docker-compose.yml

# =============================================================================
# Docker Compose - AI Portfolio Application
# =============================================================================
# Development and Production-ready configuration
# =============================================================================

services:
  # ===========================================================================
  # Backend Service (FastAPI)
  # ===========================================================================
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
      args:
        # Set USE_DOCLING=true for advanced PDF processing with Docling (default)
        # Set USE_DOCLING=false for faster builds (uses PyPDF fallback)
        - USE_DOCLING=${USE_DOCLING:-true}
    container_name: portfolio-backend
    restart: unless-stopped
    ports:
      - "8000:8000"
    environment:
      # Application Settings
      - APP_NAME=${APP_NAME:-AI Portfolio Backend}
      - APP_VERSION=${APP_VERSION:-1.0.0}
      - DEBUG=${DEBUG:-false}

      # Server Settings
      - HOST=0.0.0.0
      - PORT=8000

      # CORS Settings (comma-separated)
      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:3000,http://localhost:3001}

      # Ollama LLM Settings
      - OLLAMA_BASE_URL=${OLLAMA_BASE_URL:-http://ollama:11434}
      - OLLAMA_MODEL=${OLLAMA_MODEL:-llama3.2:3b}

      # ChromaDB Settings
      - CHROMA_PERSIST_DIR=/app/data/chroma_db
      - CHROMA_COLLECTION_NAME=${CHROMA_COLLECTION_NAME:-portfolio_docs}

      # Document Processing
      - UPLOAD_DIR=/app/data/documents
      - MAX_FILE_SIZE_MB=${MAX_FILE_SIZE_MB:-10}
      - ALLOWED_EXTENSIONS=${ALLOWED_EXTENSIONS:-.pdf,.md,.txt,.docx}
      - USE_DOCLING=${USE_DOCLING:-true}

      # RAG Settings
      - CHUNK_SIZE=${CHUNK_SIZE:-500}
      - CHUNK_OVERLAP=${CHUNK_OVERLAP:-50}
      - TOP_K_RESULTS=${TOP_K_RESULTS:-3}

      # Embedding Model (Ollama embedding model)
      - EMBEDDING_MODEL=${EMBEDDING_MODEL:-nomic-embed-text}

      # Security (REQUIRED - set in .env file)
      - ADMIN_API_KEY=${ADMIN_API_KEY}

      # Langfuse Observability (Optional)
      - LANGFUSE_PUBLIC_KEY=${LANGFUSE_PUBLIC_KEY:-}
      - LANGFUSE_SECRET_KEY=${LANGFUSE_SECRET_KEY:-}
      - LANGFUSE_HOST=${LANGFUSE_HOST:-http://langfuse:3000}
      - LANGFUSE_ENABLED=${LANGFUSE_ENABLED:-false}

      # Database
      - DATABASE_URL=postgresql+asyncpg://portfolio:portfolio_secret@postgres:5432/portfolio
      
      # Celery
      - CELERY_BROKER_URL=redis://redis:6379/0
      - CELERY_RESULT_BACKEND=redis://redis:6379/0

    volumes:
      # Persist ChromaDB data
      - chroma_data:/app/data/chroma_db
      # Persist uploaded documents
      - documents_data:/app/data/documents
      # Persist logs
      - backend_logs:/app/logs
    networks:
      - portfolio-network
    depends_on:
      ollama-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # ===========================================================================
  # Frontend Service (Next.js)
  # ===========================================================================
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        # Client-side API URL (browser -> backend)
        - NEXT_PUBLIC_API_URL=http://localhost:8000
    container_name: portfolio-frontend
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      # Admin API Key (for frontend admin operations)
      - NEXT_PUBLIC_ADMIN_API_KEY=${ADMIN_API_KEY}
      # Server-side API URL (container -> backend container)
      # This is used for server-side rendering/fetching
      - INTERNAL_API_URL=http://backend:8000
    networks:
      - portfolio-network
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # ===========================================================================
  # Ollama Service (Local LLM)
  # ===========================================================================
  ollama:
    image: ollama/ollama:latest
    container_name: portfolio-ollama
    restart: unless-stopped
    ports:
      - "11434:11434"
    volumes:
      # Persist Ollama models
      - ollama_data:/root/.ollama
    networks:
      - portfolio-network
    healthcheck:
      test: ["CMD-SHELL", "ollama list || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    # Optional: Set resource limits
    deploy:
      resources:
        limits:
          memory: 8G
        reservations:
          memory: 4G

  # ===========================================================================
  # Ollama Model Initialization (Pulls required models)
  # ===========================================================================
  # This init container ensures all required Ollama models are pulled before
  # the backend starts. It runs once and exits successfully.
  # ===========================================================================
  ollama-init:
    image: curlimages/curl:latest
    container_name: portfolio-ollama-init
    depends_on:
      ollama:
        condition: service_healthy
    networks:
      - portfolio-network
    environment:
      - OLLAMA_HOST=ollama:11434
      - LLM_MODEL=${OLLAMA_MODEL:-llama3.2:3b}
      - EMBEDDING_MODEL=${EMBEDDING_MODEL:-nomic-embed-text}
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        echo "=== Ollama Model Initialization ==="
        echo "Waiting for Ollama to be ready..."

        # Wait for Ollama API
        until curl -sf http://$$OLLAMA_HOST/api/tags > /dev/null 2>&1; do
          echo "Waiting for Ollama..."
          sleep 2
        done
        echo "Ollama is ready!"

        # Function to pull model if not exists
        pull_model() {
          MODEL=$$1
          echo "Checking model: $$MODEL"

          # Check if model exists
          if curl -sf http://$$OLLAMA_HOST/api/tags | grep -q "\"name\":\"$$MODEL\""; then
            echo "Model $$MODEL already exists, skipping pull"
          else
            echo "Pulling model: $$MODEL (this may take a while)..."
            curl -X POST http://$$OLLAMA_HOST/api/pull -d "{\"name\": \"$$MODEL\"}" --no-buffer
            echo ""
            echo "Model $$MODEL pulled successfully!"
          fi
        }

        # Pull LLM model
        pull_model "$$LLM_MODEL"

        # Pull embedding model
        pull_model "$$EMBEDDING_MODEL"

        echo "=== All models ready! ==="
    restart: "no"

  # ===========================================================================
  # PostgreSQL Database (App Data)
  # ===========================================================================
  postgres:
    image: postgres:16-alpine
    container_name: portfolio-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: portfolio
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-portfolio_secret}
      POSTGRES_DB: portfolio
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - portfolio-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U portfolio"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ===========================================================================
  # Redis (Cache & Celery Broker)
  # ===========================================================================
  redis:
    image: redis:7-alpine
    container_name: portfolio-redis
    restart: unless-stopped
    volumes:
      - redis_data:/data
    networks:
      - portfolio-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ===========================================================================
  # Celery Worker (Async Tasks)
  # ===========================================================================
  celery-worker:
    build:
      context: ./backend
      dockerfile: Dockerfile
      args:
        - USE_DOCLING=${USE_DOCLING:-true}
    container_name: portfolio-worker
    command: celery -A app.tasks.celery_app worker --loglevel=info
    environment:
      - APP_NAME=${APP_NAME:-AI Portfolio Worker}
      - DATABASE_URL=postgresql+asyncpg://portfolio:portfolio_secret@postgres:5432/portfolio
      - CELERY_BROKER_URL=redis://redis:6379/0
      - CELERY_RESULT_BACKEND=redis://redis:6379/0
      - OLLAMA_BASE_URL=${OLLAMA_BASE_URL:-http://ollama:11434}
      - CHROMA_PERSIST_DIR=/app/data/chroma_db
      - CHROMA_COLLECTION_NAME=${CHROMA_COLLECTION_NAME:-portfolio_docs}
      - EMBEDDING_MODEL=${EMBEDDING_MODEL:-nomic-embed-text}
      - UPLOAD_DIR=/app/data/documents
      - USE_DOCLING=${USE_DOCLING:-true}
    depends_on:
      - redis
      - postgres
      - ollama
    volumes:
      - chroma_data:/app/data/chroma_db
      - documents_data:/app/data/documents
      - backend_logs:/app/logs
    networks:
      - portfolio-network

  # ===========================================================================
  # Flower (Celery Monitoring) - OPTIONAL
  # ===========================================================================
  flower:
    image: mher/flower:2.0
    container_name: portfolio-flower
    command: celery --broker=redis://redis:6379/0 flower --port=5555
    ports:
      - "5555:5555"
    depends_on:
      - redis
    networks:
      - portfolio-network

  # ===========================================================================
  # Langfuse Web Service (LLM Observability) - OPTIONAL
  # ===========================================================================
  # Self-hosted Langfuse V3 for LLM tracing and monitoring
  # Enable by setting LANGFUSE_ENABLED=true in .env
  # ===========================================================================
  langfuse:
    image: langfuse/langfuse:3
    container_name: portfolio-langfuse
    restart: unless-stopped
    ports:
      - "3001:3000"
    environment:
      # Database connections
      - DATABASE_URL=postgresql://langfuse:langfuse@langfuse-db:5432/langfuse
      - CLICKHOUSE_URL=http://langfuse-clickhouse:8123
      - CLICKHOUSE_MIGRATION_URL=clickhouse://langfuse-clickhouse:9000
      - CLICKHOUSE_USER=clickhouse
      - CLICKHOUSE_PASSWORD=clickhouse
      - CLICKHOUSE_CLUSTER_ENABLED=false
      # Redis for caching
      - REDIS_HOST=langfuse-redis
      - REDIS_PORT=6379
      # Authentication
      - NEXTAUTH_SECRET=${LANGFUSE_NEXTAUTH_SECRET:-your-nextauth-secret-min-32-chars}
      - SALT=${LANGFUSE_SALT:-your-salt-min-32-chars}
      - NEXTAUTH_URL=${LANGFUSE_NEXTAUTH_URL:-http://localhost:3001}
      - TELEMETRY_ENABLED=false
      # Encryption key for API keys (32 bytes hex = 64 chars)
      - ENCRYPTION_KEY=${LANGFUSE_ENCRYPTION_KEY:-0000000000000000000000000000000000000000000000000000000000000000}
      # S3/MinIO Blob Storage (required for V3)
      - LANGFUSE_S3_EVENT_UPLOAD_BUCKET=langfuse
      - LANGFUSE_S3_EVENT_UPLOAD_REGION=us-east-1
      - LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID=minio
      - LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=miniosecret
      - LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT=http://langfuse-minio:9000
      - LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE=true
    networks:
      - portfolio-network
    depends_on:
      langfuse-db:
        condition: service_healthy
      langfuse-clickhouse:
        condition: service_healthy
      langfuse-redis:
        condition: service_healthy
      langfuse-minio:
        condition: service_healthy
    profiles:
      - observability

  # ===========================================================================
  # Langfuse Worker Service - OPTIONAL (Required for Langfuse V3)
  # ===========================================================================
  langfuse-worker:
    image: langfuse/langfuse-worker:3
    container_name: portfolio-langfuse-worker
    restart: unless-stopped
    environment:
      # Database connections
      - DATABASE_URL=postgresql://langfuse:langfuse@langfuse-db:5432/langfuse
      - CLICKHOUSE_URL=http://langfuse-clickhouse:8123
      - CLICKHOUSE_USER=clickhouse
      - CLICKHOUSE_PASSWORD=clickhouse
      - CLICKHOUSE_CLUSTER_ENABLED=false
      # Redis for caching
      - REDIS_HOST=langfuse-redis
      - REDIS_PORT=6379
      # Authentication
      - SALT=${LANGFUSE_SALT:-your-salt-min-32-chars}
      - ENCRYPTION_KEY=${LANGFUSE_ENCRYPTION_KEY:-0000000000000000000000000000000000000000000000000000000000000000}
      # S3/MinIO Blob Storage
      - LANGFUSE_S3_EVENT_UPLOAD_BUCKET=langfuse
      - LANGFUSE_S3_EVENT_UPLOAD_REGION=us-east-1
      - LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID=minio
      - LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=miniosecret
      - LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT=http://langfuse-minio:9000
      - LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE=true
    networks:
      - portfolio-network
    depends_on:
      langfuse-db:
        condition: service_healthy
      langfuse-clickhouse:
        condition: service_healthy
      langfuse-redis:
        condition: service_healthy
      langfuse-minio:
        condition: service_healthy
    profiles:
      - observability

  # ===========================================================================
  # Langfuse PostgreSQL Database - OPTIONAL
  # ===========================================================================
  langfuse-db:
    image: postgres:15-alpine
    container_name: portfolio-langfuse-db
    restart: unless-stopped
    environment:
      - POSTGRES_USER=langfuse
      - POSTGRES_PASSWORD=langfuse
      - POSTGRES_DB=langfuse
    volumes:
      - langfuse_postgres_data:/var/lib/postgresql/data
    networks:
      - portfolio-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U langfuse"]
      interval: 10s
      timeout: 5s
      retries: 5
    profiles:
      - observability

  # ===========================================================================
  # Langfuse ClickHouse Database - OPTIONAL (Required for Langfuse V3)
  # ===========================================================================
  langfuse-clickhouse:
    image: clickhouse/clickhouse-server:24.3
    container_name: portfolio-langfuse-clickhouse
    restart: unless-stopped
    user: "101:101"
    environment:
      - CLICKHOUSE_DB=default
      - CLICKHOUSE_USER=clickhouse
      - CLICKHOUSE_PASSWORD=clickhouse
    volumes:
      - langfuse_clickhouse_data:/var/lib/clickhouse
      - langfuse_clickhouse_logs:/var/log/clickhouse-server
    networks:
      - portfolio-network
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8123/ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    profiles:
      - observability

  # ===========================================================================
  # Langfuse Redis Cache - OPTIONAL (Required for Langfuse V3)
  # ===========================================================================
  langfuse-redis:
    image: redis:7-alpine
    container_name: portfolio-langfuse-redis
    restart: unless-stopped
    command: redis-server --maxmemory-policy noeviction
    networks:
      - portfolio-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    profiles:
      - observability

  # ===========================================================================
  # Langfuse MinIO (S3-compatible storage) - OPTIONAL (Required for Langfuse V3)
  # ===========================================================================
  langfuse-minio:
    image: minio/minio
    container_name: portfolio-langfuse-minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      - MINIO_ROOT_USER=minio
      - MINIO_ROOT_PASSWORD=miniosecret
    volumes:
      - langfuse_minio_data:/data
    networks:
      - portfolio-network
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 5
    profiles:
      - observability

  # ===========================================================================
  # MinIO Bucket Initialization - Creates the langfuse bucket
  # ===========================================================================
  langfuse-minio-init:
    image: minio/mc
    container_name: portfolio-langfuse-minio-init
    depends_on:
      langfuse-minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set myminio http://langfuse-minio:9000 minio miniosecret;
      mc mb myminio/langfuse --ignore-existing;
      exit 0;
      "
    networks:
      - portfolio-network
    profiles:
      - observability

# =============================================================================
# Volumes (Data Persistence)
# =============================================================================
volumes:
  chroma_data:
    driver: local
  documents_data:
    driver: local
  backend_logs:
    driver: local
  ollama_data:
    driver: local
  postgres_data:
    driver: local
  redis_data:
    driver: local
  langfuse_postgres_data:
    driver: local
  langfuse_clickhouse_data:
    driver: local
  langfuse_clickhouse_logs:
    driver: local
  langfuse_minio_data:
    driver: local

# =============================================================================
# Networks
# =============================================================================
networks:
  portfolio-network:
    driver: bridge