APIARY/llm-worker/docker-compose.yml at main · Xore/APIARY · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Safe #66 deployment: synthetic checks only, on an internal Docker network
# with no route to Elasticsearch, Ollama, captured payloads, or the Internet.
#
#   docker compose -f llm-worker/docker-compose.yml up -d --build
#
# #83 owns use of docker-compose.captured-data.yml and the explicit canary
# authorization. Do not fold those mounts/networks into this base file.
#
# #1502: migrated into arcane/home/ for Arcane directory-aware Git sync.
# Already self-contained; only the explicit name: below and the file's own
# relocation/rename to compose.yml were needed.
#
# #2234: if you started this with bare docker-compose.yml and it refuses to
# come up (or comes up and exits within seconds, unhealthy), you needed
# docker-compose.captured-data-deploy.yml instead. That file `include`s this
# one plus docker-compose.captured-data.yml, which sets ES_HOST and adds the
# llm-data/llm-backend networks -- without them, the worker cannot resolve
# or reach elasticsearch. ES_HOST is forced empty below on purpose: it is
# the compose-level signal worker.py's compose_route_preflight() checks, so
# a bare bring-up refuses to start named and fast even when a shared .env
# already carries production captured-data flags.

name: llm-worker

services:
  llm-worker:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: hp-llm-worker
    restart: unless-stopped
    env_file:
      - path: .env
        required: false
    environment:
      LLM_ENABLED: '${LLM_ENABLED:-false}'
      LLM_DRY_RUN: '${LLM_DRY_RUN:-true}'
      LLM_ALLOW_CAPTURED_DATA: '${LLM_ALLOW_CAPTURED_DATA:-false}'
      # #2234: deliberately not ${ES_HOST:-...} -- forced empty regardless
      # of .env, so this is the safe default even when a shared .env
      # already carries production captured-data flags. Only the captured-
      # data/canary overlays set a real value, alongside the networks that
      # make it reachable; worker.py's compose_route_preflight() refuses to
      # start captured-data mode when it finds this still empty.
      ES_HOST: ''
      LLM_SESSION_ENABLED: '${LLM_SESSION_ENABLED:-false}'
      LLM_PAYLOAD_ENABLED: '${LLM_PAYLOAD_ENABLED:-false}'
      LLM_DAILY_REPORT_ENABLED: '${LLM_DAILY_REPORT_ENABLED:-false}'
      LLM_MODEL: '${LLM_MODEL:-qwen3:14b}'
      LLM_EXPECTED_MODEL_DIGEST: '${LLM_EXPECTED_MODEL_DIGEST:-}'
      # #151: off by default, same shape as every other captured-data gate
      # above -- validate_mode() also requires LLM_EMBEDDING_EXPECTED_DIGEST
      # once this is turned on outside dry-run.
      LLM_EMBEDDING_ENABLED: '${LLM_EMBEDDING_ENABLED:-false}'
      LLM_EMBEDDING_MODEL: '${LLM_EMBEDDING_MODEL:-nomic-embed-text:latest}'
      LLM_EMBEDDING_EXPECTED_DIGEST: '${LLM_EMBEDDING_EXPECTED_DIGEST:-}'
      LLM_CONTEXT_LENGTH: '${LLM_CONTEXT_LENGTH:-8192}'
      LLM_OUTPUT_TOKENS: '${LLM_OUTPUT_TOKENS:-512}'
      LLM_KEEP_ALIVE: '${LLM_KEEP_ALIVE:-10m}'
      POLL_INTERVAL: '${POLL_INTERVAL:-60}'
      MAX_CONTENT_CHARS: '${MAX_CONTENT_CHARS:-12000}'
      MAX_PAYLOAD_BYTES: '${MAX_PAYLOAD_BYTES:-1048576}'
      MAX_EVENTS_PER_CYCLE: '${MAX_EVENTS_PER_CYCLE:-2000}'
      MAX_JOBS_PER_CYCLE: '${MAX_JOBS_PER_CYCLE:-20}'
      MAX_PAYLOAD_SCAN_FILES: '${MAX_PAYLOAD_SCAN_FILES:-5000}'
      MAX_PAYLOAD_SCAN_BYTES: '${MAX_PAYLOAD_SCAN_BYTES:-67108864}'
      SESSION_IDLE_SECONDS: '${SESSION_IDLE_SECONDS:-300}'
      SESSION_LOOKBACK_SECONDS: '${SESSION_LOOKBACK_SECONDS:-3600}'
      DAILY_REPORT_HOUR: '${DAILY_REPORT_HOUR:-6}'
      LOG_LEVEL: '${LOG_LEVEL:-INFO}'
    networks:
      - synthetic-only
    security_opt:
      - no-new-privileges:true
    cap_drop: [ALL]
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=16m,uid=10001,gid=10001,mode=0700
    healthcheck:
      test: ['CMD', 'python', 'worker.py', '--healthcheck']
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    labels:
      - autoheal=true
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1g
          pids: 128

networks:
  synthetic-only:
    internal: true