docker-compose.yml

services:
  ollama:
    image: ollama/ollama
    volumes:
      - ollama_data:/root/.ollama
    # No host port published: the backend reaches Ollama in-network at
    # http://ollama:11434. Publishing 11434 clashes with a native Ollama on the host.
    healthcheck:
      test: ["CMD", "ollama", "list"]
      interval: 10s
      timeout: 5s
      retries: 5

  backend:
    build:
      context: .
      dockerfile: Dockerfile.backend
    environment:
      OLLAMA_MODEL: ${OLLAMA_MODEL:-llama3.2}
      OLLAMA_BASE_URL: http://ollama:11434
      CORS_ORIGINS: http://localhost:8080
      # OIDC / Keycloak BFF — Keycloak runs in the separate keycloak/ stack and
      # is reached over the shared `keycloak-shared` network at keycloak:8080.
      OIDC_DISCOVERY_URL: http://keycloak:8080/realms/findocs/.well-known/openid-configuration
      OIDC_CLIENT_ID: findocs-bff
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-dev-secret-change-me}
      # Service-account client voor gebruikersbeheer (Keycloak Admin API).
      OIDC_ADMIN_CLIENT_ID: findocs-admin
      OIDC_ADMIN_CLIENT_SECRET: ${OIDC_ADMIN_CLIENT_SECRET:-dev-admin-secret-change-me}
      OIDC_REDIRECT_URI: http://localhost:8080/api/auth/callback
      OIDC_POST_LOGIN_REDIRECT: http://localhost:8080/
      OIDC_POST_LOGOUT_REDIRECT: http://localhost:8080/
      SESSION_SECRET: ${SESSION_SECRET:-dev-session-secret-change-me-please}
      # Persistent data (LanceDB chunks + document/image/dossier stores) —
      # mirrors the /data Azure Files mount in production.
      LANCEDB_PATH: /data/lancedb
      DOCS_PATH: /data/docs
      IMAGES_PATH: /data/images
      DOSSIERS_PATH: /data/dossiers
    volumes:
      - backend_data:/data
    depends_on:
      ollama:
        condition: service_healthy
    networks:
      - default
      - keycloak

  frontend:
    build:
      context: .
      dockerfile: Dockerfile.frontend
    environment:
      BACKEND_URL: http://backend:8000
    ports:
      - "8080:80"
    depends_on:
      - backend

volumes:
  ollama_data:
  backend_data:

networks:
  default:
  # Created by the keycloak/ stack; start that first (docker compose up there).
  keycloak:
    name: keycloak-shared
    external: true