Assistant/docker-compose.override.example.yml at master · bearlike/Assistant · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
# Local overrides — copy to docker-compose.override.yml (auto-loaded by Compose).
#
# Post-init scripts: docker/init.d/*.sh run at container startup before the API.
# You do NOT need to mount them here — docker-compose.yml already bind-mounts the
# whole directory read-only for both api and mcp, because the images bake none of
# it. Add a local-only script (an internal CA trust script, extra tooling) by
# dropping the file into docker/init.d and restarting; the mount picks it up with
# no rebuild and no edit to this file.
#
# Project directories: mount at identical paths so configs/app.json works as-is.
services:
  api:
    volumes:
      - /home/you/Projects/my-project:/home/you/Projects/my-project
      - /home/you/Projects/another-repo:/home/you/Projects/another-repo

  # Web IDE workspace roots: the mewbo-ide broker (the only service holding
  # /var/run/docker.sock) refuses to start unless MEWBO_IDE_ALLOWED_ROOTS is
  # set, and it can only validate a workspace path it can itself see. Mount
  # every root you list there, read-only, at the SAME path as on the host —
  # the broker realpath-resolves the requested path in its own mount
  # namespace to catch a symlink escape, so an unmounted root always 403s
  # even though the string is allowlisted. Set
  # MEWBO_IDE_ALLOWED_ROOTS=/home/you/Projects/my-project:/home/you/Projects/another-repo
  # in .env to match.
  mewbo-ide:
    volumes:
      - /home/you/Projects/my-project:/home/you/Projects/my-project:ro
      - /home/you/Projects/another-repo:/home/you/Projects/another-repo:ro

  # Uncomment and adjust if an upstream edge proxy / L7 gateway on a
  # different host on your LAN needs to forward requests to /ide/ at
  # this machine. The default in docker-compose.yml binds loopback-only
  # (safe). Use ``!override`` so this list replaces the default instead
  # of merging with it.
  #
  # ide-proxy:
  #   ports: !override
  #     - "0.0.0.0:5126:8080"         # all interfaces, or:
  #     - "192.168.1.10:5126:8080"    # a specific LAN IP

  # Web IDE on a bridge-networked API: the base compose runs the api with
  # network_mode: host, where it reaches the ide-proxy AND the mewbo-ide
  # broker on loopback (web_ide.proxy_url = http://127.0.0.1:5126,
  # MEWBO_IDE_BROKER_URL = http://127.0.0.1:5128). If you instead drop host
  # networking here (e.g. to get LAN-accessible DNAT or to join other
  # compose networks), the api can no longer reach either loopback address —
  # fix both the same way, by DNS name instead of by port:
  #   - The broker sits on this project's `default` network already (same as
  #     mongo), so joining `default` below is enough to reach it at
  #     MEWBO_IDE_BROKER_URL=http://mewbo-ide:5128.
  #   - The ide-proxy sits on the separate `mewbo-ide` bridge network, so
  #     that one needs an explicit join too, and its probe URL moves into
  #     app.json: agent.web_ide.proxy_url = "http://mewbo-ide-proxy:8080".
  # Skip either fix and its readiness probe silently fails — the IDE loader
  # times out waiting for a container that never gets marked ready.
  #
  # api:
  #   network_mode: !reset null
  #   networks:
  #     - default            # <-- reach the mewbo-ide broker by DNS name
  #     - mewbo-ide           # <-- reach the ide-proxy by DNS name
  #     # ...your other networks
  #   environment:
  #     - MEWBO_IDE_BROKER_URL=http://mewbo-ide:5128

  # mewbo-mcp uses network_mode: host so it binds 0.0.0.0 inside the host
  # network by default (MEWBO_MCP_HOST=0.0.0.0 in docker-compose.yml).
  # If you need to restrict the bind to loopback or a specific interface,
  # override the environment here:
  #
  # mewbo-mcp:
  #   environment:
  #     - MEWBO_MCP_HOST=127.0.0.1   # loopback-only
  #     - MEWBO_MCP_PORT=5127