Sign inSign up

harlenalvarez/huddle-stack:latest

Manifest digest

sha256:7a92b64115c9f3ffab553153442471a0620ef28c8fba7d903f0bf098172f250c

Last pushed

2 days by harlenalvarez

Type

Compose

Manifest digest

sha256:7a92b64115c9f3ffab553153442471a0620ef28c8fba7d903f0bf098172f250c

Image Layers

Compose file content

name: huddle

services:
  postgres:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-postgres:${HUDDLE_IMAGE_TAG:-dev}
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_ALLOWED_HOSTS: postgres
    volumes:
      - postgres_data:/var/lib/postgresql
    networks:
      - backend
    healthcheck:
      # Check the private listener without assuming a role from DATABASE_URL;
      # the custom entrypoint may initialize any configured username.
      test:
        [
          'CMD',
          'python3',
          '-c',
          "import socket; connection = socket.create_connection(('127.0.0.1', 5432), 3); connection.close()",
        ]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 15s
    restart: unless-stopped

  zitadel-db-init:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-postgres:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python3', '/usr/local/lib/huddle/zitadel_db_init.py']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_ALLOWED_HOSTS: postgres
      ZITADEL_DB_NAME: ${ZITADEL_DB_NAME:-zitadel}
      ZITADEL_DB_USER: ${ZITADEL_DB_USER:-zitadel}
      ZITADEL_DB_PASSWORD: ${ZITADEL_DB_PASSWORD:?ZITADEL_DB_PASSWORD is required}
      ZITADEL_MASTERKEY: ${ZITADEL_MASTERKEY:?ZITADEL_MASTERKEY is required}
      ZITADEL_SESSION_COOKIE_SECRET: ${ZITADEL_SESSION_COOKIE_SECRET:?ZITADEL_SESSION_COOKIE_SECRET is required}
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - zitadel_bootstrap:/zitadel/bootstrap
    networks:
      - backend
    restart: 'no'

  zitadel-api:
    image: ghcr.io/zitadel/zitadel:${ZITADEL_VERSION:-v4.19.3}
    user: '0'
    command:
      ['start-from-init', '--masterkey', '${ZITADEL_MASTERKEY:?ZITADEL_MASTERKEY is required}']
    environment:
      ZITADEL_PORT: '8080'
      ZITADEL_TLS_ENABLED: 'false'
      ZITADEL_EXTERNALDOMAIN: ${ZITADEL_DOMAIN:-localhost}
      ZITADEL_EXTERNALPORT: ${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}
      ZITADEL_EXTERNALSECURE: ${ZITADEL_EXTERNALSECURE:-false}
      ZITADEL_DATABASE_POSTGRES_DSN: postgresql://${ZITADEL_DB_USER:-zitadel}:${ZITADEL_DB_PASSWORD:?ZITADEL_DB_PASSWORD is required}@postgres:5432/${ZITADEL_DB_NAME:-zitadel}?sslmode=disable
      ZITADEL_FIRSTINSTANCE_ORG_NAME: ${ZITADEL_ADMIN_ORG:-Huddle Admin}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME: ${ZITADEL_ADMIN_EMAIL:?ZITADEL_ADMIN_EMAIL is required}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS: ${ZITADEL_ADMIN_EMAIL:?ZITADEL_ADMIN_EMAIL is required}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_VERIFIED: 'true'
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME: Huddle
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME: Admin
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: ${ZITADEL_ADMIN_PASSWORD:?ZITADEL_ADMIN_PASSWORD is required}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: 'false'
      ZITADEL_FIRSTINSTANCE_PATPATH: /zitadel/bootstrap/admin.pat
      ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME: huddle-bootstrap
      ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME: Huddle bootstrap administrator
      ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE: ${ZITADEL_ADMIN_PAT_EXPIRATION:-2027-10-01T00:00:00Z}
      ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH: /zitadel/bootstrap/login-client.pat
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME: login-client
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME: Huddle Login v2
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE: ${ZITADEL_LOGIN_PAT_EXPIRATION:-2027-10-01T00:00:00Z}
      ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED: 'true'
      ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_BASEURI: ${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}/ui/v2/login/
      ZITADEL_OIDC_DEFAULTLOGINURLV2: ${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}/ui/v2/login/login?authRequest=
      ZITADEL_OIDC_DEFAULTLOGOUTURLV2: ${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}/ui/v2/login/logout?post_logout_redirect=
      ZITADEL_SAML_DEFAULTLOGINURLV2: ${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}/ui/v2/login/login?samlRequest=
      # Invite-only from first start, before the operator runs bootstrap.
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_ALLOWREGISTER: 'false'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_ALLOWUSERNAMEPASSWORD: 'true'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_FORCEMFA: 'false'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_HIDEPASSWORDRESET: 'true'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_ALLOWEXTERNALIDP: 'false'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_ALLOWDOMAINDISCOVERY: 'false'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_PASSWORDLESSTYPE: '0'
    depends_on:
      zitadel-db-init:
        condition: service_completed_successfully
    volumes:
      - zitadel_bootstrap:/zitadel/bootstrap
    networks:
      - backend
    healthcheck:
      test: ['CMD', '/app/zitadel', 'ready']
      interval: 10s
      timeout: 30s
      retries: 12
      start_period: 30s
    restart: unless-stopped

  zitadel-login:
    image: ghcr.io/zitadel/zitadel-login:${ZITADEL_VERSION:-v4.19.3}
    user: '0'
    environment:
      ZITADEL_API_URL: http://zitadel-api:8080
      NEXT_PUBLIC_BASE_PATH: /ui/v2/login
      ZITADEL_SERVICE_USER_TOKEN_FILE: /zitadel/bootstrap/login-client.pat
      ZITADEL_SESSION_COOKIE_SECRET: ${ZITADEL_SESSION_COOKIE_SECRET:?ZITADEL_SESSION_COOKIE_SECRET is required}
      CUSTOM_REQUEST_HEADERS: Host:${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}},X-Forwarded-Proto:${ZITADEL_PUBLIC_SCHEME:-http}
    depends_on:
      zitadel-api:
        condition: service_healthy
    volumes:
      - zitadel_bootstrap:/zitadel/bootstrap:ro
    networks:
      - backend
    healthcheck:
      test: ['CMD', 'node', '/app/healthcheck.mjs', 'http://localhost:3000/ui/v2/login/healthy']
      interval: 10s
      timeout: 30s
      retries: 12
      start_period: 30s
    restart: unless-stopped

  zitadel:
    image: caddy:2-alpine
    environment:
      ZITADEL_SITE_ADDRESS: ${ZITADEL_SITE_ADDRESS:-http://:8080}
    configs:
      - source: zitadel_caddyfile
        target: /etc/caddy/Caddyfile
    depends_on:
      zitadel-login:
        condition: service_healthy
      zitadel-api:
        condition: service_healthy
    networks:
      - frontend
      - backend
    healthcheck:
      test:
        ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1:2019/config/']
      interval: 10s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  redis:
    image: redis:8-alpine
    command: ['redis-server', '--appendonly', 'yes']
    volumes:
      - redis_data:/data
    networks:
      - backend
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

  nats:
    image: nats:2-alpine
    command: ['-js', '-sd', '/data', '-m', '8222']
    volumes:
      - nats_data:/data
    networks:
      - backend
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--spider', 'http://127.0.0.1:8222/healthz']
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

  nats-tools:
    image: natsio/nats-box:latest
    profiles: ['tools']
    entrypoint: ['sleep', 'infinity']
    depends_on:
      nats:
        condition: service_healthy
    networks:
      - backend

