limit Mem0 env file to runtime secrets

docker-compose.yaml

@@ -162,6 +162,21 @@ services:
     stop_grace_period: 30s
     env_file:
       - ./mem0/.env
+    environment:
+      POSTGRES_HOST: postgres
+      POSTGRES_PORT: "5432"
+      POSTGRES_DB: mem0
+      POSTGRES_USER: mem0
+      POSTGRES_COLLECTION_NAME: mem0_bootstrap_unused
+      APP_DB_NAME: mem0_app
+      OPENAI_API_KEY: internal-litellm
+      OPENAI_BASE_URL: http://host.docker.internal:4000/v1
+      MEM0_DEFAULT_LLM_MODEL: grok-fast
+      MEM0_DEFAULT_EMBEDDER_MODEL: voyage-4
+      AUTH_DISABLED: "false"
+      MEM0_TELEMETRY: "false"
+      DASHBOARD_URL: http://127.0.0.1:8888
+      HISTORY_DB_PATH: /app/history/history.db
     depends_on:
       postgres:
         condition: service_healthy

mem0/README.md

@@ -8,6 +8,7 @@ Neo4j, or Qdrant. PostgreSQL/pgvector stores data in isolated `mem0` and
 - embeddings: `voyage-4`, 1024 dimensions
 
 The service is bound to `127.0.0.1:8888`. The OSS API paths do not use `/v1`.
-Runtime secrets live in ignored `mem0/.env` with mode `0600`; no model-provider
-credential is copied into Mem0. The image source is pinned to the upstream Mem0
-`v2.0.12` release commit.
+Only `POSTGRES_PASSWORD`, `JWT_SECRET`, and `ADMIN_API_KEY` live in the ignored
+`mem0/.env` with mode `0600`. Non-secret runtime settings stay in Compose, and no
+model-provider credential is copied into Mem0. The image source is pinned to the
+upstream Mem0 `v2.0.12` release commit.