docker-compose.yml

services:
  ollama:
    # Pin the runtime image (override with OLLAMA_VERSION). Avoid :latest for
    # reproducibility. For the strongest pin, use an image digest (@sha256:...).
    image: ollama/ollama:${OLLAMA_VERSION:-0.5.1}
    # No host port: Ollama is reachable only on the internal compose network.
    expose:
      - "11434"
    volumes:
      - ollama_data:/root/.ollama
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:11434/"]
      interval: 10s
      timeout: 5s
      retries: 5
    entrypoint:
      - /bin/sh
      - -c
      - |
        ollama serve &
        until curl -sf http://localhost:11434/; do sleep 1; done
        # Pull the SAME model the app queries (single source: LLM_MODEL). For a
        # digest pin use e.g. LLM_MODEL=llama3.2:3b@sha256:<digest>.
        ollama pull ${LLM_MODEL:-llama3.2:3b}
        wait
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "4.0"
          memory: 8g

  app:
    build: .
    # Bind to the host loopback only; expose publicly behind a reverse proxy
    # with NEXUSRAG_API_KEY set. 0.0.0.0 in the container is inside the network.
    ports:
      - "127.0.0.1:8000:8000"
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
      # One variable drives both the pulled model (ollama service) and the
      # queried model (app), so they can never desync.
      - LLM_MODEL=${LLM_MODEL:-llama3.2:3b}
      # Set NEXUSRAG_API_KEY in your shell/.env to require an X-API-Key header.
      - NEXUSRAG_API_KEY=${NEXUSRAG_API_KEY:-}
    volumes:
      - ./data:/app/data
    depends_on:
      ollama:
        condition: service_healthy
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "4.0"
          memory: 4g

volumes:
  ollama_data: