engraphis/docker-compose.yml at main · Coding-Dev-Tools/engraphis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# Default `docker compose up` runs the local customer dashboard and its hosted-service clients.
# Team identity, roles, seats, and organization management remain in the private account portal.
# The raw single-user v1 API server is available under the "api" profile after setting a strong
# ENGRAPHIS_API_TOKEN in .env or the shell:
#     docker compose --profile api up engraphis-api
#
# NOTE: the `env_file:` object form below (`- path: .env` + `required: false`, which makes
# .env OPTIONAL so a fresh clone with no .env still boots) needs Docker Compose v2.24+
# (Jan 2024). On older Compose, either upgrade, or replace each `env_file:` block with the
# plain list form `env_file: [.env]` and run `touch .env` first — the `environment:` blocks
# already supply every default, so .env is only ever for optional overrides.
services:
  engraphis:
    build: .
    image: engraphis:latest
    # Local customer dashboard on the v2 engine. --no-open: never try to launch a browser in a
    # container. Binds 0.0.0.0 via the ENGRAPHIS_HOST below (explicit here; the image
    # itself no longer bakes a host — its entrypoint defaults to `::` dual-stack).
    command: ["engraphis-dashboard", "--no-open"]
    ports:
      # Keep the zero-token quickstart reachable only from this machine. Do not widen
      # this bind without first setting ENGRAPHIS_API_TOKEN in .env.
      - "127.0.0.1:8700:8700"
    env_file:
      # Optional: a fresh clone has no .env (it's gitignored), and `docker compose up`
      # must still work using the `environment:` block below plus the shell env.
      - path: .env
        required: false
    environment:
      ENGRAPHIS_HOST: 0.0.0.0
      # Docker NAT presents the host browser as a private bridge peer. This exception is
      # safe only because the published host port above is loopback-only.
      ENGRAPHIS_LOCAL_TRUSTED_PEERS: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
      ENGRAPHIS_DB_PATH: /data/engraphis.db
      # Persist the customer-side cloud session and non-authoritative entitlement display
      # cache on the volume. Issuance, trial state, leases, and revocations stay private.
      ENGRAPHIS_STATE_DIR: /data/.engraphis
    volumes:
      - engraphis-data:/data
    restart: unless-stopped

  # Raw v1 API server (single-user). Opt in with:  docker compose --profile api up
  engraphis-api:
    build: .
    image: engraphis:latest
    command: ["engraphis-server"]
    profiles: ["api"]
    ports:
      - "127.0.0.1:8701:8700"
    env_file:
      - path: .env
        required: false
    environment:
      ENGRAPHIS_HOST: 0.0.0.0
      # This process binds all container interfaces. Even though the published host port is
      # loopback-only, require an explicit bearer so a changed port mapping cannot silently
      # expose the legacy v1 API. Keep interpolation optional so the inactive profile does
      # not break a fresh ``docker compose up``; engraphis-server fails closed at startup
      # when this profile is actually launched without a token.
      ENGRAPHIS_API_TOKEN: ${ENGRAPHIS_API_TOKEN:-}
      # The v1 server uses a DIFFERENT, incompatible memory schema from the v2 dashboard,
      # so it MUST NOT share the dashboard's engraphis.db (doing so corrupts both). Give it
      # its own file on the shared volume.
      ENGRAPHIS_DB_PATH: /data/engraphis_v1.db
      ENGRAPHIS_STATE_DIR: /data/.engraphis
    volumes:
      - engraphis-data:/data
    restart: unless-stopped

volumes:
  engraphis-data: