docker-stack-compose.yml

x-logging:
  &default-logging
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "1"
    tag: "{{.Name}}"

services:
  openwebui:
    image: ghcr.io/open-webui/open-webui:main
    # No wait script — Open WebUI has internal retry logic for db/redis,
    # and the wait script causes a multi-replica Redis lock race on fresh deploys.
    volumes:
      - ${DATA_ROOT}/open-webui/data:/app/backend/data
    env_file:
      - env/owui.env
    environment:
      TZ: America/New_York
      # CORS - use "*" for allow-all (can create 500 errors w/current traefik CORS rules)
      CORS_ALLOW_ORIGIN: https://${ROUTER_NAME}.${ROOT_DOMAIN}
    networks:
      - backend
      # - traefik-public  # uncomment if using Traefik as ingress
    healthcheck:
      test: ["CMD-SHELL", "curl --fail localhost:8080/health || exit 1"]
      interval: 30s
      retries: 15
      start_period: 180s
      timeout: 10s
    deploy:
      replicas: 2
      update_config:
        parallelism: 1
        delay: 30s
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 15s
        max_attempts: 5
        window: 120s
      labels:
        # Traefik — uncomment and configure if using Traefik as ingress
        # - traefik.enable=true
        # - traefik.swarm.network=traefik-public
        # - traefik.http.routers.${ROUTER_NAME}.rule=Host(`${ROUTER_NAME}.${ROOT_DOMAIN}`)
        # - traefik.http.routers.${ROUTER_NAME}.middlewares=chain-oauth@file
        # - traefik.http.routers.${ROUTER_NAME}.service=${ROUTER_NAME}-svc
        # - traefik.http.services.${ROUTER_NAME}-svc.loadbalancer.server.port=8080
        # - traefik.constraint=traefik-public
    logging: *default-logging

  db:
    image: pgvector/pgvector:pg17
    env_file:
      - env/db.env
    user: "999:999"
    environment:
      TZ: America/New_York
    entrypoint: ["/init/entrypoint.sh"]
    command: ["postgres"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 30s
      retries: 10
      start_period: 60s
      timeout: 10s
    volumes:
      - postgres:/var/lib/postgresql/data
      - ${DATA_ROOT}/open-webui/postgres/init:/init:ro
    networks:
      - backend
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 30s
      restart_policy:
        condition: on-failure

    logging: *default-logging

  redis:
    image: docker.io/valkey/valkey:9-alpine
    # Host tuning: sudo sysctl vm.overcommit_memory=1 (persist in /etc/sysctl.conf)
    environment:
      TZ: America/New_York
    volumes:
      - ${REDIS_DATA_ROOT:-${DATA_ROOT}}/open-webui/redis/data:/data
    command: "valkey-server --save 30 1 --maxmemory-policy allkeys-lru --tcp-keepalive 300"
    healthcheck:
      test: "[ $$(valkey-cli ping) = 'PONG' ]"
      start_period: 5s
      interval: 1s
      timeout: 3s
      retries: 5
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
      - DAC_OVERRIDE
    networks:
      - backend
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 30s
      restart_policy:
        condition: on-failure
    logging: *default-logging

  searxng:
    image: searxng/searxng:2025.7.10-4b9644e
    user: "977:977"
    entrypoint: ["/bin/sh", "/wait-for-services.sh", "redis:6379", "--", "/usr/local/searxng/entrypoint.sh"]
    env_file: env/searxng.env
    environment:
      TZ: America/New_York
    healthcheck:
      interval: 30s
      retries: 5
      start_period: 60s
      test: ["CMD-SHELL", "wget -nv -t1 --spider http://127.0.0.1:8080 || exit 1"]
      timeout: 10s
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - DAC_OVERRIDE
    cap_drop:
      - ALL
    volumes:
      - ${DATA_ROOT}/open-webui/searxng/conf/settings.yml:/etc/searxng/settings.yml:ro
      - ${DATA_ROOT}/open-webui/searxng/conf/uwsgi.ini:/etc/searxng/uwsgi.ini:ro
      - ${DATA_ROOT}/open-webui/searxng/conf/limiter.toml:/etc/searxng/limiter.toml:ro
      - ${DATA_ROOT}/open-webui/scripts/wait-for-services.sh:/wait-for-services.sh:ro
      - searxng:/var/cache/searxng:rw
    networks:
      - backend
      # - traefik-public  # uncomment if using Traefik as ingress
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 30s
      restart_policy:
        condition: on-failure
      labels:
        # Traefik — uncomment and configure if using Traefik as ingress
        # SearXNG is served under /searxng — requires SEARXNG_BASE_URL=/searxng in env/searxng.env
        # - traefik.enable=true
        # - traefik.swarm.network=traefik-public
        # - traefik.http.routers.searxng.rule=Host(`${ROUTER_NAME}.${ROOT_DOMAIN}`) && PathPrefix(`/searxng`)
        # - traefik.http.routers.searxng.middlewares=chain-oauth@file,searxng-stripprefix
        # - traefik.http.middlewares.searxng-stripprefix.stripPrefix.prefixes=/searxng
        # - traefik.http.routers.searxng.service=searxng-svc
        # - traefik.http.services.searxng-svc.loadbalancer.server.port=8080
    logging:
      driver: "json-file"
      options:
        max-size: "1m"
        max-file: "1"

