docker-compose.bundle.yml

# docker-compose.bundle.yml - All-in-one Fortemi deployment
#
# Usage (end-user / default - pulls from GHCR):
#   docker compose -f docker-compose.bundle.yml up -d
#
# Usage (internal development - pulls from Gitea registry):
#   FORTEMI_REGISTRY=git.integrolabs.net FORTEMI_TAG=bundle-main \
#     docker compose -f docker-compose.bundle.yml pull
#   FORTEMI_REGISTRY=git.integrolabs.net FORTEMI_TAG=bundle-main \
#     docker compose -f docker-compose.bundle.yml up -d --no-build
#
# Usage (development - build locally):
#   docker compose -f docker-compose.bundle.yml up -d --build
#
# GPU Setup (REQUIRED for GPU-accelerated features):
#   1. Install NVIDIA Container Toolkit: https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/install-guide.html
#   2. Copy docker/daemon.json to /etc/docker/daemon.json (sets nvidia as default runtime)
#   3. Restart Docker: sudo systemctl restart docker
#   4. Verify: docker info | grep "Default Runtime"  →  should show "nvidia"
#
# Without this setup, GPU devices appear in containers but NVIDIA libraries are not
# mounted, causing CUDA to report 0 devices and GPU workloads (Whisper, pyannote,
# Open3D) to fail silently or with float16/CUDA errors.
#
# Hardware profiles — select based on your GPU VRAM:
#
#   Default (no profile):  6-8GB VRAM (RTX 3060/4060/5060)
#     - CPU Whisper + CPU pyannote, single qwen3.5:9b model (~6.5GB VRAM)
#
#   --profile gpu-12gb:    12-16GB VRAM (RTX 3060 12GB/4070/5070)
#     - GPU Whisper + GPU pyannote + qwen3.5:9b
#
#   --profile gpu-24gb:    24GB+ VRAM (RTX 3090/4090/5090)
#     - GPU Whisper + GPU pyannote + larger models via OLLAMA_GEN_MODEL
#
# Set COMPOSE_PROFILES in .env (recommended) or pass --profile on command line:
#   COMPOSE_PROFILES=edge       # in .env (default)
#   COMPOSE_PROFILES=gpu-12gb   # in .env (mid-range GPU)
#   COMPOSE_PROFILES=gpu-24gb   # in .env (high-end GPU)
#
# For clean install (wipe database):
#   docker compose -f docker-compose.bundle.yml down -v
#   docker compose -f docker-compose.bundle.yml up -d
#
# Environment: Create .env from .env.example, set ISSUER_URL.
# MCP OAuth credentials are auto-managed on first boot (persisted at $PGDATA/.fortemi-mcp-credentials).
# Manual MCP_CLIENT_ID/MCP_CLIENT_SECRET in .env only needed for standalone (non-Docker) deployments.

services:
  # Autoheal: restarts containers that fail their Docker healthcheck.
  # Only containers with label autoheal=true are monitored.
  # Does NOT monitor matric (contains PostgreSQL — needs human investigation).
  autoheal:
    image: willfarrell/autoheal
    environment:
      - AUTOHEAL_CONTAINER_LABEL=autoheal
      - AUTOHEAL_INTERVAL=30
      - AUTOHEAL_START_PERIOD=300
      - AUTOHEAL_DEFAULT_STOP_TIMEOUT=10
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped

  # Redis cache for search query results
  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    volumes:
      - matric-redis:/data
    labels:
      - autoheal=true
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3

  # Whisper speech-to-text server (GPU-accelerated, OpenAI-compatible API)
  # Opt-in via hardware profile: --profile gpu-12gb or --profile gpu-24gb
  whisper-gpu:
    image: ghcr.io/speaches-ai/speaches:latest-cuda-12.6.3
    profiles:
      - gpu-12gb
      - gpu-24gb
    networks:
      default:
        aliases:
          - whisper  # Same alias as CPU variant — matric reaches either as http://whisper:8000
    volumes:
      - whisper-models:/home/ubuntu/.cache/huggingface/hub
    labels:
      - autoheal=true
    environment:
      - WHISPER__INFERENCE_DEVICE=auto
      - WHISPER__COMPUTE_TYPE=float16
      # Pre-download model on startup (avoids first-request delay)
      - PRELOAD_MODELS=["${WHISPER_MODEL:-Systran/faster-distil-whisper-large-v3}"]
    mem_limit: ${WHISPER_MEM_LIMIT:-8g}
    memswap_limit: ${WHISPER_MEM_LIMIT:-8g}
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]
    stop_grace_period: 30s
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://0.0.0.0:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # Whisper CPU variant (edge default — preserves GPU VRAM for inference)
  # Activated by default via COMPOSE_PROFILES=edge in .env
  # For GPU-accelerated transcription, set COMPOSE_PROFILES=gpu-12gb or gpu-24gb
  whisper:
    image: ghcr.io/speaches-ai/speaches:latest-cpu
    profiles:
      - edge
    volumes:
      - whisper-models:/home/ubuntu/.cache/huggingface/hub
    labels:
      - autoheal=true
    environment:
      - WHISPER__INFERENCE_DEVICE=cpu
      - WHISPER__COMPUTE_TYPE=int8
      - PRELOAD_MODELS=["${WHISPER_MODEL:-Systran/faster-distil-whisper-large-v3}"]
    mem_limit: ${WHISPER_CPU_MEM_LIMIT:-4g}
    memswap_limit: ${WHISPER_CPU_MEM_LIMIT:-4g}
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://0.0.0.0:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  # pyannote speaker diarization sidecar (GPU-accelerated)
  # Opt-in via hardware profile: --profile gpu-12gb or --profile gpu-24gb
  # Set DIARIZATION_BASE_URL= (empty) in .env to disable diarization entirely.
  pyannote-gpu:
    image: ${FORTEMI_REGISTRY:-ghcr.io}/fortemi/fortemi:${FORTEMI_PYANNOTE_TAG:-pyannote-latest}
    build:
      context: build/pyannote
      dockerfile: Dockerfile
    profiles:
      - gpu-12gb
      - gpu-24gb
    networks:
      default:
        aliases:
          - pyannote  # Same alias as CPU variant — matric reaches either as http://pyannote:8001
    volumes:
      - pyannote-models:/root/.cache/huggingface/hub
    labels:
      - autoheal=true
    environment:
      - PYANNOTE_MODEL=${DIARIZATION_MODEL:-pyannote/speaker-diarization-3.1}
      - PYANNOTE_PORT=8001
      # HuggingFace token for gated pyannote models (required for first download)
      - HF_TOKEN=${HF_TOKEN:-}
    mem_limit: ${PYANNOTE_MEM_LIMIT:-6g}
    memswap_limit: ${PYANNOTE_MEM_LIMIT:-6g}
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]
    stop_grace_period: 30s
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://0.0.0.0:8001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 300s

  # pyannote CPU variant (edge default — preserves GPU VRAM for inference)
  # Activated by default via COMPOSE_PROFILES=edge in .env
  pyannote:
    image: ${FORTEMI_REGISTRY:-ghcr.io}/fortemi/fortemi:${FORTEMI_PYANNOTE_TAG:-pyannote-latest}
    build:
      context: build/pyannote
      dockerfile: Dockerfile
    profiles:
      - edge
    volumes:
      - pyannote-models:/root/.cache/huggingface/hub
    labels:
      - autoheal=true
    environment:
      - PYANNOTE_MODEL=${DIARIZATION_MODEL:-pyannote/speaker-diarization-3.1}
      - PYANNOTE_PORT=8001
      - PYANNOTE_DEVICE=cpu
      - HF_TOKEN=${HF_TOKEN:-}
    mem_limit: ${PYANNOTE_CPU_MEM_LIMIT:-4g}
    memswap_limit: ${PYANNOTE_CPU_MEM_LIMIT:-4g}
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://0.0.0.0:8001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 300s

  # GLiNER NER sidecar (zero-shot entity extraction, CPU-only)
  # Runs as a separate container; matric connects via GLINER_BASE_URL=http://gliner:8090
  # Set GLINER_BASE_URL= (empty) in .env to disable NER entirely.
  gliner:
    image: ${FORTEMI_REGISTRY:-ghcr.io}/fortemi/fortemi:${FORTEMI_GLINER_TAG:-gliner-latest}
    build:
      context: build/gliner
      dockerfile: Dockerfile
    volumes:
      - gliner-models:/root/.cache/huggingface/hub
    labels:
      - autoheal=true
    environment:
      - GLINER_MODEL=${GLINER_MODEL:-urchade/gliner_large-v2.1}
      - GLINER_PORT=8090
      - GLINER_THRESHOLD=${GLINER_THRESHOLD:-0.3}
    mem_limit: ${GLINER_MEM_LIMIT:-4g}
    memswap_limit: ${GLINER_MEM_LIMIT:-4g}
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://0.0.0.0:8090/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # Service name "fortemi" (was "matric" in v2026.5.4 and earlier — renamed
  # in v2026.5.6 so `docker compose exec fortemi ...` recipes in the README
  # and seed-support-archive.sh hints actually work. The container's
  # Postgres user/database/binary names retain "matric" for back-compat with
  # existing data volumes and external pg connection strings.)
  fortemi:
    image: ${FORTEMI_REGISTRY:-ghcr.io}/fortemi/fortemi:${FORTEMI_TAG:-bundle-latest}
    build:
      context: .
      dockerfile: Dockerfile.bundle
      args:
        VERSION: ${VERSION:-dev}
        GIT_SHA: ${GIT_SHA:-unknown}
        BUILD_DATE: ${BUILD_DATE:-unknown}
        CARGO_BUILD_JOBS: ${CARGO_BUILD_JOBS:-8}
    ports:
      # Host-side port is env-configurable so operators can dodge
      # collisions with existing services on the host (e.g. another
      # dashboard on 3001) without needing a docker-compose override file.
      # Container-side stays fixed.
      - "${API_HOST_PORT:-3000}:3000"
      - "${MCP_HOST_PORT:-3001}:3001"
    depends_on:
      redis:
        condition: service_healthy
      whisper:
        condition: service_healthy
        required: false  # Whisper is optional - matric starts without it
      gliner:
        condition: service_healthy
        required: false  # GLiNER is optional - matric starts without it (NER disabled)
      pyannote:
        condition: service_healthy
        required: false  # Diarization is optional - matric starts without it
    environment:
      # ── PostgreSQL ──────────────────────────────────────────────────────
      - POSTGRES_USER=matric
      - POSTGRES_PASSWORD=matric
      - POSTGRES_DB=matric

      # ── API Server ─────────────────────────────────────────────────────
      - RUST_LOG=${RUST_LOG:-info}

      # ── Debug ──────────────────────────────────────────────────────────
      - DEBUG_SESSION_CONTEXT=${DEBUG_SESSION_CONTEXT:-}
      - RATE_LIMIT_ENABLED=${RATE_LIMIT_ENABLED:-false}
      - REQUIRE_AUTH=${REQUIRE_AUTH:-true}
      # ADR-094: anonymous mode is opt-in only. To run a local single-user
      # bundle without auth, explicitly set REQUIRE_AUTH=false and
      # I_UNDERSTAND_NO_AUTH=true in your environment.
      - I_UNDERSTAND_NO_AUTH=${I_UNDERSTAND_NO_AUTH:-false}
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-}
      - MATRIC_MAX_BODY_SIZE_BYTES=${MATRIC_MAX_BODY_SIZE_BYTES:-2147483648}
      - MATRIC_MAX_UPLOAD_SIZE_BYTES=${MATRIC_MAX_UPLOAD_SIZE_BYTES:-}

      # ── Redis Cache ────────────────────────────────────────────────────
      - REDIS_ENABLED=${REDIS_ENABLED:-true}
      - REDIS_URL=redis://redis:6379
      - REDIS_CACHE_TTL=${REDIS_CACHE_TTL:-300}

      # ── Full-Text Search ───────────────────────────────────────────────
      - FTS_SCRIPT_DETECTION=${FTS_SCRIPT_DETECTION:-true}
      - FTS_TRIGRAM_FALLBACK=${FTS_TRIGRAM_FALLBACK:-true}
      - FTS_BIGRAM_CJK=${FTS_BIGRAM_CJK:-true}
      - FTS_MULTILINGUAL_CONFIGS=${FTS_MULTILINGUAL_CONFIGS:-true}
      - FTS_WEBSEARCH_TO_TSQUERY=${FTS_WEBSEARCH_TO_TSQUERY:-true}

      # ── File Storage ───────────────────────────────────────────────────
      - FILE_STORAGE_PATH=${FILE_STORAGE_PATH:-/var/lib/matric/files}

      # ── Real-Time Events ───────────────────────────────────────────────
      - MATRIC_EVENT_BUS_CAPACITY=${MATRIC_EVENT_BUS_CAPACITY:-256}
      - MATRIC_WEBHOOK_TIMEOUT_SECS=${MATRIC_WEBHOOK_TIMEOUT_SECS:-10}

      # ── Background Worker ──────────────────────────────────────────────
      # - WORKER_ENABLED=true
      # - LOG_FORMAT=json

      # ── Support Memory Archive ──────────────────────────────────────────
      # Off by default so the Docker bundle matches the native build
      # (which never auto-seeds). Set LOAD_SUPPORT_MEMORY=true in .env
      # to seed on first boot, or run
      #   docker compose -f docker-compose.bundle.yml \
      #     exec fortemi /app/seed-support-archive.sh
      # at any time to seed an already-running instance.
      - LOAD_SUPPORT_MEMORY=${LOAD_SUPPORT_MEMORY:-false}
      # Legacy override: forces skip even if LOAD_SUPPORT_MEMORY=true.
      # Kept for back-compat with bundles that pre-date the opt-in flip.
      - DISABLE_SUPPORT_MEMORY=${DISABLE_SUPPORT_MEMORY:-false}
      - MAX_MEMORIES=${MAX_MEMORIES:-10}

      # ── Backup ─────────────────────────────────────────────────────────
      - BACKUP_DEST=${BACKUP_DEST:-/var/backups/matric-memory}

      # ── OAuth ──────────────────────────────────────────────────────────
      # ISSUER_URL is REQUIRED for OAuth/MCP - set in .env
      - ISSUER_URL=${ISSUER_URL:-https://localhost:3000}
      # OAuth token lifetimes (seconds)
      - OAUTH_TOKEN_LIFETIME_SECS=${OAUTH_TOKEN_LIFETIME_SECS:-3600}
      - OAUTH_MCP_TOKEN_LIFETIME_SECS=${OAUTH_MCP_TOKEN_LIFETIME_SECS:-14400}

      # ── MCP Server ─────────────────────────────────────────────────────
      - MCP_TRANSPORT=http
      - MCP_PORT=3001
      - MCP_BASE_URL=${MCP_BASE_URL:-${ISSUER_URL:-https://localhost:3000}/mcp}
      # Internal API URL for MCP→API calls (avoids nginx hairpin)
      - FORTEMI_URL=${FORTEMI_URL:-http://localhost:3000}
      # MCP OAuth client credentials - register via POST /oauth/register
      - MCP_CLIENT_ID=${MCP_CLIENT_ID}
      - MCP_CLIENT_SECRET=${MCP_CLIENT_SECRET}

      # ── Job Worker ─────────────────────────────────────────────────────
      # Max concurrent jobs per worker (Phase 1 jobs run in parallel).
      # Set OLLAMA_NUM_PARALLEL on your Ollama server to match.
      - JOB_MAX_CONCURRENT=${JOB_MAX_CONCURRENT:-4}
      # Job execution timeout (seconds). Default 600 (10 min).
      # Increase for large video files or slow GPU inference.
      - JOB_TIMEOUT_SECS=${JOB_TIMEOUT_SECS:-600}
      # Fast model for extraction pipeline (concept tagging, references, titles).
      # Default: qwen3.5:9b (256K ctx, natively multimodal, strong JSON).
      # Also serves as vision model — eliminates separate qwen3-vl VRAM load.
      # Set to empty to disable. Chunk size adapts to model context via profiles.
      - MATRIC_FAST_GEN_MODEL=${MATRIC_FAST_GEN_MODEL:-qwen3.5:9b}
      # Timeout for fast model requests (seconds).
      - MATRIC_FAST_GEN_TIMEOUT_SECS=${MATRIC_FAST_GEN_TIMEOUT_SECS:-60}

      # ── Inference: Ollama (default) ────────────────────────────────────
      - MATRIC_INFERENCE_DEFAULT=${MATRIC_INFERENCE_DEFAULT:-ollama}
      - OLLAMA_BASE=${OLLAMA_BASE:-http://host.docker.internal:11434}
      - OLLAMA_HOST=${OLLAMA_HOST:-http://host.docker.internal:11434}
      - OLLAMA_EMBED_MODEL=${OLLAMA_EMBED_MODEL:-nomic-embed-text}
      - OLLAMA_GEN_MODEL=${OLLAMA_GEN_MODEL:-qwen3.5:9b}
      - OLLAMA_EMBED_DIM=${OLLAMA_EMBED_DIM:-768}
      - MATRIC_EMBED_TIMEOUT_SECS=${MATRIC_EMBED_TIMEOUT_SECS:-30}
      - MATRIC_GEN_TIMEOUT_SECS=${MATRIC_GEN_TIMEOUT_SECS:-120}

      # ── Inference: llama.cpp (opt-in, OpenAI-compatible protocol) ─────
      # Set LLAMACPP_BASE_URL to enable. Uses existing OpenAI backend.
      # Example: LLAMACPP_BASE_URL=http://host.docker.internal:8080/v1
      - LLAMACPP_BASE_URL=${LLAMACPP_BASE_URL:-}
      - LLAMACPP_API_KEY=${LLAMACPP_API_KEY:-}

      # ── Inference: OpenAI / OpenRouter (opt-in) ───────────────────────
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - OPENAI_BASE_URL=${OPENAI_BASE_URL:-}
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}

      # ── NVIDIA GPU (required for Open3D 3D renderer + optional for other GPU workloads)
      # 'all' ensures graphics (EGL), compute (CUDA), and utility (nvidia-smi) are available.
      # For non-GPU deployments: remove the deploy.resources section and set
      # OPEN3D_CPU_RENDERING=true (3D rendering will use software fallback).
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=all
      # Max concurrent GPU jobs per tier (default 1 = serial, prevents VRAM contention).
      # Increase only if your GPU has enough VRAM to run multiple models simultaneously.
      - GPU_MAX_CONCURRENT=${GPU_MAX_CONCURRENT:-1}

      # ── 3D Model Renderer (Open3D) ────────────────────────────────────
      # Internal renderer URL — bundled Open3D renderer on localhost:8080
      - RENDERER_URL=${RENDERER_URL:-http://localhost:8080}
      - RENDERER_PORT=${RENDERER_PORT:-8080}

      # ── Extraction Services (enabled by default) ─────────────────────
      - OLLAMA_VISION_MODEL=${OLLAMA_VISION_MODEL:-qwen3.5:9b}
      # Whisper is bundled and enabled by default (GPU). Override for remote server.
      - WHISPER_BASE_URL=${WHISPER_BASE_URL:-http://whisper:8000}
      - WHISPER_MODEL=${WHISPER_MODEL:-Systran/faster-distil-whisper-large-v3}
      - OCR_ENABLED=${OCR_ENABLED:-false}
      - LIBREOFFICE_PATH=${LIBREOFFICE_PATH:-}
      # GLiNER NER (sidecar container, set to empty to disable)
      - GLINER_BASE_URL=${GLINER_BASE_URL:-http://gliner:8090}
      # pyannote speaker diarization (sidecar container, set to empty to disable)
      - DIARIZATION_BASE_URL=${DIARIZATION_BASE_URL:-http://pyannote:8001}
      - DIARIZATION_MODEL=${DIARIZATION_MODEL:-pyannote/speaker-diarization-3.1}
      # Target concepts per note. GLiNER runs first; if it produces fewer than
      # this, fast/standard LLM supplements. Higher = richer taxonomy, slower.
      - EXTRACTION_TARGET_CONCEPTS=${EXTRACTION_TARGET_CONCEPTS:-5}

      # ── Inference: OpenAI (alternative) ────────────────────────────────
      # - OPENAI_API_KEY=${OPENAI_API_KEY}
      # - OPENAI_BASE_URL=${OPENAI_BASE_URL:-https://api.openai.com/v1}
      # - OPENAI_EMBED_MODEL=${OPENAI_EMBED_MODEL:-text-embedding-3-small}
      # - OPENAI_GEN_MODEL=${OPENAI_GEN_MODEL:-gpt-4o-mini}
      # - OPENAI_EMBED_DIM=${OPENAI_EMBED_DIM:-1536}
      # - OPENAI_TIMEOUT=${OPENAI_TIMEOUT:-30}
    volumes:
      # PostgreSQL data persistence
      - matric-pgdata:/var/lib/postgresql/data
      # File storage (attachments, blobs)
      - matric-files:/var/lib/matric/files
      # Backup directory
      - matric-backups:/var/backups/matric-memory
    # GPU device reservation for Open3D EGL rendering and CUDA workloads.
    # For non-GPU deployments: remove this deploy section entirely.
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]
    restart: unless-stopped
    extra_hosts:
      # Required on Linux for host.docker.internal to resolve to host
      - "host.docker.internal:host-gateway"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 5s
      start_period: 60s
      retries: 3

volumes:
  matric-pgdata:
    driver: local
  matric-files:
    driver: local
  matric-backups:
    driver: local
  matric-redis:
    driver: local
  whisper-models:
    driver: local
  gliner-models:
    driver: local
  pyannote-models:
    driver: local