docker-compose.yml

services:
  # ============================================
  # Application Web Flask
  # ============================================
  app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - APP_VERSION=${APP_VERSION:-1.3.5}
    image: ghcr.io/ll7baucarre/elaslip:latest
    container_name: elaslip-app
    cap_add:
      - NET_RAW
      - NET_ADMIN
    ports:
      - "${FLASK_PORT:-5000}:5000"
    environment:
      - FLASK_ENV=development
      - FLASK_APP=app
      - FLASK_PORT=5000
      - APP_VERSION=${APP_VERSION:-1.3.5}
      - SECRET_KEY=${SECRET_KEY:-supersecretkey}
      - FLASK_HOST=${FLASK_HOST:-0.0.0.0}
      - APP_URL=${APP_URL:-http://localhost:5000}
      - ELASTICSEARCH_URL=http://elastic:${ELASTICSEARCH_PASSWORD:-elastic123}@elasticsearch:9200
      - ELASTICSEARCH_USER=${ELASTICSEARCH_USER:-elastic}
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-elastic123}
      - REDIS_URL=redis://redis:6379/0
      - SESSION_REDIS_DB=${SESSION_REDIS_DB:-2}
      - CELERY_BROKER_URL=redis://redis:6379/1
      - DEFAULT_ADMIN_USER=${DEFAULT_ADMIN_USER:-admin}
      - DEFAULT_ADMIN_PASSWORD=${DEFAULT_ADMIN_PASSWORD:-admin123}
      - LLM_ENABLED=${LLM_ENABLED:-false}
      - LLM_URL=${LLM_URL:-http://ollama:11434}
      - LLM_MODEL=${LLM_MODEL:-mistral}
      - LLM_API_KEY=${LLM_API_KEY:-}
      - LLM_GENERATION_LANGUAGE=${LLM_GENERATION_LANGUAGE:-en}
      # OAuth Configuration
      - OAUTH_ENABLED=${OAUTH_ENABLED:-false}
      - OAUTH_AUTO_CREATE_USER=${OAUTH_AUTO_CREATE_USER:-true}
      - OAUTH_AUTO_LINK_BY_EMAIL=${OAUTH_AUTO_LINK_BY_EMAIL:-false}
      - OAUTH_DEFAULT_ROLE=${OAUTH_DEFAULT_ROLE:-viewer}
      # NOTE: Must be set to a non-empty value when OAUTH_ENABLED=true, otherwise the app will fail to start.
      #       Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
      - OAUTH_ENCRYPTION_KEY=${OAUTH_ENCRYPTION_KEY:-}
      # Default to secure cookies; override to 'false' only for pure-HTTP local setups.
      - SESSION_COOKIE_SECURE=${SESSION_COOKIE_SECURE:-true}
      # OAuth Providers
      - OAUTH_GOOGLE_ENABLED=${OAUTH_GOOGLE_ENABLED:-false}
      - OAUTH_GOOGLE_CLIENT_ID=${OAUTH_GOOGLE_CLIENT_ID:-}
      - OAUTH_GOOGLE_CLIENT_SECRET=${OAUTH_GOOGLE_CLIENT_SECRET:-}
      - OAUTH_GITHUB_ENABLED=${OAUTH_GITHUB_ENABLED:-false}
      - OAUTH_GITHUB_CLIENT_ID=${OAUTH_GITHUB_CLIENT_ID:-}
      - OAUTH_GITHUB_CLIENT_SECRET=${OAUTH_GITHUB_CLIENT_SECRET:-}
      - OAUTH_OIDC_ENABLED=${OAUTH_OIDC_ENABLED:-false}
      - OAUTH_OIDC_CLIENT_ID=${OAUTH_OIDC_CLIENT_ID:-}
      - OAUTH_OIDC_CLIENT_SECRET=${OAUTH_OIDC_CLIENT_SECRET:-}
      - OAUTH_OIDC_DISCOVERY_URL=${OAUTH_OIDC_DISCOVERY_URL:-}
      - OAUTH_OIDC_PROVIDER_NAME=${OAUTH_OIDC_PROVIDER_NAME:-OIDC}
    volumes:
      - ./app:/app/app
      - ./templates:/app/templates
      - ./static:/app/static
      - ./scripts:/app/scripts
    depends_on:
      elasticsearch:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - elaslip-network
    restart: unless-stopped

  # ============================================
  # Celery Worker - Standard (sans VPN)
  # ============================================
  worker:
    build:
      context: .
      dockerfile: Dockerfile
    image: ghcr.io/ll7baucarre/elaslip:latest
    container_name: elaslip-worker
    command: celery -A app.celery worker --loglevel=info
    cap_add:
      - NET_RAW
      - NET_ADMIN
    dns:
      - 1.1.1.1
      - 8.8.8.8
    environment:
      - FLASK_ENV=development
      - SECRET_KEY=${SECRET_KEY:-supersecretkey}
      - ELASTICSEARCH_URL=http://elastic:${ELASTICSEARCH_PASSWORD:-elastic123}@elasticsearch:9200
      - ELASTICSEARCH_USER=${ELASTICSEARCH_USER:-elastic}
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-elastic123}
      - REDIS_URL=redis://redis:6379/0
      - CELERY_BROKER_URL=redis://redis:6379/1
      - LLM_ENABLED=${LLM_ENABLED:-false}
      - LLM_URL=${LLM_URL:-http://ollama:11434}
      - LLM_MODEL=${LLM_MODEL:-mistral}
      - LLM_API_KEY=${LLM_API_KEY:-}
      - LLM_GENERATION_LANGUAGE=${LLM_GENERATION_LANGUAGE:-en}
      - VPN_ENABLED=false
      - WORKER_DNS=${WORKER_DNS:-1.1.1.1,8.8.8.8}
    volumes:
      - ./app:/app/app
      - ./scripts:/app/scripts
    depends_on:
      elasticsearch:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - elaslip-network
    restart: unless-stopped

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    container_name: elaslip-elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=true
      - xpack.security.enrollment.enabled=true
      - ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD:-elastic123}
      - "ES_JAVA_OPTS=-Xms${ELASTICSEARCH_MEMORY_XMS:-256m} -Xmx${ELASTICSEARCH_MEMORY_XMX:-256m}"
    ports:
      - "9200:9200"
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    networks:
      - elaslip-network
    healthcheck:
      test: ["CMD-SHELL", "curl -f -u elastic:${ELASTICSEARCH_PASSWORD:-elastic123} http://localhost:9200/_cluster/health?wait_for_status=yellow || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 40s
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: elaslip-redis
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    networks:
      - elaslip-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped

volumes:
  elasticsearch-data:
  redis-data:

networks:
  elaslip-network:
    driver: bridge