Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

compose.production.yaml

@@ -0,0 +1,85 @@
+# Unraid production overlay. Compose with the base topology:
+#   docker compose -f compose.yaml -f compose.production.yaml up -d
+#
+# Everything already parameterized in compose.yaml (RAGCORE_STATE_ROOT,
+# RAGCORE_HOST_PORT, POSTGRES_*, QDRANT_API_KEY) is configured via .env --
+# copy .env.example to .env, set RAGCORE_STATE_ROOT to a direct SSD/NVMe
+# pool path (e.g. /mnt/<pool>/appdata/ragcore, never /mnt/pool/...) and
+# generate real secrets. See docs/09_OPERATIONS/UNRAID_DEPLOYMENT.md.
+#
+# This overlay only adds what genuinely differs for production: requiring
+# real secrets (no silent fallback to the insecure .env.example defaults
+# base compose.yaml also loads for local dev convenience), forcing
+# production mode itself, and resource limits. Healthchecks, non-root/
+# no-new-privileges, restart policies and the internal-only backend network
+# (only `app`/`mcp` are ever published) are already unconditional in
+# compose.yaml; nothing here changes them.
+#
+# RAGCORE_ENV=production is set here explicitly (not left to .env) on
+# purpose: `environment:` always wins over `env_file`-sourced values
+# regardless of file order, so an operator who copies .env.example to .env
+# without touching RAGCORE_ENV (it still says `development` there) cannot
+# accidentally deploy this overlay in development mode -- Settings'
+# own fail-closed validation (secrets, storage paths, ...) only ever runs
+# when env is actually "production".
+services:
+  app:
+    environment:
+      RAGCORE_ENV: production
+      RAGCORE_TRUSTED_PROXY_IPS: "${RAGCORE_TRUSTED_PROXY_IPS:?set the dedicated proxy IP or CIDR}"
+    env_file:
+      - path: .env
+        required: true
+    deploy:
+      resources:
+        limits:
+          cpus: "2"
+          memory: 2g
+    networks:
+      edge:
+      backend:
+      proxy:
+        aliases: [ragcore-app]
+
+  worker:
+    environment:
+      RAGCORE_ENV: production
+    env_file:
+      - path: .env
+        required: true
+    deploy:
+      resources:
+        limits:
+          cpus: "2"
+          memory: 2g
+
+  mcp:
+    environment:
+      RAGCORE_ENV: production
+    env_file:
+      - path: .env
+        required: true
+    deploy:
+      resources:
+        limits:
+          cpus: "1"
+          memory: 1g
+
+  postgres:
+    deploy:
+      resources:
+        limits:
+          cpus: "2"
+          memory: 2g
+
+  qdrant:
+    deploy:
+      resources:
+        limits:
+          cpus: "2"
+          memory: 4g
+
+networks:
+  proxy:
+    name: "${RAGCORE_PROXY_NETWORK:-ragcore-proxy}"
+    external: true