docker-compose.yml

version: '3.8'
services:
  postgres:
    image: pgvector/pgvector:pg16
    container_name: silhouette-postgres
    ports:
      - "5432:5432"
    env_file:
      - .env.local
    environment:
      POSTGRES_DB: silhouette
      POSTGRES_USER: silhouette
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-silhouette_secure_dev_2026}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: always
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U silhouette" ]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:alpine
    container_name: silhouette-llm-redis
    ports:
      - "6499:6379"
    volumes:
      - redis_data_llm:/data
    restart: always
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 10s
      timeout: 5s
      retries: 5

  qdrant:
    image: qdrant/qdrant:latest
    container_name: silhouette-llm-qdrant
    ports:
      - "6433:6333" # REST
      - "6434:6334" # gRPC
    volumes:
      - qdrant_data_llm:/qdrant/storage
    restart: always
    healthcheck:
      test: [ "CMD-SHELL", "bash -c ':> /dev/tcp/127.0.0.1/6333' || exit 1" ]
      interval: 10s
      timeout: 5s
      retries: 5

  reasoning-engine:
    build: ./reasoning_engine
    container_name: silhouette-reasoning-engine
    ports:
      - "8000:8000"
    environment:
      - NEO4J_URI=bolt://neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-changeme_on_first_run}
    depends_on:
      neo4j:
        condition: service_healthy
    restart: always

  neo4j:
    image: neo4j:5.15.0-community
    container_name: silhouette-llm-neo4j
    ports:
      - "7574:7474" # HTTP
      - "7787:7687" # Bolt
    environment:
      NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-changeme_on_first_run}
      NEO4J_apoc_export_file_enabled: "true"
      NEO4J_apoc_import_file_enabled: "true"
      NEO4J_apoc_import_file_use__neo4j__config: "true"
      NEO4J_PLUGINS: '["apoc"]'
    volumes:
      - neo4j_data_llm:/data
      - neo4j_plugins_llm:/plugins
    restart: always
    healthcheck:
      test: [ "CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:7474/" ]
      interval: 10s
      timeout: 10s
      retries: 10

  bot:
    build: .
    container_name: silhouette-bot
    ports:
      - "3005:3005"
    env_file:
      - .env.local
    environment:
      # Inside a container the runtime provides isolation, so we bind to all
      # interfaces. SET SILHOUETTE_API_TOKEN in .env.local to secure the API,
      # otherwise the server refuses token-less access on a non-loopback bind.
      SILHOUETTE_HOST: 0.0.0.0
      # External silhouette-brain integration (no-op unless the brain profile is up).
      # Override BRAIN_API_ENABLED=true to force-enable.
      BRAIN_API_URL: ${BRAIN_API_URL:-http://silhouette-brain:9876}
      BRAIN_API_ENABLED: ${BRAIN_API_ENABLED:-false}
    volumes:
      - .:/app
      - /app/node_modules
      - silhouette_data:/app/data
      - silhouette_db:/app/db
      # ⚠️ SECURITY: Host Docker socket + full filesystem mounts have been removed
      # from the default stack because they grant container→host root escalation.
      # If you explicitly need "host-aware" powers, opt in with the documented
      # override (review it first!):
      #   docker compose -f docker-compose.yml -f docker-compose.host-access.yml up -d
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      qdrant:
        condition: service_healthy
      neo4j:
        condition: service_healthy
    restart: always

  # ── External Silhouette Brain (opt-in via profile) ───────────────────────────
  # Build context defaults to a sibling checkout of the silhouette-brain repo:
  #   git clone https://github.com/haroldfabla2-hue/silhouette-brain ../silhouette-brain
  # Bring it up with:  docker compose --profile brain up -d
  silhouette-brain:
    build: ${BRAIN_CONTEXT:-../silhouette-brain}
    container_name: silhouette-brain
    profiles: ["brain"]
    ports:
      - "9876:9876"
    environment:
      BRAIN_API_HOST: 0.0.0.0
      REASONING_PROVIDER: ${REASONING_PROVIDER:-minimax}
      REASONING_API_KEY: ${REASONING_API_KEY:-}
      REASONING_MODEL: ${REASONING_MODEL:-MiniMax-M2.5}
      FASTEMBED_MODEL: ${FASTEMBED_MODEL:-sentence-transformers/paraphrase-multilingual-MiniLM-L12-v2}
      NEO4J_URI: bolt://neo4j:7687
      NEO4J_USER: neo4j
      NEO4J_PASSWORD: ${NEO4J_PASSWORD}
      REDIS_URL: redis://redis:6379
    volumes:
      - brain_data:/app/data
    depends_on:
      neo4j:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: always

  caddy:
    image: caddy:latest
    container_name: silhouette-caddy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./dist:/usr/share/caddy
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - bot
    restart: always

volumes:
  postgres_data:
  redis_data_llm:
  qdrant_data_llm:
  neo4j_data_llm:
  neo4j_plugins_llm:
  silhouette_data:
  silhouette_db:
  brain_data:
  caddy_data:
  caddy_config: