Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

compose.yaml

@@ -0,0 +1,145 @@
+name: ragcore
+
+services:
+  app:
+    build:
+      context: .
+      target: runtime
+    command: ["python", "-m", "ragcore.main"]
+    env_file:
+      - path: .env.example
+        required: true
+      - path: .env
+        required: false
+    depends_on:
+      postgres:
+        condition: service_healthy
+      qdrant:
+        condition: service_started
+    ports:
+      - "127.0.0.1:${RAGCORE_HOST_PORT:-8088}:8080"
+    volumes:
+      - "${RAGCORE_STATE_ROOT:-./.state}/blobs:/var/lib/ragcore/blobs"
+      - "${RAGCORE_STATE_ROOT:-./.state}/parsed:/var/lib/ragcore/parsed"
+      - "${RAGCORE_STATE_ROOT:-./.state}/tmp:/var/lib/ragcore/tmp"
+      - "${RAGCORE_STATE_ROOT:-./.state}/models:/var/lib/ragcore/models"
+      - "${RAGCORE_MODELFORGE_SECRET_ROOT:-./.state/secrets}:/run/secrets/ragcore:ro"
+    read_only: true
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+    networks: [edge, backend]
+
+  worker:
+    build:
+      context: .
+      target: runtime
+    command: ["python", "-m", "ragcore.worker"]
+    healthcheck:
+      disable: true
+    env_file:
+      - path: .env.example
+        required: true
+      - path: .env
+        required: false
+    depends_on:
+      postgres:
+        condition: service_healthy
+      qdrant:
+        condition: service_started
+    volumes:
+      - "${RAGCORE_STATE_ROOT:-./.state}/blobs:/var/lib/ragcore/blobs"
+      - "${RAGCORE_STATE_ROOT:-./.state}/parsed:/var/lib/ragcore/parsed"
+      - "${RAGCORE_STATE_ROOT:-./.state}/tmp:/var/lib/ragcore/tmp"
+      - "${RAGCORE_STATE_ROOT:-./.state}/models:/var/lib/ragcore/models"
+      # Folder/Git source content. Read-only, and every path listed here must
+      # also appear in RAGCORE_SOURCE_ROOTS -- the mount makes it reachable,
+      # the allowlist makes it permitted, and both are required. Only the
+      # worker needs it: the app validates source paths lexically and never
+      # opens them.
+      - "${RAGCORE_SOURCE_MOUNT:-./.state/sources}:/mnt/rag-sources:ro"
+    read_only: true
+    tmpfs:
+      - /tmp:size=512m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+    networks: [backend]
+
+  mcp:
+    build:
+      context: .
+      target: runtime
+    command: ["python", "-m", "ragcore.mcp.main"]
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8090/health', timeout=3)"]
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
+    env_file:
+      - path: .env.example
+        required: true
+      - path: .env
+        required: false
+    depends_on:
+      postgres:
+        condition: service_healthy
+      qdrant:
+        condition: service_started
+    ports:
+      - "${RAGCORE_MCP_HOST_PORT:-8090}:8090"
+    volumes:
+      # Read-only: MCP only ever reads the active embedding profile, never
+      # registers one -- but still needs the same shared file app/worker use.
+      - "${RAGCORE_STATE_ROOT:-./.state}/models:/var/lib/ragcore/models:ro"
+    read_only: true
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+    networks: [edge, backend]
+
+  postgres:
+    image: postgres:18.4-bookworm
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-ragcore}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-ragcore}"
+      POSTGRES_DB: "${POSTGRES_DB:-ragcore}"
+    volumes:
+      - "${RAGCORE_STATE_ROOT:-./.state}/postgres:/var/lib/postgresql"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-ragcore} -d ${POSTGRES_DB:-ragcore}"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+    shm_size: 256mb
+    restart: unless-stopped
+    networks: [backend]
+
+  qdrant:
+    image: qdrant/qdrant:v1.18.3
+    environment:
+      QDRANT__SERVICE__API_KEY: "${QDRANT_API_KEY:-replace-me}"
+      QDRANT__SERVICE__ENABLE_TLS: "false"
+      QDRANT__LOG_LEVEL: INFO
+    volumes:
+      - "${RAGCORE_STATE_ROOT:-./.state}/qdrant:/qdrant/storage"
+    restart: unless-stopped
+    networks: [backend]
+
+  ollama:
+    profiles: ["models"]
+    image: ollama/ollama:0.31.1
+    volumes:
+      - "${RAGCORE_STATE_ROOT:-./.state}/ollama:/root/.ollama"
+    restart: unless-stopped
+    networks: [backend]
+
+networks:
+  edge:
+  backend:
+    internal: true