Initial curated projectbrain source from 8a7b1e0651dbdab97d744cbd2e653ab3970ac6c5

docker/nginx.conf

@@ -0,0 +1,66 @@
+server {
+  listen 8080;
+  server_name _;
+
+  root /usr/share/nginx/html;
+  index index.html;
+  client_max_body_size 1m;
+  add_header X-Content-Type-Options "nosniff" always;
+  add_header X-Frame-Options "DENY" always;
+  add_header Referrer-Policy "no-referrer" always;
+  add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+  add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'" always;
+
+  location /api/ {
+    proxy_pass http://backend:4000/api/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_connect_timeout 5s;
+    proxy_send_timeout 30s;
+    proxy_read_timeout 30s;
+    add_header Cache-Control "no-store" always;
+  }
+
+  location = /mcp {
+    proxy_pass http://backend:4000/mcp;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Authorization $http_authorization;
+    proxy_connect_timeout 5s;
+    proxy_send_timeout 120s;
+    proxy_read_timeout 120s;
+    add_header Cache-Control "no-store" always;
+  }
+
+  location /.well-known/ {
+    proxy_pass http://backend:4000/.well-known/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    add_header Cache-Control "no-store" always;
+  }
+
+  location /oauth/ {
+    proxy_pass http://backend:4000/oauth/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    add_header Cache-Control "no-store" always;
+  }
+
+  location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?)$ {
+    try_files $uri =404;
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+  }
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+}

docker/nginx.single.conf

@@ -0,0 +1,66 @@
+server {
+  listen 80;
+  server_name _;
+
+  root /usr/share/nginx/html;
+  index index.html;
+  client_max_body_size 1m;
+  add_header X-Content-Type-Options "nosniff" always;
+  add_header X-Frame-Options "DENY" always;
+  add_header Referrer-Policy "no-referrer" always;
+  add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+  add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'" always;
+
+  location /api/ {
+    proxy_pass http://127.0.0.1:4000/api/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_connect_timeout 5s;
+    proxy_send_timeout 30s;
+    proxy_read_timeout 30s;
+    add_header Cache-Control "no-store" always;
+  }
+
+  location = /mcp {
+    proxy_pass http://127.0.0.1:4000/mcp;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Authorization $http_authorization;
+    proxy_connect_timeout 5s;
+    proxy_send_timeout 120s;
+    proxy_read_timeout 120s;
+    add_header Cache-Control "no-store" always;
+  }
+
+  location /.well-known/ {
+    proxy_pass http://127.0.0.1:4000/.well-known/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    add_header Cache-Control "no-store" always;
+  }
+
+  location /oauth/ {
+    proxy_pass http://127.0.0.1:4000/oauth/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    add_header Cache-Control "no-store" always;
+  }
+
+  location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?)$ {
+    try_files $uri =404;
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+  }
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+}

docker/unraid/projectbrain-container.env.example

@@ -0,0 +1,65 @@
+PROJECTBRAIN_WEB_PORT=1209
+
+# Single-container app image settings.
+PROJECTBRAIN_IMAGE=projectbrain-unraid:latest
+PROJECTBRAIN_CONTAINER_NAME=projectbrain
+PROJECTBRAIN_DOCKER_NETWORK=auto
+PROJECTBRAIN_STOP_COMPOSE_APP_SERVICES=true
+PROJECTBRAIN_REMOVE_OLD_POSTGRES=true
+PROJECTBRAIN_APPDATA_PATH=/mnt/pool/appdata/projectbrain
+PROJECTBRAIN_DEPLOY_NO_CACHE=false
+PROJECTBRAIN_MIN_DOCKER_FREE_MB=2048
+PROJECTBRAIN_DOCKER_STORAGE_STRICT=false
+PROJECTBRAIN_BACKUP_DIR=/mnt/pool/appdata/projectbrain-backups
+PROJECTBRAIN_BACKUP_MAX_AGE_DAYS=2
+PROJECTBRAIN_REQUIRE_FRESH_BACKUP=false
+
+# Frontend is built for same-origin /api proxying inside the container.
+VITE_PROJECTBRAIN_CLIENT_MODE=real
+VITE_PROJECTBRAIN_API_URL=
+
+# Runtime backend settings.
+PROJECTBRAIN_DATA_SOURCE=database
+PROJECTBRAIN_SEED_ON_START=true
+LOG_LEVEL=info
+PROJECTBRAIN_USE_EXTERNAL_DATABASE=false
+PROJECTBRAIN_OWNER_USERNAME=owner
+PROJECTBRAIN_OWNER_PASSWORD=
+PROJECTBRAIN_AUTH_SECRET=
+PROJECTBRAIN_SESSION_TTL_HOURS=24
+PROJECTBRAIN_TRUST_PROXY=true
+PROJECTBRAIN_GITEA_URL=https://gitea.example.com
+PROJECTBRAIN_GITEA_TOKEN=
+PROJECTBRAIN_GITEA_WRITE_TOKEN=
+PROJECTBRAIN_GITEA_WEBHOOK_SECRET=
+PROJECTBRAIN_MCP_ENABLED=false
+PROJECTBRAIN_MCP_RATE_LIMIT_PER_MINUTE=1200
+PROJECTBRAIN_ANALYSIS_WORKER_PORT=4001
+PROJECTBRAIN_ANALYSIS_POLL_MS=1000
+PROJECTBRAIN_ANALYSIS_BATCH_SIZE=5
+PROJECTBRAIN_ANALYSIS_REPOSITORY_CONCURRENCY=2
+PROJECTBRAIN_ANALYSIS_JOB_TIMEOUT_SECONDS=1800
+PROJECTBRAIN_ANALYSIS_STALE_SECONDS=300
+PROJECTBRAIN_ANALYSIS_SCHEDULE_MINUTES=1440
+PROJECTBRAIN_AUTO_ONBOARD_REPOSITORIES=true
+PROJECTBRAIN_REPOSITORY_RECONCILE_SECONDS=60
+PROJECTBRAIN_AUTONOMY_EXECUTOR_STALE_SECONDS=5400
+PROJECTBRAIN_API_HEAP_MB=512
+PROJECTBRAIN_ANALYSIS_WORKER_HEAP_MB=384
+PROJECTBRAIN_MEMORY_LIMIT=1536m
+PROJECTBRAIN_MEMORY_RESERVATION=1024m
+PROJECTBRAIN_CPU_LIMIT=2.0
+PROJECTBRAIN_PIDS_LIMIT=256
+PROJECTBRAIN_HUB_SERVICE_TOKEN=
+PROJECTBRAIN_PUBLIC_URL=https://projectbrain.example.com
+
+# Optional Microsoft Entra ID login. Register this exact Web redirect URI:
+# https://projectbrain.example.com/api/auth/entra/callback
+PROJECTBRAIN_ENTRA_TENANT_ID=
+PROJECTBRAIN_ENTRA_CLIENT_ID=
+PROJECTBRAIN_ENTRA_CLIENT_SECRET=
+
+# Embedded PostgreSQL settings inside the single ProjectBrain container.
+POSTGRES_DB=projectbrain
+POSTGRES_USER=projectbrain
+POSTGRES_PASSWORD=

docker/unraid/projectbrain.env.example

@@ -0,0 +1,37 @@
+# ProjectBrain Unraid compose template
+# Copy this file to /mnt/pool/appdata/brain/.env and edit values in Unraid or over SSH.
+
+# Web UI host port. Change this when another container already uses 1209.
+PROJECTBRAIN_WEB_PORT=1209
+
+# Frontend build-time API settings.
+# Keep API URL empty for same-origin nginx /api proxying.
+VITE_PROJECTBRAIN_CLIENT_MODE=real
+VITE_PROJECTBRAIN_API_URL=
+
+# Backend runtime mode.
+PROJECTBRAIN_DATA_SOURCE=database
+PROJECTBRAIN_SEED_ON_START=true
+LOG_LEVEL=info
+
+# Postgres settings used by the integrated postgres service.
+POSTGRES_DB=projectbrain
+POSTGRES_USER=projectbrain
+POSTGRES_PASSWORD=projectbrain
+
+# Internal Docker network database URL.
+# Only change this if you also change the postgres service name or credentials.
+DATABASE_URL=postgresql://projectbrain:projectbrain@postgres:5432/projectbrain?schema=public
+
+# Portfolio and ChatGPT MCP integration.
+PROJECTBRAIN_GITEA_URL=https://gitea.example.com
+PROJECTBRAIN_GITEA_TOKEN=
+PROJECTBRAIN_GITEA_WRITE_TOKEN=
+PROJECTBRAIN_GITEA_WEBHOOK_SECRET=
+PROJECTBRAIN_MCP_ENABLED=false
+PROJECTBRAIN_MCP_RATE_LIMIT_PER_MINUTE=1200
+PROJECTBRAIN_PUBLIC_URL=https://projectbrain.example.com
+PROJECTBRAIN_AUTO_ONBOARD_REPOSITORIES=true
+PROJECTBRAIN_REPOSITORY_RECONCILE_SECONDS=60
+PROJECTBRAIN_AUTONOMY_EXECUTOR_STALE_SECONDS=5400
+PROJECTBRAIN_ANALYSIS_SCHEDULE_MINUTES=1440