compose.yaml

name: sixsentences-community

x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

x-runtime-environment: &runtime-environment
  SIX_DATABASE_URL: postgresql+psycopg://sixsentences:${POSTGRES_PASSWORD:?run deploy/community/init-env.sh first}@postgres:5432/sixsentences
  SIX_DATA_DIR: /data
  SIX_JOBS_BACKEND: database
  SIX_RATE_LIMIT_BACKEND: database
  SIX_CONNECTOR_ENCRYPTION_KEY: ${SIX_CONNECTOR_ENCRYPTION_KEY:?run deploy/community/init-env.sh first}
  SIX_APP_URL: ${SIX_PUBLIC_ORIGIN:?set SIX_PUBLIC_ORIGIN}
  SIX_SITE_URL: ${SIX_PUBLIC_ORIGIN:?set SIX_PUBLIC_ORIGIN}
  SIX_PRIVACY_NOTICE_URL: ${SIX_LEGAL_BASE_URL:?set SIX_LEGAL_BASE_URL}/privacy
  SIX_TERMS_URL: ${SIX_LEGAL_BASE_URL:?set SIX_LEGAL_BASE_URL}/terms
  SIX_DOCS_URL: ${SIX_PUBLIC_ORIGIN:?set SIX_PUBLIC_ORIGIN}/docs
  SIX_SMTP_HOST: ${SIX_SMTP_HOST:-}
  SIX_SMTP_PORT: ${SIX_SMTP_PORT:-587}
  SIX_SMTP_USERNAME: ${SIX_SMTP_USERNAME:-}
  SIX_SMTP_PASSWORD: ${SIX_SMTP_PASSWORD:-}
  SIX_SMTP_STARTTLS: ${SIX_SMTP_STARTTLS:-true}
  SIX_MAIL_FROM: ${SIX_MAIL_FROM:-community@example.invalid}
  SIX_MAIL_REPLY_TO: ${SIX_MAIL_REPLY_TO:-community@example.invalid}
  SIX_OPENALEX_API_KEY: ${SIX_OPENALEX_API_KEY:-}
  SIX_OPENALEX_MAILTO: ${SIX_OPENALEX_MAILTO:-}
  SIX_OPENROUTER_API_KEY: ${SIX_OPENROUTER_API_KEY:-}
  SIX_OPENROUTER_BASE_URL: ${SIX_OPENROUTER_BASE_URL:-https://model-provider.example.invalid/v1}
  SIX_WEBSEARCH_API_KEY: ${SIX_WEBSEARCH_API_KEY:-}
  SIX_WEBSEARCH_DATA_PROCESSING_CONFIRMED: ${SIX_WEBSEARCH_DATA_PROCESSING_CONFIRMED:-false}
  SIX_GEMINI_API_KEY: ${SIX_GEMINI_API_KEY:-}
  SIX_GEMINI_DATA_PROCESSING_CONFIRMED: ${SIX_GEMINI_DATA_PROCESSING_CONFIRMED:-false}
  SIX_PUBLIC_SPOKEN_INTERVIEWS_ENABLED: ${SIX_PUBLIC_SPOKEN_INTERVIEWS_ENABLED:-false}
  SIX_LLM_ROUTING: ${SIX_LLM_ROUTING:-}
  SIX_LLM_BUDGET_USD: ${SIX_LLM_BUDGET_USD:-10}
  SIX_GROBID_URL: ${SIX_GROBID_URL:-}
  SIX_REPOSITORY_ANALYSIS_ENABLED: ${SIX_REPOSITORY_ANALYSIS_ENABLED:-true}
  SIX_STORAGE_RESERVE_BYTES: ${SIX_STORAGE_RESERVE_BYTES:-1073741824}

services:
  postgres:
    image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
    restart: unless-stopped
    logging: *default-logging
    environment:
      POSTGRES_DB: sixsentences
      POSTGRES_USER: sixsentences
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?run deploy/community/init-env.sh first}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    shm_size: 256mb
    healthcheck:
      test: ["CMD-SHELL", "pg_isready --username sixsentences --dbname sixsentences"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s
    networks:
      - backend

  api:
    image: ${SIX_API_IMAGE:-sixsentences-community-api:local}
    build:
      context: .
      dockerfile: services/api/Dockerfile
    restart: unless-stopped
    init: true
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging: *default-logging
    environment:
      <<: *runtime-environment
      SIX_CORS_ORIGINS: ${SIX_PUBLIC_ORIGIN:?set SIX_PUBLIC_ORIGIN}
      SIX_SELF_SIGNUP: ${SIX_SELF_SIGNUP:-false}
      SIX_REQUIRE_EMAIL_VERIFICATION: ${SIX_REQUIRE_EMAIL_VERIFICATION:-true}
      SIX_ENFORCE_LEGAL_ACCEPTANCE: ${SIX_ENFORCE_LEGAL_ACCEPTANCE:-true}
      SIX_GOOGLE_OAUTH_CLIENT_ID: ${SIX_GOOGLE_OAUTH_CLIENT_ID:-}
      SIX_BROWSER_CAPTURE_REDIRECT_URIS: ${SIX_BROWSER_CAPTURE_REDIRECT_URIS:-}
      SIX_ERASURE_LEDGER_PATH: /privacy/erasure-ledger.jsonl
      SIX_ERASURE_LEDGER_HMAC_KEY: ${SIX_ERASURE_LEDGER_HMAC_KEY:?run deploy/community/init-env.sh first}
    volumes:
      - app_data:/data
      - privacy_data:/privacy
    tmpfs:
      - /tmp:size=256m,mode=1777
    expose:
      - "8000"
    depends_on:
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/ready', timeout=5).read()"
      interval: 15s
      timeout: 8s
      retries: 5
      start_period: 45s
    networks:
      backend:
      egress:
        gw_priority: 1

