docker-compose.yml

# ─────────────────────────────────────────────────────────────
# StackForge — Self-hosted AI Brain for Hermes Agent
# One stack. One IP.  →  `docker compose up -d`
# ─────────────────────────────────────────────────────────────
# Requirements: git, docker, docker compose, tailscale (recommended)
# See .env.example for all configurable variables.
# ─────────────────────────────────────────────────────────────

x-logging: &default-log
  driver: journald
  options:
    tag: "{{.Name}}"

networks:
  tailnet:
    name: stackdeploy-tailnet
    driver: bridge
    attachable: true
  backend:
    name: stackdeploy-backend
    internal: true
    driver: bridge

volumes:
  qdrant-data:
  honcho-pgdata:
  honcho-redis-data:
  couchdb-data:
  ollama-data:

services:

  # ═══════════════════════════════════════════════════════
  # SEARCH ENGINE
  # ═══════════════════════════════════════════════════════
  searxng:
    image: searxng/searxng:latest
    container_name: stackdeploy-searxng
    restart: unless-stopped
    networks: [tailnet]
    ports:
      - "${SVC_SEARXNG_PORT:-8080}:8080"
    volumes:
      - ./searxng:/etc/searxng:ro
    environment:
      - SEARXNG_BASE_URL=http://${SERVER_IP:-localhost}:${SVC_SEARXNG_PORT:-8080}/
      - SEARXNG_SECRET_KEY=${SEARXNG_SECRET_KEY:-}
    cap_drop: [ALL]
    cap_add: [CHOWN, SETGID, SETUID]
    logging: *default-log
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://localhost:8080/ || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # ═══════════════════════════════════════════════════════
  # VECTOR DATABASE
  # ═══════════════════════════════════════════════════════
  qdrant:
    image: qdrant/qdrant:latest
    container_name: stackdeploy-qdrant
    restart: unless-stopped
    networks: [tailnet]
    ports:
      - "${SVC_QDRANT_PORT:-6333}:6333"
    volumes:
      - qdrant-data:/qdrant/storage
    logging: *default-log
    healthcheck:
      test: ["CMD-SHELL", "timeout 3 bash -c 'cat < /dev/null > /dev/tcp/localhost/6333'"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  # ═══════════════════════════════════════════════════════
  # MEMORY LAYER  —  Honcho (LLM memory) + Postgres + Redis
  # ═══════════════════════════════════════════════════════

  honcho-db:
    image: pgvector/pgvector:pg15
    container_name: stackdeploy-honcho-db
    restart: unless-stopped
    networks: [backend]
    ports:
      - "127.0.0.1:5432:5432"    # host loopback only — admin tools
    environment:
      - POSTGRES_DB=honcho
      - POSTGRES_USER=honcho
      - POSTGRES_PASSWORD=${HONCHO_DB_PASSWORD:-changeme}
      - PGDATA=/var/lib/postgresql/data/pgdata
    volumes:
      - honcho-pgdata:/var/lib/postgresql/data
    logging: *default-log
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U honcho -d honcho"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 15s

  honcho-redis:
    image: redis:8.2
    container_name: stackdeploy-honcho-redis
    restart: unless-stopped
    networks: [backend]
    ports:
      - "127.0.0.1:6379:6379"    # host loopback only
    volumes:
      - honcho-redis-data:/data
    logging: *default-log
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 5s

  honcho-api:
    image: ghcr.io/plastic-labs/honcho:latest
    container_name: stackdeploy-honcho-api
    restart: unless-stopped
    depends_on:
      honcho-db:  { condition: service_healthy }
      honcho-redis: { condition: service_healthy }
    networks:
      - backend
      - tailnet
    ports:
      - "${SVC_HONCHO_PORT:-8000}:8000"
    environment:
      - DB_CONNECTION_URI=postgresql+psycopg://honcho:${HONCHO_DB_PASSWORD:-changeme}@honcho-db:5432/honcho
      - CACHE_ENABLED=true
      - CACHE_URL=redis://honcho-redis:6379/0
      - METRICS_ENABLED=false
      # ── Embeddings: local Ollama (nomic-embed-text, 768-dim, OpenAI-compatible /v1) ──
      - EMBEDDING_MODEL_CONFIG__TRANSPORT=openai
      - EMBEDDING_MODEL_CONFIG__MODEL=nomic-embed-text
      - EMBEDDING_MODEL_CONFIG__OVERRIDES__BASE_URL=${OLLAMA_HOST:-http://localhost:11434}/v1
      - EMBEDDING_MODEL_CONFIG__OVERRIDES__API_KEY=ollama
      - EMBEDDING_VECTOR_DIMENSIONS=768
      # ── LLM: local Ollama via the openai transport (no external keys).
      #    For OpenRouter instead: set LLM_OPENAI_BASE_URL=https://openrouter.ai/api/v1
      #    + LLM_OPENAI_API_KEY=<key> and change the *_MODEL_CONFIG__MODEL values below. ──
      - LLM_OPENAI_BASE_URL=${OLLAMA_HOST:-http://localhost:11434}/v1
      - LLM_OPENAI_API_KEY=ollama
      - OPENAI_API_KEY=ollama
      - LLM_VLLM_API_KEY=ollama
      - LLM_VLLM_BASE_URL=${OLLAMA_HOST:-http://localhost:11434}/v1
      - LLM_VLLM_MODEL=llama3.2:1b
      # Local model for every LLM role (deriver / dialectic / summary / dream)
      - DERIVER_MODEL_CONFIG__TRANSPORT=openai
      - DERIVER_MODEL_CONFIG__MODEL=llama3.2:1b
      - SUMMARY_MODEL_CONFIG__TRANSPORT=openai
      - SUMMARY_MODEL_CONFIG__MODEL=llama3.2:1b
      - DREAM_MODEL_CONFIG__TRANSPORT=openai
      - DREAM_MODEL_CONFIG__MODEL=llama3.2:1b
      - DIALECTIC_LEVELS__minimal__MODEL_CONFIG__TRANSPORT=openai
      - DIALECTIC_LEVELS__minimal__MODEL_CONFIG__MODEL=llama3.2:1b
      - DIALECTIC_LEVELS__low__MODEL_CONFIG__TRANSPORT=openai
      - DIALECTIC_LEVELS__low__MODEL_CONFIG__MODEL=llama3.2:1b
      - DIALECTIC_LEVELS__medium__MODEL_CONFIG__TRANSPORT=openai
      - DIALECTIC_LEVELS__medium__MODEL_CONFIG__MODEL=llama3.2:1b
      - DIALECTIC_LEVELS__high__MODEL_CONFIG__TRANSPORT=openai
      - DIALECTIC_LEVELS__high__MODEL_CONFIG__MODEL=llama3.2:1b
      - DIALECTIC_LEVELS__max__MODEL_CONFIG__TRANSPORT=openai
      - DIALECTIC_LEVELS__max__MODEL_CONFIG__MODEL=llama3.2:1b
    volumes:
      - ./honcho/config.toml:/app/config.toml:ro
    logging: *default-log
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)\""]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # ═══════════════════════════════════════════════════════
  # OBSIDIAN LIVESYNC  —  CouchDB (Real-time sync backend)
  # ═══════════════════════════════════════════════════════

  livesync:
    image: couchdb:3.4
    container_name: stackdeploy-livesync
    restart: unless-stopped
    networks: [tailnet]
    ports:
      - "${SVC_COUCHDB_PORT:-5984}:5984"
    volumes:
      - couchdb-data:/opt/couchdb/data
    # Admin user created by CouchDB on first boot via env vars
    environment:
      - COUCHDB_USER=${COUCHDB_ADMIN_USER:-admin}
      - COUCHDB_PASSWORD=${COUCHDB_ADMIN_PASSWORD:-changeme}
    logging: *default-log
    healthcheck:
      test: ["CMD-SHELL", "curl -s -o /dev/null http://127.0.0.1:5984/ || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

  livesync-init:
    image: curlimages/curl:latest
    container_name: stackdeploy-livesync-init
    restart: "no"
    init: true
    networks: [tailnet]
    depends_on:
      livesync: { condition: service_healthy }
    environment:
      - COUCHDB_ADMIN_USER=${COUCHDB_ADMIN_USER:-admin}
      - COUCHDB_ADMIN_PASSWORD=${COUCHDB_ADMIN_PASSWORD:-changeme}
      - COUCHDB_SYNC_USER=${COUCHDB_SYNC_USER:-obsync}
      - COUCHDB_SYNC_PASSWORD=${COUCHDB_SYNC_PASSWORD:-changeme}
    volumes:
      - ./obsidian/couchdb-init.sh:/init.sh:ro
    entrypoint: ["/bin/sh", "/init.sh"]

  # ═══════════════════════════════════════════════════════
  # OBSIDIAN VAULT WEB VIEWER  —  Caddy
  # ═══════════════════════════════════════════════════════
  obsidian:
    image: caddy:2-alpine
    container_name: stackdeploy-obsidian
    restart: unless-stopped
    networks: [tailnet]
    ports:
      - "${SVC_OBSIDIAN_PORT:-8083}:80"
    volumes:
      - ./obsidian/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./obsidian/vault:/var/lib/caddy/vault:ro
      - ./obsidian/index.html:/var/lib/caddy/index.html:ro
    logging: *default-log
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 5s

  # ═══════════════════════════════════════════════════════
  # P2P FILE SYNC  —  Syncthing (laptop ↔ server)
  # ═══════════════════════════════════════════════════════
  syncthing:
    image: syncthing/syncthing:latest
    container_name: stackdeploy-syncthing
    restart: unless-stopped
    networks: [tailnet]
    ports:
      - "${SVC_SYNCTHING_UI_PORT:-8384}:8384"    # web UI
      - "22000:22000/tcp"                         # sync transport
      - "22000:22000/udp"
      - "21027:21027/udp"                         # LAN discovery
    volumes:
      - ./syncthing/config:/var/syncthing/config
      - ./obsidian/vault:/var/syncthing/vault:rw
    environment:
      - STGUIADDRESS=0.0.0.0:${SVC_SYNCTHING_UI_PORT:-8384}
      - STNODEFAULTUSER=true
    logging: *default-log
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:${SVC_SYNCTHING_UI_PORT:-8384}/', timeout=5)\""]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # ═══════════════════════════════════════════════════════
  # WEB AUTOMATION  —  Selenium standalone Chrome
  # ═══════════════════════════════════════════════════════
  webautomation:
    image: selenium/standalone-chrome:latest
    container_name: stackdeploy-webautomation
    restart: unless-stopped
    networks: [tailnet]
    ports:
      - "${SVC_SELENIUM_PORT:-4444}:4444"
    shm_size: "${SELENIUM_SHM_SIZE:-2g}"
    environment:
      - SE_NO_SANDBOX=${SELENIUM_NO_SANDBOX:-1}
      - SE_VNC_PASSWORD=${SELENIUM_VNC_PASSWORD:-}
      - SE_OPTS=${SELENIUM_OPTS:-}
    logging: *default-log
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:4444/status"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

  # ═══════════════════════════════════════════════════════
  # LOCAL LLM  —  Ollama (optional, comment out to skip)
  # ═══════════════════════════════════════════════════════
  ollama:
    image: ollama/ollama:latest
    container_name: stackdeploy-ollama
    restart: unless-stopped
    networks: [tailnet]
    ports:
      - "11434:11434"
    volumes:
      - ollama-data:/root/.ollama
    environment:
      - OLLAMA_HOST=0.0.0.0
      - OLLAMA_KEEP_ALIVE=${OLLAMA_KEEP_ALIVE:-5m}
      - OLLAMA_NUM_PARALLEL=${OLLAMA_NUM_PARALLEL:-1}
      - OLLAMA_MAX_LOADED_MODELS=${OLLAMA_MAX_LOADED_MODELS:-1}
    # GPU acceleration — uncomment if NVIDIA GPU + nvidia-container-toolkit installed:
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: all
    #           capabilities: [gpu]
    logging: *default-log
    healthcheck:
      test: ["CMD-SHELL", "timeout 5 bash -c 'cat < /dev/null > /dev/tcp/localhost/11434'"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s