
 - embeddings: `voyage-4`, 1024 dimensions
 
 The service is bound to `127.0.0.1:8888`. The OSS API paths do not use `/v1`.
-Runtime secrets live in ignored `mem0/.env` with mode `0600`; no model-provider
-credential is copied into Mem0. The image source is pinned to the upstream Mem0
-`v2.0.12` release commit.
+Only `POSTGRES_PASSWORD`, `JWT_SECRET`, and `ADMIN_API_KEY` live in the ignored
+`mem0/.env` with mode `0600`. Non-secret runtime settings stay in Compose, and no
+model-provider credential is copied into Mem0. The image source is pinned to the
+upstream Mem0 `v2.0.12` release commit.