  worker:
    image: ${SIX_API_IMAGE:-sixsentences-community-api:local}
    build:
      context: .
      dockerfile: services/api/Dockerfile
    command: ["six-community-worker"]
    restart: unless-stopped
    init: true
    stop_grace_period: 310s
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging: *default-logging
    environment:
      <<: *runtime-environment
      SIX_ERASURE_LEDGER_PATH: /privacy/erasure-ledger.jsonl
      SIX_ERASURE_LEDGER_HMAC_KEY: ${SIX_ERASURE_LEDGER_HMAC_KEY:?run deploy/community/init-env.sh first}
      SIX_JOBS_WORKER_LANE: all
      SIX_JOBS_WORKER_CONCURRENCY: ${SIX_WORKER_CONCURRENCY:-2}
      SIX_JOBS_HEARTBEAT_DIR: /tmp
    volumes:
      - app_data:/data
      - privacy_data:/privacy
    tmpfs:
      - /tmp:size=512m,mode=1777
    depends_on:
      api:
        condition: service_healthy
    healthcheck:
      test:
        - CMD-SHELL
        - >-
          test -f /tmp/job-worker-heartbeat &&
          find /tmp/job-worker-heartbeat -mmin -2 -print -quit | grep -q .
      interval: 30s
      timeout: 5s
      retries: 4
      start_period: 45s
    networks:
      backend:
      egress:
        gw_priority: 1

  migrate:
    image: ${SIX_API_IMAGE:-sixsentences-community-api:local}
    build:
      context: .
      dockerfile: services/api/Dockerfile
    command: ["alembic", "upgrade", "head"]
    restart: "no"
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging: *default-logging
    environment:
      <<: *runtime-environment
      SIX_ERASURE_LEDGER_PATH: /privacy/erasure-ledger.jsonl
      SIX_ERASURE_LEDGER_HMAC_KEY: ${SIX_ERASURE_LEDGER_HMAC_KEY:?run deploy/community/init-env.sh first}
    volumes:
      - app_data:/data
      - privacy_data:/privacy
    tmpfs:
      - /tmp:size=128m,mode=1777
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - backend

  web:
    image: ${SIX_WEB_IMAGE:-sixsentences-community-web:local}
    build:
      context: ./apps/web
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_SIX_API_URL: ${SIX_PUBLIC_API_URL:?set SIX_PUBLIC_API_URL}
        NEXT_PUBLIC_APP_URL: ${SIX_PUBLIC_ORIGIN:?set SIX_PUBLIC_ORIGIN}
        NEXT_PUBLIC_LEGAL_BASE_URL: ${SIX_LEGAL_BASE_URL:?set SIX_LEGAL_BASE_URL}
        SIX_ALLOW_INSECURE_LOCAL_HTTP: ${SIX_ALLOW_INSECURE_LOCAL_HTTP:-false}
        NEXT_PUBLIC_TERMS_VERSION: ${SIX_TERMS_VERSION:?set SIX_TERMS_VERSION}
        NEXT_PUBLIC_PRIVACY_VERSION: ${SIX_PRIVACY_VERSION:?set SIX_PRIVACY_VERSION}
        NEXT_PUBLIC_DPA_VERSION: ${SIX_DPA_VERSION:?set SIX_DPA_VERSION}
        NEXT_PUBLIC_GOOGLE_CLIENT_ID: ${SIX_GOOGLE_OAUTH_CLIENT_ID:-}
    restart: unless-stopped
    init: true
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging: *default-logging
    tmpfs:
      - /tmp:size=64m,mode=1777
    expose:
      - "3000"
    networks:
      - frontend

  proxy:
    image: caddy:2-alpine@sha256:5f5c8640aae01df9654968d946d8f1a56c497f1dd5c5cda4cf95ab7c14d58648
    restart: unless-stopped
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    logging: *default-logging
    environment:
      SIX_SITE_ADDRESS: ${SIX_SITE_ADDRESS:?set SIX_SITE_ADDRESS}
    ports:
      - "${SIX_HTTP_PORT:-80}:80"
      - "${SIX_HTTPS_PORT:-443}:443"
      - "${SIX_HTTPS_PORT:-443}:443/udp"
    volumes:
      - ./deploy/community/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    tmpfs:
      - /tmp:size=64m,mode=1777
    depends_on:
      api:
        condition: service_healthy
      web:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "caddy", "validate", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      frontend:
        gw_priority: 1
      backend:

volumes:
  postgres_data:
  app_data:
  privacy_data:
  caddy_data:
  caddy_config:

networks:
  frontend:
  backend:
    internal: true
  # API and worker need explicit outbound access for operator-selected SMTP,
  # scholarly metadata, model and speech providers. No ports are published on
  # this network; PostgreSQL remains attached only to the internal backend.
  egress: