docker-compose.yml

# =============================================================================
# agent-wise — Wiseway Staff Assistant PoC
# =============================================================================
# Local-dev stack. Runs out of the box against the bundled sample documents and
# a simple demo login, so the integrating team can see the whole workflow
# end-to-end before wiring in Wiseway's real systems.
#
# Services:
#   librechat          host :3080  — the chat UI + API (forked LibreChat)
#   mongodb                        — Mongo 8, LibreChat's datastore
#   wiseway-doc-search host :8000  — role-scoped document-search tool (MCP) — the access gate
#
# The local AI model (Ollama) runs NATIVELY on the host, NOT in Docker, and is
# reached at http://host.docker.internal:11434/v1/. See README.md.
#
# AUTH (DEMO): a simple User/Admin password box (deploy/wiseway-assets/
# wiseway-role-ui.js) replaces real SSO so anyone can try the demo. *** This is
# NOT real security — replace it with Wiseway SSO before any real data. ***
# INTEGRATE: re-point LibreChat at Wiseway's OIDC and remove the demo gate —
# see docs/INTEGRATION.md §1.
#
# >>> INTEGRATION TOUCH POINTS are flagged with "INTEGRATE:" comments below and
#     documented in full in docs/INTEGRATION.md. <<<
#
# First run:
#   1. cp deploy/.env.example deploy/.env   (then fill the REPLACE_ME secrets)
#   2. add to /etc/hosts:  127.0.0.1 host.docker.internal
#   3. ollama serve  &&  ollama pull qwen2.5:7b
#   4. docker compose up -d
#   5. ./deploy/create-accounts.sh          (creates the user/admin demo logins)
#   6. ./deploy/create-agent.sh             (seeds + pins the default "SOP" agent)
#   7. ./deploy/build-role-ui-index.sh      (only if the login box doesn't show —
#                                            regenerates index.html for the pulled image)
# =============================================================================

services:
  librechat:
    image: registry.librechat.ai/danny-avila/librechat-dev:latest
    container_name: wiseway-librechat
    restart: unless-stopped
    ports:
      - "3080:3080"
    env_file:
      - ./deploy/.env
    environment:
      - HOST=0.0.0.0
      - PORT=3080
      - CONFIG_PATH=/app/librechat.yaml
    volumes:
      # Wiseway runtime config (branding, model endpoint, MCP doc-search server).
      - ./deploy/librechat.yaml:/app/librechat.yaml
      # Brand assets — overlaid onto LibreChat's built client at /app/client/dist/assets.
      - ./deploy/wiseway-assets/logo.svg:/app/client/dist/assets/logo.svg:ro
      - ./deploy/wiseway-assets/favicon.svg:/app/client/dist/assets/favicon.svg:ro
      - ./deploy/wiseway-assets/favicon-16x16.png:/app/client/dist/assets/favicon-16x16.png:ro
      - ./deploy/wiseway-assets/favicon-32x32.png:/app/client/dist/assets/favicon-32x32.png:ro
      - ./deploy/wiseway-assets/apple-touch-icon-180x180.png:/app/client/dist/assets/apple-touch-icon-180x180.png:ro
      - ./deploy/wiseway-assets/icon-192x192.png:/app/client/dist/assets/icon-192x192.png:ro
      - ./deploy/wiseway-assets/maskable-icon.png:/app/client/dist/assets/maskable-icon.png:ro
      # Demo login gate + role-scoped UI (presentation only). The generated
      # index.html injects the css/js. NOTE: after any change to these three
      # files you MUST `docker compose up -d --force-recreate librechat` — the
      # macOS bind mount pins the inode, so an in-place edit won't propagate.
      - ./deploy/wiseway-assets/index.html:/app/client/dist/index.html:ro
      - ./deploy/wiseway-assets/wiseway-role-ui.css:/app/client/dist/assets/wiseway-role-ui.css:ro
      - ./deploy/wiseway-assets/wiseway-role-ui.js:/app/client/dist/assets/wiseway-role-ui.js:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      - mongodb
      - wiseway-doc-search
    networks:
      - wiseway

  mongodb:
    image: mongo:8.0.20
    container_name: wiseway-mongodb
    restart: unless-stopped
    command: mongod --quiet --logpath /dev/null
    volumes:
      - mongo-data:/data/db
    networks:
      - wiseway

  wiseway-doc-search:
    build:
      context: ./mcp-doc-search
    container_name: wiseway-doc-search
    restart: unless-stopped
    ports:
      - "8000:8000"
    # Graph creds (TENANT_ID, GRAPH_CLIENT_ID, GRAPH_CLIENT_SECRET, SHAREPOINT_*)
    # + WISEWAY_MCP_SHARED_SECRET come from deploy/.env.
    env_file:
      - ./deploy/.env
    environment:
      # "local" = bundled sample-docs (runs with no SharePoint creds — default).
      # INTEGRATE: set to "graph" to read real SharePoint via the Entra machine
      # login (needs the Entra app + per-site grant — see docs/INTEGRATION.md §3).
      - WISEWAY_DOC_BACKEND=local
      # Pin the port (deploy/.env carries PORT=3080 for LibreChat; must not leak here).
      - PORT=8000
      # graph backend only: Microsoft Search API region (REQUIRED for app-only
      # /search/query). Set to your tenant's region (e.g. AUS, NAM, EUR).
      - GRAPH_SEARCH_REGION=AUS
    volumes:
      - ./sample-docs:/app/sample-docs:ro
    networks:
      - wiseway

  # Admin feedback dashboard — read-only view over the 👍/👎 + reason tags staff
  # leave on assistant answers (LibreChat writes these onto message docs in
  # Mongo and ships no admin view). Reads the same Mongo; never writes feedback.
  # Empty DB => empty dashboard. Local demo data: ./deploy/seed-feedback.local.sh
  # (gitignored — stays on the dev machine; a real deploy starts empty).
  # SECURITY (PoC): no auth — gate behind admin SSO / internal-only network
  # before real data. INTEGRATE: see docs/INTEGRATION.md.
  wiseway-feedback-dash:
    build:
      context: ./feedback-dash
    container_name: wiseway-feedback-dash
    restart: unless-stopped
    ports:
      - "8050:8050"
    environment:
      - PORT=8050
      - MONGO_URI=mongodb://mongodb:27017/LibreChat
    depends_on:
      - mongodb
    networks:
      - wiseway

networks:
  wiseway:
    driver: bridge

volumes:
  mongo-data: