Flow/docker-compose.yml at main · BTreeMap/Flow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
# docker-compose.yml - Production-like local stack for Flow.
#
# Usage:
#   docker compose up
#
# Architecture:
#   flow-web  (Caddy)   :${WEB_PORT:-8080}  - serves static frontend
#                                          reverse proxies /api/* -> flow:${API_PORT:-8000}
#   flow      (FastAPI) :${API_PORT:-8000}  - backend API (routes at root, no /api prefix)
#   postgres            :5432  - database (always running)
#
# Cloudflare Tunnel (production):
#   TLS is terminated by Cloudflare Tunnel. flow-web listens on plain HTTP :${WEB_PORT:-8080}.
#   The tunnel forwards https://example.com → http://flow-web:${WEB_PORT:-8080}.

services:
  flow-web:
    image: ${FLOW_WEB_IMAGE:-ghcr.io/btreemap/flow-web:latest}
    hostname: flow-web
    ports:
      - "${WEB_PORT:-8080}:${WEB_PORT:-8080}"
    environment:
      BACKEND_UPSTREAM: "flow:${API_PORT:-8000}"
      WEB_PORT: "${WEB_PORT:-8080}"
    depends_on:
      flow:
        condition: service_healthy
    networks:
      - flow-net

  flow:
    image: ${FLOW_IMAGE:-ghcr.io/btreemap/flow:latest}
    hostname: flow
    environment:
      H4CKATH0N_ENV: ${H4CKATH0N_ENV:-production}
      H4CKATH0N_RP_ID: ${H4CKATH0N_RP_ID:-localhost}
      H4CKATH0N_ORIGIN: ${H4CKATH0N_ORIGIN:-http://localhost:8080}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      LLM_MODEL: ${LLM_MODEL:-gpt-4o-mini}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      FLOW_DATA_DIR: /app/data
      API_HOST: "${API_HOST:-::}"
      API_PORT: "${API_PORT:-8000}"
      TZ: ${TZ:-America/Toronto}

      # One Base64URL-encoded 32-byte master key. BLAKE3 derives dedicated
      # subkeys for condition randomization and Spark pseudonymous identity.
      FLOW_CRYPTO_MASTER_KEY: ${FLOW_CRYPTO_MASTER_KEY:-}

      # VAPID Web Push (push disabled if either is empty).
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}
      VAPID_CLAIM_SUB: ${VAPID_CLAIM_SUB:-mailto:admin@example.com}

      # Default is Postgres (production-shaped). Override to sqlite in CI/local if desired.
      H4CKATH0N_DATABASE_URL: ${H4CKATH0N_DATABASE_URL:-postgresql+asyncpg://flow:flow@postgres:5432/flow}

    volumes:
      - flow-data:/app/data

    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - flow-net

  flow-worker:
    image: ${FLOW_IMAGE:-ghcr.io/btreemap/flow:latest}
    hostname: flow-worker
    entrypoint:
      [
        "/opt/venv/bin/python",
        "-m",
        "app.worker.notification_worker",
      ]
    environment:
      H4CKATH0N_ENV: ${H4CKATH0N_ENV:-production}
      H4CKATH0N_RP_ID: ${H4CKATH0N_RP_ID:-localhost}
      H4CKATH0N_ORIGIN: ${H4CKATH0N_ORIGIN:-http://localhost:8080}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      LLM_MODEL: ${LLM_MODEL:-gpt-4o-mini}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      FLOW_DATA_DIR: /app/data
      TZ: ${TZ:-America/Toronto}

      # Same master key as the API; worker derives the randomization subkey.
      FLOW_CRYPTO_MASTER_KEY: ${FLOW_CRYPTO_MASTER_KEY:-}

      # VAPID Web Push — the worker is the only push sender. Push disabled if empty.
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}
      VAPID_CLAIM_SUB: ${VAPID_CLAIM_SUB:-mailto:admin@example.com}

      H4CKATH0N_DATABASE_URL: ${H4CKATH0N_DATABASE_URL:-postgresql+asyncpg://flow:flow@postgres:5432/flow}
    volumes:
      - flow-data:/app/data
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - flow-net

  postgres:
    image: postgres:18.4
    hostname: postgres
    environment:
      POSTGRES_USER: flow
      POSTGRES_PASSWORD: flow
      POSTGRES_DB: flow

    # Postgres 18+ expects the volume at /var/lib/postgresql, not /var/lib/postgresql/data.
    # This matches the image's PGDATA/VOLUME layout change.
    volumes:
      - pg-data:/var/lib/postgresql

    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U flow -d flow"]
      interval: 5s
      timeout: 5s
      retries: 20
    networks:
      - flow-net

volumes:
  flow-data:
  pg-data:

networks:
  flow-net:
    name: flow-net
    driver: bridge
    enable_ipv6: true
    ipam:
      config:
        - subnet: 172.30.0.0/16
        - subnet: fd00:f100::/64