  tika:
    image: apache/tika:${TIKA_TAG:-3.2.3.0}-full
    entrypoint: ["/bin/sh", "-c", "exec java -cp \"/customocr:/tika-server-standard-$${TIKA_VERSION}.jar:/tika-extras/*\" org.apache.tika.server.core.TikaServerCli -h 0.0.0.0 $$0 $$@"]
    command: -c /tika-config.xml
    environment:
      TZ: America/New_York
    healthcheck:
      test: ["CMD-SHELL", "wget -nv -t1 --spider http://127.0.0.1:9998/tika || exit 1"]
      interval: 30s
      retries: 5
      start_period: 60s
      timeout: 10s
    volumes:
      - ${DATA_ROOT}/open-webui/tika/conf/tika-config.xml:/tika-config.xml
      - ${DATA_ROOT}/open-webui/tika/conf/customocr:/customocr
    networks:
      - backend
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 30s
      restart_policy:
        condition: on-failure
    logging: *default-logging

  edgetts:
    image: travisvn/openai-edge-tts:latest
    env_file: env/edgetts.env
    environment:
      TZ: America/New_York
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:5050/v1/models')\" || exit 1"]
      interval: 30s
      retries: 5
      start_period: 15s
      timeout: 5s
    networks:
      - backend
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 30s
      restart_policy:
        condition: on-failure
    logging: *default-logging

  mcposerver:
    image: ghcr.io/open-webui/mcpo:latest
    entrypoint: ["/bin/sh", "/wait-for-services.sh", "db:5432", "--"]
    command: ["mcpo", "--config", "/app/conf/config.json"]
    env_file: env/mcp.env
    environment:
      TZ: America/New_York
    healthcheck:
      interval: 30s
      retries: 5
      start_period: 60s
      test: ["CMD-SHELL", "curl -sf http://127.0.0.1:8000/docs || exit 1"]
      timeout: 10s
    volumes:
      - ${DATA_ROOT}/open-webui/mcposerver/conf:/app/conf:ro
      - ${DATA_ROOT}/open-webui/scripts/wait-for-services.sh:/wait-for-services.sh:ro
    networks:
      - backend
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 30s
      restart_policy:
        condition: on-failure
    logging: *default-logging

  tools-init:
    image: python:3.12-slim
    env_file: env/tools-init.env
    environment:
      TZ: America/New_York
      # 300s is needed because openwebui bind ≠ ready: migrations + function
      # module loading + frontmatter pip installs can run several minutes on
      # fresh boots (slim base image has no nc, so the wait script falls back
      # to python3 socket connect — works fine here).
      WAIT_TIMEOUT: "300"
    entrypoint: ["bash", "/wait-for-services.sh", "openwebui:8080", "--"]
    command: ["bash", "-c", "apt-get update -qq && apt-get install -y -qq curl jq >/dev/null 2>&1 && exec bash /scripts/install-tools.sh"]
    volumes:
      - ${DATA_ROOT}/open-webui/tools:/tools:ro
      - ${DATA_ROOT}/open-webui/tools/install-tools.sh:/scripts/install-tools.sh:ro
      - ${DATA_ROOT}/open-webui/scripts/wait-for-services.sh:/wait-for-services.sh:ro
    networks:
      - backend
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 60s
        max_attempts: 5
    logging: *default-logging

networks:
  backend:
    name: ${BACKEND_NETWORK_NAME}
    external: true
  # traefik-public:  # uncomment if using Traefik as ingress
  #   external: true

volumes:
  postgres:
    external: true
    name: ${STACK_NAME}_postgresdata
  searxng:
    external: true
    name: ${STACK_NAME}_searxngcache