compose: stack profile — one-command standalone deployment (A5) #1485
+8
-156
@@ -1,156 +1,8 @@
|
|||||||
# ─────────────────────────────────────────────────────────────────────────────
|
# Mosaic Stack standalone deployment (compose `stack` profile)
|
||||||
# Mosaic — Environment Variables Reference
|
# Copy to .env and adjust. Port overrides exist because the defaults
|
||||||
# Copy this file to .env and fill in the values for your deployment.
|
# collide with common host services (and with the dev compose itself).
|
||||||
# Lines beginning with # are comments; optional vars are commented out.
|
PG_HOST_PORT=5433
|
||||||
# ─────────────────────────────────────────────────────────────────────────────
|
VALKEY_HOST_PORT=6380
|
||||||
|
GATEWAY_HOST_PORT=14242
|
||||||
|
# Registry image override (defaults to a local build of docker/gateway.Dockerfile):
|
||||||
# ─── Database (PostgreSQL 17 + pgvector) ─────────────────────────────────────
|
# GATEWAY_IMAGE=git.mosaicstack.dev/mosaicstack/stack/gateway:sha-acf640d
|
||||||
# Full connection string used by the gateway, ORM, and migration runner.
|
|
||||||
# Port 5433 avoids conflict with a host-side PostgreSQL instance.
|
|
||||||
DATABASE_URL=postgresql://mosaic:mosaic@localhost:5433/mosaic
|
|
||||||
|
|
||||||
# Docker Compose host-port override for the PostgreSQL container (default: 5433)
|
|
||||||
# PG_HOST_PORT=5433
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Queue (Valkey 8 / Redis-compatible) ─────────────────────────────────────
|
|
||||||
# Port 6380 avoids conflict with a host-side Redis/Valkey instance.
|
|
||||||
VALKEY_URL=redis://localhost:6380
|
|
||||||
|
|
||||||
# Docker Compose host-port override for the Valkey container (default: 6380)
|
|
||||||
# VALKEY_HOST_PORT=6380
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Gateway ─────────────────────────────────────────────────────────────────
|
|
||||||
# TCP port the NestJS/Fastify gateway listens on (default: 14242)
|
|
||||||
GATEWAY_PORT=14242
|
|
||||||
|
|
||||||
# Comma-separated list of allowed CORS origins.
|
|
||||||
# Must include the web app origin in production.
|
|
||||||
GATEWAY_CORS_ORIGIN=http://localhost:3000
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Auth (BetterAuth) ───────────────────────────────────────────────────────
|
|
||||||
# REQUIRED — random secret used to sign sessions and tokens.
|
|
||||||
# Generate with: openssl rand -base64 32
|
|
||||||
BETTER_AUTH_SECRET=change-me-to-a-random-32-char-string
|
|
||||||
|
|
||||||
# Public base URL of the gateway (used by BetterAuth for callback URLs)
|
|
||||||
BETTER_AUTH_URL=http://localhost:14242
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Web App (SPA) ───────────────────────────────────────────────────────────
|
|
||||||
# Directory holding the built SPA bundle (vite build output). When set, the
|
|
||||||
# gateway serves the SPA same-origin; when unset (dev), run the Vite dev
|
|
||||||
# server (pnpm --filter @mosaicstack/web dev), which proxies to the gateway.
|
|
||||||
# safe-default: unset in dev — SPA serving is an opt-in production concern
|
|
||||||
#WEB_DIST_DIR=apps/web/dist
|
|
||||||
|
|
||||||
|
|
||||||
# ─── OpenTelemetry ───────────────────────────────────────────────────────────
|
|
||||||
# OTLP HTTP endpoint (otel-collector or any OpenTelemetry-compatible backend)
|
|
||||||
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
|
|
||||||
|
|
||||||
# Service name shown in traces
|
|
||||||
OTEL_SERVICE_NAME=mosaic-gateway
|
|
||||||
|
|
||||||
|
|
||||||
# ─── AI Providers ────────────────────────────────────────────────────────────
|
|
||||||
|
|
||||||
# Ollama (local models — set OLLAMA_BASE_URL to enable)
|
|
||||||
# OLLAMA_BASE_URL=http://localhost:11434
|
|
||||||
# OLLAMA_HOST is a legacy alias for OLLAMA_BASE_URL
|
|
||||||
# OLLAMA_HOST=http://localhost:11434
|
|
||||||
# Comma-separated list of Ollama model IDs to register (default: llama3.2,codellama,mistral)
|
|
||||||
# OLLAMA_MODELS=llama3.2,codellama,mistral
|
|
||||||
|
|
||||||
# Anthropic (claude-sonnet-4-6, claude-opus-4-6, claude-haiku-4-5)
|
|
||||||
# ANTHROPIC_API_KEY=sk-ant-...
|
|
||||||
|
|
||||||
# OpenAI (gpt-4o, gpt-4o-mini, o3-mini)
|
|
||||||
# OPENAI_API_KEY=sk-...
|
|
||||||
|
|
||||||
# Z.ai / GLM (glm-4.5, glm-4.5-air, glm-4.5-flash)
|
|
||||||
# ZAI_API_KEY=...
|
|
||||||
|
|
||||||
# Custom providers — JSON array of provider configs
|
|
||||||
# Format: [{"id":"<id>","baseUrl":"<url>","apiKey":"<key>","models":[{"id":"<model-id>","name":"<label>"}]}]
|
|
||||||
# MOSAIC_CUSTOM_PROVIDERS=
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Embedding Service ───────────────────────────────────────────────────────
|
|
||||||
# OpenAI-compatible embeddings endpoint (default: OpenAI)
|
|
||||||
# EMBEDDING_API_URL=https://api.openai.com/v1
|
|
||||||
# EMBEDDING_MODEL=text-embedding-3-small
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Log Summarization Service ───────────────────────────────────────────────
|
|
||||||
# OpenAI-compatible chat completions endpoint for log summarization (default: OpenAI)
|
|
||||||
# SUMMARIZATION_API_URL=https://api.openai.com/v1
|
|
||||||
# SUMMARIZATION_MODEL=gpt-4o-mini
|
|
||||||
|
|
||||||
# Cron schedule for summarization job (default: every 6 hours)
|
|
||||||
# SUMMARIZATION_CRON=0 */6 * * *
|
|
||||||
|
|
||||||
# Cron schedule for log tier management (default: daily at 03:00)
|
|
||||||
# TIER_MANAGEMENT_CRON=0 3 * * *
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Agent ───────────────────────────────────────────────────────────────────
|
|
||||||
# Filesystem sandbox root for agent file tools (default: process.cwd())
|
|
||||||
# AGENT_FILE_SANDBOX_DIR=/var/lib/mosaic/sandbox
|
|
||||||
|
|
||||||
# Comma-separated list of tool names available to non-admin users.
|
|
||||||
# Leave unset to allow all tools for all authenticated users.
|
|
||||||
# AGENT_USER_TOOLS=read_file,list_directory,search_files
|
|
||||||
|
|
||||||
# System prompt injected into every agent session (optional)
|
|
||||||
# AGENT_SYSTEM_PROMPT=You are a helpful assistant.
|
|
||||||
|
|
||||||
|
|
||||||
# ─── MCP Servers ─────────────────────────────────────────────────────────────
|
|
||||||
# JSON array of MCP server configs — set to enable MCP tool integration.
|
|
||||||
# Each entry: {"name":"<id>","url":"<http-or-sse-url>"}
|
|
||||||
# MCP_SERVERS=[{"name":"my-mcp","url":"http://localhost:3100/sse"}]
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Coordinator ─────────────────────────────────────────────────────────────
|
|
||||||
# Root directory used to scope coordinator (worktree/repo) operations.
|
|
||||||
# Defaults to the monorepo root auto-detected from process.cwd().
|
|
||||||
# MOSAIC_WORKSPACE_ROOT=/home/user/projects/mosaic
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Discord Plugin (optional — set DISCORD_BOT_TOKEN to enable) ─────────────
|
|
||||||
# DISCORD_BOT_TOKEN=
|
|
||||||
# DISCORD_GUILD_ID=
|
|
||||||
# DISCORD_GATEWAY_URL=http://localhost:14242
|
|
||||||
|
|
||||||
|
|
||||||
# ─── Telegram Plugin (optional — set TELEGRAM_BOT_TOKEN to enable) ───────────
|
|
||||||
# TELEGRAM_BOT_TOKEN=
|
|
||||||
# TELEGRAM_GATEWAY_URL=http://localhost:14242
|
|
||||||
|
|
||||||
|
|
||||||
# ─── SSO Providers (add credentials to enable) ───────────────────────────────
|
|
||||||
|
|
||||||
# --- Authentik (optional — set AUTHENTIK_CLIENT_ID to enable) ---
|
|
||||||
# AUTHENTIK_ISSUER=https://auth.example.com/application/o/mosaic/
|
|
||||||
# AUTHENTIK_CLIENT_ID=
|
|
||||||
# AUTHENTIK_CLIENT_SECRET=
|
|
||||||
|
|
||||||
# --- WorkOS (optional — set WORKOS_CLIENT_ID to enable) ---
|
|
||||||
# WORKOS_ISSUER=https://your-company.authkit.app
|
|
||||||
# WORKOS_CLIENT_ID=client_...
|
|
||||||
# WORKOS_CLIENT_SECRET=sk_live_...
|
|
||||||
|
|
||||||
# --- Keycloak (optional — set KEYCLOAK_CLIENT_ID to enable) ---
|
|
||||||
# KEYCLOAK_ISSUER=https://auth.example.com/realms/master
|
|
||||||
# Legacy alternative if you prefer to compose the issuer from separate vars:
|
|
||||||
# KEYCLOAK_URL=https://auth.example.com
|
|
||||||
# KEYCLOAK_REALM=master
|
|
||||||
# KEYCLOAK_CLIENT_ID=mosaic
|
|
||||||
# KEYCLOAK_CLIENT_SECRET=
|
|
||||||
|
|
||||||
# The web login page discovers configured providers dynamically from
|
|
||||||
# GET /api/sso/providers. No NEXT_PUBLIC_* provider feature flag is required.
|
|
||||||
|
|||||||
@@ -47,6 +47,41 @@ services:
|
|||||||
environment:
|
environment:
|
||||||
COLLECTOR_OTLP_ENABLED: 'true'
|
COLLECTOR_OTLP_ENABLED: 'true'
|
||||||
|
|
||||||
|
|
||||||
|
gateway:
|
||||||
|
# Standalone-tier application service (compose `stack` profile).
|
||||||
|
# Default image = local build of docker/gateway.Dockerfile (works with
|
||||||
|
# no registry auth); override GATEWAY_IMAGE to a CI-published sha tag
|
||||||
|
# for registry deploys (git.mosaicstack.dev/mosaicstack/stack/gateway:sha-XXXXXXX).
|
||||||
|
profiles: [stack]
|
||||||
|
image: ${GATEWAY_IMAGE:-mosaic-gateway:dev}
|
||||||
|
build:
|
||||||
|
context: .
|
||||||
|
dockerfile: docker/gateway.Dockerfile
|
||||||
|
ports:
|
||||||
|
- '${GATEWAY_HOST_PORT:-14242}:14242'
|
||||||
|
environment:
|
||||||
|
GATEWAY_PORT: '14242'
|
||||||
|
DATABASE_URL: postgresql://mosaic:mosaic@postgres:5432/mosaic
|
||||||
|
VALKEY_URL: valkey://valkey:6379
|
||||||
|
# Standalone-tier secrets: generated at install (see .env.example).
|
||||||
|
# Enterprise tier replaces these with Vault/Openbao plumbing.
|
||||||
|
BETTER_AUTH_SECRET: '${BETTER_AUTH_SECRET:?set in .env — openssl rand -hex 32}'
|
||||||
volumes:
|
volumes:
|
||||||
|
- gateway_workspaces:/opt/mosaic/.workspaces
|
||||||
|
depends_on:
|
||||||
|
postgres:
|
||||||
|
condition: service_healthy
|
||||||
|
valkey:
|
||||||
|
condition: service_healthy
|
||||||
|
healthcheck:
|
||||||
|
test: ['CMD-SHELL', 'wget -qO- http://127.0.0.1:14242/health || exit 1']
|
||||||
|
interval: 10s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 12
|
||||||
|
start_period: 20s
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
gateway_workspaces:
|
||||||
pg_data:
|
pg_data:
|
||||||
valkey_data:
|
valkey_data:
|
||||||
|
|||||||
Reference in New Issue
Block a user