infra/docker-compose.yaml

name: infra

services:
  postgres:
    container_name: postgres
    group_add: ["65534"]
    image: pgvector/pgvector:0.8.2-pg18
    restart: unless-stopped
    stop_grace_period: 60s
    shm_size: 256mb
    environment:
      TZ: Asia/Shanghai
      POSTGRES_USER: postgres
      POSTGRES_DB: postgres
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_superuser_password
      POSTGRES_INITDB_ARGS: --auth-host=scram-sha-256
      PGDATA: /var/lib/postgresql/18/docker
    secrets:
      - postgres_superuser_password
      - gitea_db_password
    volumes:
      - ./postgres/data:/var/lib/postgresql
      - ./postgres/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 20s
    networks:
      - git_forge

  gitea:
    container_name: gitea
    group_add: ["65534"]
    image: ${GITEA_IMAGE:-gitea/gitea:1.23}
    restart: unless-stopped
    stop_grace_period: 30s
    environment:
      TZ: Asia/Shanghai
      USER_UID: 1000
      USER_GID: 1000
      GITEA__database__DB_TYPE: postgres
      GITEA__database__HOST: postgres:5432
      GITEA__database__NAME: gitea
      GITEA__database__USER: gitea
      GITEA__database__PASSWD__FILE: /run/secrets/gitea_db_password
      GITEA__database__SSL_MODE: disable
      GITEA__server__DOMAIN: gitea.xyslh.xyz
      GITEA__server__ROOT_URL: https://gitea.xyslh.xyz/
      GITEA__server__SSH_DOMAIN: gitea.xyslh.xyz
      GITEA__server__SSH_PORT: 2222
      GITEA__server__PROTOCOL: http
      GITEA__service__REQUIRE_SIGNIN_VIEW: "false"
      GITEA__service__DISABLE_REGISTRATION: "true"
      GITEA__security__INSTALL_LOCK: "true"
    depends_on:
      postgres:
        condition: service_healthy
    secrets:
      - gitea_db_password
    volumes:
      - ./gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "13000:3000"
      - "2223:22"
    healthcheck:
      test: ["CMD-SHELL", "grep -Eq '^INSTALL_LOCK[[:space:]]*=[[:space:]]*true' /data/gitea/conf/app.ini && grep -Eq '^DB_TYPE[[:space:]]*=[[:space:]]*postgres' /data/gitea/conf/app.ini && wget -q --spider http://127.0.0.1:3000/api/healthz"]
      interval: 5s
      timeout: 3s
      retries: 24
      start_period: 20s
    networks:
      - git_forge

  litellm:
    env_file:
      - ./litellm/.env
    container_name: litellm
    image: ghcr.io/berriai/litellm:main-latest
    restart: unless-stopped
    user: root
    environment:
      TZ: Asia/Shanghai
      XAI_OAUTH_TOKEN_DIR: /app/config/xai_oauth
      CHATGPT_TOKEN_DIR: /app/config/chatgpt
      HTTP_PROXY: http://192.168.0.4:7890
      HTTPS_PROXY: http://192.168.0.4:7890
      ALL_PROXY: http://192.168.0.4:7890
      http_proxy: http://192.168.0.4:7890
      https_proxy: http://192.168.0.4:7890
      all_proxy: http://192.168.0.4:7890
      NO_PROXY: localhost,127.0.0.1,::1,host.docker.internal,n8n,postgres,qdrant,litellm,10.,172.16.,172.17.,172.18.,172.19.,172.20.,172.21.,172.22.,172.23.,172.24.,172.25.,172.26.,172.27.,172.28.,172.29.,172.30.,172.31.,192.168.
      no_proxy: localhost,127.0.0.1,::1,host.docker.internal,n8n,postgres,qdrant,litellm,10.,172.16.,172.17.,172.18.,172.19.,172.20.,172.21.,172.22.,172.23.,172.24.,172.25.,172.26.,172.27.,172.28.,172.29.,172.30.,172.31.,192.168.
    ports:
      - "4000:4000"
    volumes:
      - ./litellm/config.yaml:/app/config/config.yaml:ro
      - ./litellm/xai_oauth:/app/config/xai_oauth
      - ./litellm/chatgpt:/app/config/chatgpt
    command:
      - --config
      - /app/config/config.yaml
      - --host
      - 0.0.0.0
      - --port
      - "4000"
    healthcheck:
      test:
        - CMD
        - /app/.venv/bin/python
        - -c
        - import urllib.request; urllib.request.urlopen("http://127.0.0.1:4000/health/liveliness", timeout=3).read()
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - n8n_default

  git-bridge:
    container_name: git-bridge
    profiles: ["git-bridge"]
    image: ${GITEA_IMAGE:-gitea/gitea:1.23}
    restart: "no"
    user: "0:0"
    environment:
      HOME: /state/home
      HTTP_PROXY: http://192.168.0.4:7890
      HTTPS_PROXY: http://192.168.0.4:7890
      ALL_PROXY: http://192.168.0.4:7890
      NO_PROXY: localhost,127.0.0.1,::1,gitea,postgres,litellm
    entrypoint: ["/bin/sh", "/app/bin/sync-main-forward.sh"]
    volumes:
      - ./git-bridge/bin:/app/bin:ro
      - ./git-bridge/config:/app/config:ro
      - ./git-bridge/state:/state
      - ./git-bridge/secrets/gitea_token:/run/secrets/gitea_token:ro
      - ./git-bridge/secrets/github_token:/run/secrets/github_token:ro
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: ["ALL"]
    security_opt:
      - no-new-privileges:true
    networks:
      - git_forge

  mem0:
    container_name: mem0
    build:
      context: ./mem0
      dockerfile: Dockerfile
      args:
        MEM0_SOURCE_REF: 42cf18c4e6adb448e981aa1c7b55c1602b0cb670
        MEM0AI_VERSION: 2.0.12
        HTTP_PROXY: ${MEM0_BUILD_PROXY:-http://192.168.0.4:7890}
        HTTPS_PROXY: ${MEM0_BUILD_PROXY:-http://192.168.0.4:7890}
        NO_PROXY: localhost,127.0.0.1,postgres,litellm
    restart: unless-stopped
    stop_grace_period: 30s
    env_file:
      - ./mem0/.env
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DB: mem0
      POSTGRES_USER: mem0
      POSTGRES_COLLECTION_NAME: mem0_bootstrap_unused
      APP_DB_NAME: mem0_app
      OPENAI_API_KEY: internal-litellm
      OPENAI_BASE_URL: http://host.docker.internal:4000/v1
      MEM0_DEFAULT_LLM_MODEL: grok-fast
      MEM0_DEFAULT_EMBEDDER_MODEL: voyage-4
      AUTH_DISABLED: "false"
      MEM0_TELEMETRY: "false"
      DASHBOARD_URL: http://127.0.0.1:8888
      HISTORY_DB_PATH: /app/history/history.db
    depends_on:
      postgres:
        condition: service_healthy
    extra_hosts:
      - host.docker.internal:host-gateway
    volumes:
      - ./mem0/history:/app/history
    ports:
      - "127.0.0.1:8888:8000"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/openapi.json', timeout=3).read()"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 30s
    networks:
      - git_forge

  python_worker:
    container_name: python_worker
    image: n8n-python_worker
    pull_policy: never
    restart: unless-stopped
    stop_grace_period: 60s
    working_dir: /app
    env_file:
      - ./python_worker/runtime.env
    volumes:
      - ./python_worker/app:/app
      - /volume2/docker/n8n/files:/files
    ports:
      - "8000:8000"
    command:
      - /bin/sh
      - -lc
      - . /app/.venv/bin/activate && exec python -m uvicorn fastapi_app:app --host 0.0.0.0 --port 8000 --log-level debug
    dns:
      - 223.5.5.5
      - 114.114.114.114
    healthcheck:
      test: ["CMD", "/app/.venv/bin/python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=3).read()"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 30s
    networks:
      n8n_backbone:
        aliases:
          - python_worker

networks:
  git_forge:
    name: git_forge
  n8n_default:
    external: true
    name: n8n_default

  n8n_backbone:
    external: true
    name: n8n_default

secrets:
  postgres_superuser_password:
    file: ./postgres/secrets/postgres_superuser_password
  gitea_db_password:
    file: ./postgres/secrets/gitea_db_password