docker-compose.yml

# Three-service sovereign-RAG stack. Bring it up with:
#
#   cp .env.example .env       # set PG_PASSWORD to something not the demo default
#   docker compose up -d
#   docker compose exec ollama ollama pull llama3.2:3b
#   docker compose exec ollama ollama pull nomic-embed-text
#   docker compose exec ollama ollama pull all-minilm
#
# After Ollama has the models, ingest the corpus:
#
#   docker compose exec api python -m ingest.bootstrap
#
# Prod note: replace the dev-default PG password and front the API
# with TLS + auth (the api/ tier has no auth — it's a research tool).

services:
  pgvector:
    image: pgvector/pgvector:pg16
    environment:
      POSTGRES_DB: ${PG_DB:-rti}
      POSTGRES_USER: ${PG_USER:-rti}
      POSTGRES_PASSWORD: ${PG_PASSWORD:-rti-dev-password-change-me}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "${PG_USER:-rti}", "-d", "${PG_DB:-rti}"]
      interval: 5s
      timeout: 3s
      retries: 10
    restart: unless-stopped
    networks: [rti-net]

  ollama:
    image: ollama/ollama:latest    # pinning Ollama is awkward — its tag scheme
                                    # changes frequently; named volume isolates state.
    volumes:
      - ollama:/root/.ollama
    ports:
      - "11434:11434"
    restart: unless-stopped
    networks: [rti-net]

  api:
    build: .
    image: rag-threat-intel/api:1.0.0
    env_file: .env
    environment:
      - PG_HOST=pgvector
      - OLLAMA_BASE_URL=http://ollama:11434
    depends_on:
      pgvector:
        condition: service_healthy
    ports:
      - "8000:8000"
    restart: unless-stopped
    networks: [rti-net]

volumes:
  pgdata:
  ollama:

networks:
  rti-net:
    driver: bridge