86 lines
2.5 KiB
YAML
86 lines
2.5 KiB
YAML
# Unraid production overlay. Compose with the base topology:
|
|
# docker compose -f compose.yaml -f compose.production.yaml up -d
|
|
#
|
|
# Everything already parameterized in compose.yaml (RAGCORE_STATE_ROOT,
|
|
# RAGCORE_HOST_PORT, POSTGRES_*, QDRANT_API_KEY) is configured via .env --
|
|
# copy .env.example to .env, set RAGCORE_STATE_ROOT to a direct SSD/NVMe
|
|
# pool path (e.g. /mnt/<pool>/appdata/ragcore, never /mnt/pool/...) and
|
|
# generate real secrets. See docs/09_OPERATIONS/UNRAID_DEPLOYMENT.md.
|
|
#
|
|
# This overlay only adds what genuinely differs for production: requiring
|
|
# real secrets (no silent fallback to the insecure .env.example defaults
|
|
# base compose.yaml also loads for local dev convenience), forcing
|
|
# production mode itself, and resource limits. Healthchecks, non-root/
|
|
# no-new-privileges, restart policies and the internal-only backend network
|
|
# (only `app`/`mcp` are ever published) are already unconditional in
|
|
# compose.yaml; nothing here changes them.
|
|
#
|
|
# RAGCORE_ENV=production is set here explicitly (not left to .env) on
|
|
# purpose: `environment:` always wins over `env_file`-sourced values
|
|
# regardless of file order, so an operator who copies .env.example to .env
|
|
# without touching RAGCORE_ENV (it still says `development` there) cannot
|
|
# accidentally deploy this overlay in development mode -- Settings'
|
|
# own fail-closed validation (secrets, storage paths, ...) only ever runs
|
|
# when env is actually "production".
|
|
services:
|
|
app:
|
|
environment:
|
|
RAGCORE_ENV: production
|
|
RAGCORE_TRUSTED_PROXY_IPS: "${RAGCORE_TRUSTED_PROXY_IPS:?set the dedicated proxy IP or CIDR}"
|
|
env_file:
|
|
- path: .env
|
|
required: true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "2"
|
|
memory: 2g
|
|
networks:
|
|
edge:
|
|
backend:
|
|
proxy:
|
|
aliases: [ragcore-app]
|
|
|
|
worker:
|
|
environment:
|
|
RAGCORE_ENV: production
|
|
env_file:
|
|
- path: .env
|
|
required: true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "2"
|
|
memory: 2g
|
|
|
|
mcp:
|
|
environment:
|
|
RAGCORE_ENV: production
|
|
env_file:
|
|
- path: .env
|
|
required: true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "1"
|
|
memory: 1g
|
|
|
|
postgres:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "2"
|
|
memory: 2g
|
|
|
|
qdrant:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "2"
|
|
memory: 4g
|
|
|
|
networks:
|
|
proxy:
|
|
name: "${RAGCORE_PROXY_NETWORK:-ragcore-proxy}"
|
|
external: true
|