  artifact-storage-init:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    user: '0:0'
    entrypoint: ['sh', '-c']
    command:
      - mkdir -p /var/lib/huddle/artifacts /var/lib/huddle/artifact-staging && chown -R 10001:10001 /var/lib/huddle/artifacts /var/lib/huddle/artifact-staging && chmod 700 /var/lib/huddle/artifact-staging
    volumes:
      - artifact_data:/var/lib/huddle/artifacts
      - artifact_staging:/var/lib/huddle/artifact-staging
    restart: 'no'

  api:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_STARTUP_TIMEOUT: ${DATABASE_STARTUP_TIMEOUT:-120}
      # Allow Zitadel bootstrap to render the stack before the org exists.
      # The ownership migration rejects a missing ID before changing the schema.
      ZITADEL_BOOTSTRAP_OWNER_ID: ${ZITADEL_BOOTSTRAP_OWNER_ID:-}
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      ARTIFACT_BLOB_ROOT: /var/lib/huddle/artifacts
      ARTIFACT_STAGING_ROOT: /var/lib/huddle/artifact-staging
      ARTIFACT_MAX_UPLOAD_BYTES: ${ARTIFACT_MAX_UPLOAD_BYTES:-26214400}
      ARTIFACT_MAX_FILES_PER_UPLOAD: ${ARTIFACT_MAX_FILES_PER_UPLOAD:-20}
      ARTIFACT_AGENT_WRITE_MAX_CHARS: ${ARTIFACT_AGENT_WRITE_MAX_CHARS:-100000}
      ARTIFACT_TEXT_MAX_BYTES: ${ARTIFACT_TEXT_MAX_BYTES:-2097152}
      ARTIFACT_VISION_MAX_EDGE_PX: ${ARTIFACT_VISION_MAX_EDGE_PX:-2048}
      ARTIFACT_SVG_MAX_BYTES: ${ARTIFACT_SVG_MAX_BYTES:-5242880}
      ARTIFACT_HTML_MAX_BYTES: ${ARTIFACT_HTML_MAX_BYTES:-5242880}
      ARTIFACT_HTML_MAX_IMAGES: ${ARTIFACT_HTML_MAX_IMAGES:-10}
      ARTIFACT_HTML_MIN_IMAGE_DIMENSION_PX: ${ARTIFACT_HTML_MIN_IMAGE_DIMENSION_PX:-32}
      HTTP_TIMEOUT: ${HTTP_TIMEOUT:-300}
      HTTPX_MAX_CONNECTIONS: ${HTTPX_MAX_CONNECTIONS:-100}
      HTTP_MAX_KEEPALIVE: ${HTTP_MAX_KEEPALIVE:-20}
      ASR_WS_URL: ${ASR_WS_URL:-ws://spark-427e.local:8005/v1/audio/transcriptions/realtime}
      VLLM_API_KEY: ${VLLM_API_KEY:-EMPTY}
      CHAT_HEIC_MODE: ${CHAT_HEIC_MODE:-passthrough}
      CHAT_CONTEXT_USAGE_TIMEOUT_SECONDS: ${CHAT_CONTEXT_USAGE_TIMEOUT_SECONDS:-2.0}
      EXA_API_KEY: ${EXA_API_KEY:-}
      GOOGLE_PLACES_API_KEY: ${GOOGLE_PLACES_API_KEY:-}
      REDIS_HOST: redis:6379
      REDIS_KEY_PREFIX: ${REDIS_KEY_PREFIX:-huddle:}
      REDIS_MAX_CONNECTIONS: ${REDIS_MAX_CONNECTIONS:-10}
      REDIS_SOCKET_CONNECT_TIMEOUT: ${REDIS_SOCKET_CONNECT_TIMEOUT:-10.0}
      REDIS_SOCKET_TIMEOUT: ${REDIS_SOCKET_TIMEOUT:-30.0}
      REDIS_SOCKET_KEEPALIVE: ${REDIS_SOCKET_KEEPALIVE:-true}
      REDIS_SSL_ENABLED: 'false'
      REDIS_IS_CLUSTER: 'false'
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      WEB_PUSH_ENABLED: ${WEB_PUSH_ENABLED:-false}
      WEB_PUSH_VAPID_PUBLIC_KEY: ${WEB_PUSH_VAPID_PUBLIC_KEY:-}
      OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID:-}
      OAUTH_ISSUER: ${OAUTH_ISSUER:-${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}}
      OAUTH_AUDIENCE: ${OAUTH_AUDIENCE:-}
      OAUTH_JWKS_URL: ${OAUTH_JWKS_URL:-http://zitadel:8080/oauth/v2/keys}
      OAUTH_JWKS_HOST_HEADER: ${OAUTH_JWKS_HOST_HEADER:-${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}}
      OAUTH_OWNER_CLAIM: ${OAUTH_OWNER_CLAIM:-urn:zitadel:iam:user:resourceowner:id}
      OAUTH_END_SESSION_ENDPOINT: ${OAUTH_END_SESSION_ENDPOINT:-}
      OAUTH_SCOPES: ${OAUTH_SCOPES:-}
      HUDDLE_PUBLIC_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
      HUDDLE_LANDING_ORIGIN: ${HUDDLE_LANDING_ORIGIN:-}
      INTEREST_TOKEN_SECRET: ${INTEREST_TOKEN_SECRET:-}
      INTEREST_HOURLY_SIGNUP_LIMIT: ${INTEREST_HOURLY_SIGNUP_LIMIT:-60}
      INTEREST_DAILY_EMAIL_LIMIT: ${INTEREST_DAILY_EMAIL_LIMIT:-100}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM: ${SMTP_FROM:-}
      SMTP_STARTTLS: ${SMTP_STARTTLS:-true}
      EBAY_ENVIRONMENT: ${EBAY_ENVIRONMENT:-sandbox}
      EBAY_CLIENT_ID: ${EBAY_CLIENT_ID:-}
      EBAY_CLIENT_SECRET: ${EBAY_CLIENT_SECRET:-}
      EBAY_REDIRECT_URI: ${EBAY_REDIRECT_URI:-}
      EBAY_ALLOW_PRODUCTION: ${EBAY_ALLOW_PRODUCTION:-false}
      EBAY_ACCOUNT_DELETION_VERIFICATION_TOKEN: ${EBAY_ACCOUNT_DELETION_VERIFICATION_TOKEN:-}
      EBAY_ACCOUNT_DELETION_PUBLIC_ORIGIN: ${EBAY_ACCOUNT_DELETION_PUBLIC_ORIGIN:-}
      EBAY_SANDBOX_API_URL: ${EBAY_SANDBOX_API_URL:-https://api.sandbox.ebay.com}
      EBAY_PRODUCTION_API_URL: ${EBAY_PRODUCTION_API_URL:-https://api.ebay.com}
      EBAY_SANDBOX_INVENTORY_API_URL: ${EBAY_SANDBOX_INVENTORY_API_URL:-https://api.sandbox.ebay.com/sell/inventory/v1}
      EBAY_PRODUCTION_INVENTORY_API_URL: ${EBAY_PRODUCTION_INVENTORY_API_URL:-https://api.ebay.com/sell/inventory/v1}
    depends_on:
      artifact-storage-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      nats:
        condition: service_healthy
    volumes:
      - artifact_data:/var/lib/huddle/artifacts
      - artifact_staging:/var/lib/huddle/artifact-staging
      - hf_cache:/var/lib/huddle/hf-cache
    networks:
      - backend
      - frontend
      - webhook_backend
    healthcheck:
      test:
        [
          'CMD',
          'python',
          '-c',
          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:9000/api/health', timeout=3)",
        ]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s
    restart: unless-stopped

  schedule-publisher:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.scheduled_worker', 'scheduler']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      HUDDLE_PUBLIC_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
      REDIS_HOST: redis:6379
      REDIS_KEY_PREFIX: ${REDIS_KEY_PREFIX:-huddle:}
      VLLM_API_KEY: ${VLLM_API_KEY:-EMPTY}
      EXA_API_KEY: ${EXA_API_KEY:-}
      GOOGLE_PLACES_API_KEY: ${GOOGLE_PLACES_API_KEY:-}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    networks:
      - backend
    restart: unless-stopped

  notification-live-worker:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.live_outbox_worker', 'notifications']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      WEB_PUSH_VAPID_PUBLIC_KEY: ${WEB_PUSH_VAPID_PUBLIC_KEY:-}
      WEB_PUSH_VAPID_PRIVATE_KEY: ${WEB_PUSH_VAPID_PRIVATE_KEY:-}
      WEB_PUSH_VAPID_SUBJECT: ${WEB_PUSH_VAPID_SUBJECT:-}
      WEB_PUSH_ENABLED: ${WEB_PUSH_ENABLED:-false}
      HUDDLE_PUBLIC_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    networks:
      - backend
      # Web Push must reach external browser push providers.
      - frontend
    restart: unless-stopped

  schedule-live-worker:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.live_outbox_worker', 'schedules']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    networks:
      - backend
    restart: unless-stopped

  chat-thread-live-worker:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.live_outbox_worker', 'chat.threads']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    networks:
      - backend
    restart: unless-stopped

  scheduled-task-worker:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.scheduled_worker', 'worker']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      ARTIFACT_BLOB_ROOT: /var/lib/huddle/artifacts
      ARTIFACT_VISION_MAX_EDGE_PX: ${ARTIFACT_VISION_MAX_EDGE_PX:-2048}
      ARTIFACT_SVG_MAX_BYTES: ${ARTIFACT_SVG_MAX_BYTES:-5242880}
      ARTIFACT_HTML_MAX_BYTES: ${ARTIFACT_HTML_MAX_BYTES:-5242880}
      ARTIFACT_HTML_MAX_IMAGES: ${ARTIFACT_HTML_MAX_IMAGES:-10}
      ARTIFACT_HTML_MIN_IMAGE_DIMENSION_PX: ${ARTIFACT_HTML_MIN_IMAGE_DIMENSION_PX:-32}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      HUDDLE_PUBLIC_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
      REDIS_HOST: redis:6379
      REDIS_KEY_PREFIX: ${REDIS_KEY_PREFIX:-huddle:}
      VLLM_API_KEY: ${VLLM_API_KEY:-EMPTY}
      HTTP_TIMEOUT: ${HTTP_TIMEOUT:-300}
      HTTPX_MAX_CONNECTIONS: ${HTTPX_MAX_CONNECTIONS:-100}
      HTTP_MAX_KEEPALIVE: ${HTTP_MAX_KEEPALIVE:-20}
      CHAT_HEIC_MODE: ${CHAT_HEIC_MODE:-passthrough}
      CHAT_CONTEXT_USAGE_TIMEOUT_SECONDS: ${CHAT_CONTEXT_USAGE_TIMEOUT_SECONDS:-2.0}
      EXA_API_KEY: ${EXA_API_KEY:-}
      GOOGLE_PLACES_API_KEY: ${GOOGLE_PLACES_API_KEY:-}
      EBAY_ENVIRONMENT: ${EBAY_ENVIRONMENT:-sandbox}
      EBAY_CLIENT_ID: ${EBAY_CLIENT_ID:-}
      EBAY_CLIENT_SECRET: ${EBAY_CLIENT_SECRET:-}
      EBAY_REDIRECT_URI: ${EBAY_REDIRECT_URI:-}
      EBAY_ALLOW_PRODUCTION: ${EBAY_ALLOW_PRODUCTION:-false}
      EBAY_SANDBOX_API_URL: ${EBAY_SANDBOX_API_URL:-https://api.sandbox.ebay.com}
      EBAY_PRODUCTION_API_URL: ${EBAY_PRODUCTION_API_URL:-https://api.ebay.com}
      EBAY_SANDBOX_INVENTORY_API_URL: ${EBAY_SANDBOX_INVENTORY_API_URL:-https://api.sandbox.ebay.com/sell/inventory/v1}
      EBAY_PRODUCTION_INVENTORY_API_URL: ${EBAY_PRODUCTION_INVENTORY_API_URL:-https://api.ebay.com/sell/inventory/v1}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    volumes:
      - artifact_data:/var/lib/huddle/artifacts
    networks:
      - backend
      - frontend
      - webhook_backend
    restart: unless-stopped

  artifact-index-worker:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.artifact_index_worker']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      ARTIFACT_BLOB_ROOT: /var/lib/huddle/artifacts
      ARTIFACT_VISION_MAX_EDGE_PX: ${ARTIFACT_VISION_MAX_EDGE_PX:-2048}
      ARTIFACT_SVG_MAX_BYTES: ${ARTIFACT_SVG_MAX_BYTES:-5242880}
      ARTIFACT_HTML_MAX_BYTES: ${ARTIFACT_HTML_MAX_BYTES:-5242880}
      ARTIFACT_HTML_MAX_IMAGES: ${ARTIFACT_HTML_MAX_IMAGES:-10}
      ARTIFACT_HTML_MIN_IMAGE_DIMENSION_PX: ${ARTIFACT_HTML_MIN_IMAGE_DIMENSION_PX:-32}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      HUDDLE_PUBLIC_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
      REDIS_HOST: redis:6379
      REDIS_KEY_PREFIX: ${REDIS_KEY_PREFIX:-huddle:}
      VLLM_API_KEY: ${VLLM_API_KEY:-EMPTY}
      HTTP_TIMEOUT: ${HTTP_TIMEOUT:-300}
      HTTPX_MAX_CONNECTIONS: ${HTTPX_MAX_CONNECTIONS:-100}
      HTTP_MAX_KEEPALIVE: ${HTTP_MAX_KEEPALIVE:-20}
      CHAT_HEIC_MODE: ${CHAT_HEIC_MODE:-passthrough}
      CHAT_CONTEXT_USAGE_TIMEOUT_SECONDS: ${CHAT_CONTEXT_USAGE_TIMEOUT_SECONDS:-2.0}
      EXA_API_KEY: ${EXA_API_KEY:-}
      GOOGLE_PLACES_API_KEY: ${GOOGLE_PLACES_API_KEY:-}
      EBAY_ENVIRONMENT: ${EBAY_ENVIRONMENT:-sandbox}
      EBAY_CLIENT_ID: ${EBAY_CLIENT_ID:-}
      EBAY_CLIENT_SECRET: ${EBAY_CLIENT_SECRET:-}
      EBAY_REDIRECT_URI: ${EBAY_REDIRECT_URI:-}
      EBAY_ALLOW_PRODUCTION: ${EBAY_ALLOW_PRODUCTION:-false}
      EBAY_SANDBOX_API_URL: ${EBAY_SANDBOX_API_URL:-https://api.sandbox.ebay.com}
      EBAY_PRODUCTION_API_URL: ${EBAY_PRODUCTION_API_URL:-https://api.ebay.com}
      EBAY_SANDBOX_INVENTORY_API_URL: ${EBAY_SANDBOX_INVENTORY_API_URL:-https://api.sandbox.ebay.com/sell/inventory/v1}
      EBAY_PRODUCTION_INVENTORY_API_URL: ${EBAY_PRODUCTION_INVENTORY_API_URL:-https://api.ebay.com/sell/inventory/v1}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    volumes:
      - artifact_data:/var/lib/huddle/artifacts
      - hf_cache:/var/lib/huddle/hf-cache
    networks:
      - backend
      - frontend
      - webhook_backend
    restart: unless-stopped

  web:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-web:${HUDDLE_IMAGE_TAG:-dev}
    networks:
      - frontend
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1/healthz']
      interval: 10s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  landing:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-landing-web:${HUDDLE_IMAGE_TAG:-dev}
    environment:
      HUDDLE_APP_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
    networks:
      - frontend
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1/healthz']
      interval: 10s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  caddy:
    image: caddy:2-alpine
    environment:
      HUDDLE_HOSTNAME: ${HUDDLE_HOSTNAME:-localhost}
      HUDDLE_LANDING_HOSTNAME: ${HUDDLE_LANDING_HOSTNAME:-landing.localhost}
      HUDDLE_AUTH_HOSTNAME: ${HUDDLE_AUTH_HOSTNAME:-auth.localhost}
      HUDDLE_TLS_ISSUER: ${HUDDLE_TLS_ISSUER:-internal}
    configs:
      - source: caddyfile
        target: /etc/caddy/Caddyfile
    ports:
      - name: http
        target: 80
        published: ${HUDDLE_HTTP_PORT:-80}
        protocol: tcp
      - name: https
        target: 443
        published: ${HUDDLE_HTTPS_PORT:-443}
        protocol: tcp
      - name: http3
        target: 443
        published: ${HUDDLE_HTTPS_PORT:-443}
        protocol: udp
    volumes:
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      api:
        condition: service_healthy
      web:
        condition: service_healthy
      landing:
        condition: service_healthy
    networks:
      - frontend
    healthcheck:
      test:
        ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1:2019/config/']
      interval: 10s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  # The eBay webhook tunnel is for environments without a public domain (local
  # and LAN staging). Start it with `--profile tunnel`; production does not need it.
  ebay-webhook-gateway:
    image: caddy:2-alpine
    profiles: ['tunnel']
    configs:
      - source: ebay_webhook_caddyfile
        target: /etc/caddy/Caddyfile
    depends_on:
      api:
        condition: service_healthy
    networks:
      - webhook_edge
      - webhook_backend
    healthcheck:
      test:
        ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1:2019/config/']
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 5s
    restart: unless-stopped

  cloudflared:
    image: cloudflare/cloudflared:latest
    profiles: ['tunnel']
    command: ['tunnel', '--no-autoupdate', '--url', 'http://ebay-webhook-gateway:8080']
    depends_on:
      ebay-webhook-gateway:
        condition: service_healthy
    networks:
      - webhook_edge
    restart: unless-stopped

configs:
  zitadel_caddyfile:
    file: ./zitadel.Caddyfile
  caddyfile:
    file: ./Caddyfile
  ebay_webhook_caddyfile:
    file: ./ebay-webhook.Caddyfile

networks:
  frontend:
  webhook_edge:
  webhook_backend:
    internal: true
  backend:
    internal: true

volumes:
  zitadel_bootstrap:
  postgres_data:
  redis_data:
  nats_data:
  caddy_data:
  caddy_config:
  artifact_data:
  artifact_staging:
  hf_cache:
services:
  api:
    image: docker.io/harlenalvarez/huddle-api:2026.10.20-1@sha256:d5090108522ca3721ba8491b4f1ee9deb7b37eea8c493045d97449eb61d77ca2
  artifact-index-worker:
    image: docker.io/harlenalvarez/huddle-api:2026.10.20-1@sha256:d5090108522ca3721ba8491b4f1ee9deb7b37eea8c493045d97449eb61d77ca2
  artifact-storage-init:
    image: docker.io/harlenalvarez/huddle-api:2026.10.20-1@sha256:d5090108522ca3721ba8491b4f1ee9deb7b37eea8c493045d97449eb61d77ca2
  caddy:
    image: docker.io/library/caddy:2-alpine@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f
  chat-thread-live-worker:
    image: docker.io/harlenalvarez/huddle-api:2026.10.20-1@sha256:d5090108522ca3721ba8491b4f1ee9deb7b37eea8c493045d97449eb61d77ca2
  cloudflared:
    image: docker.io/cloudflare/cloudflared:latest@sha256:0e56c13c7058fcef9c4f0e7d83372f82330548dbf8f8b366f3d8b506526d93b2
  ebay-webhook-gateway:
    image: docker.io/library/caddy:2-alpine@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f
  landing:
    image: docker.io/harlenalvarez/huddle-landing-web:2026.10.20-1@sha256:5705b48cfc739bd1254137cbf6514022ec69fb8fcfc4d2d55a8158b5cc6f7917
  nats:
    image: docker.io/library/nats:2-alpine@sha256:2ae57dfba3063d5e25fecb75256118c0882a1a2d2cf7d0fba17a7c701df956f6
  nats-tools:
    image: docker.io/natsio/nats-box:latest@sha256:d2f04223f40e016f77922a8115d34b0cd5fad2ec10b19b39316ae92d07f3d295
  notification-live-worker:
    image: docker.io/harlenalvarez/huddle-api:2026.10.20-1@sha256:d5090108522ca3721ba8491b4f1ee9deb7b37eea8c493045d97449eb61d77ca2
  postgres:
    image: docker.io/harlenalvarez/huddle-postgres:2026.10.20-1@sha256:64b01556bdd755cdd71e5392b5d4212348ed1b5f5c180dc0ef45513165b1e5e1
  redis:
    image: docker.io/library/redis:8-alpine@sha256:3811787313eba226a2ef38658c6ccb91cd5e110edc89c37767de373120a0e5a0
  schedule-live-worker:
    image: docker.io/harlenalvarez/huddle-api:2026.10.20-1@sha256:d5090108522ca3721ba8491b4f1ee9deb7b37eea8c493045d97449eb61d77ca2
  schedule-publisher:
    image: docker.io/harlenalvarez/huddle-api:2026.10.20-1@sha256:d5090108522ca3721ba8491b4f1ee9deb7b37eea8c493045d97449eb61d77ca2
  scheduled-task-worker:
    image: docker.io/harlenalvarez/huddle-api:2026.10.20-1@sha256:d5090108522ca3721ba8491b4f1ee9deb7b37eea8c493045d97449eb61d77ca2
  web:
    image: docker.io/harlenalvarez/huddle-web:2026.10.20-1@sha256:2dfabd42a1eb7160a5fb83ed49614a6649dd9e2f1f45d31d9ca4a1833a2adc49
  zitadel:
    image: docker.io/library/caddy:2-alpine@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f
  zitadel-api:
    image: ghcr.io/zitadel/zitadel:v4.19.3@sha256:d8430210beea5319bce553a0e6ff77167e30633535c3e072938c6b675f3c115e
  zitadel-db-init:
    image: docker.io/harlenalvarez/huddle-postgres:2026.10.20-1@sha256:64b01556bdd755cdd71e5392b5d4212348ed1b5f5c180dc0ef45513165b1e5e1
  zitadel-login:
    image: ghcr.io/zitadel/zitadel-login:v4.19.3@sha256:f4fb0eb8acb474e8abba0698dfb69b8b67e0856f5cda9e787c2c67b8205976f3

Docker commands

docker compose -f oci://harlenalvarez/huddle-stack:latest up

Use the above command to pull and run the Compose file. Learn more⁠.

Images used

Image + 1 more
Repository logo

redis

Redis is the world’s fastest data platform for caching, vector search, and NoSQL databases.

Pulls

1B+

Stars

13624

Last Updated

about 19 hours

Image
Repository logo

caddy

Caddy 2 is a powerful, enterprise-ready, open source web server with automatic HTTPS written in Go.

Pulls

500M+

Stars

993

Last Updated

about 16 hours

Image + 1 more
Repository logo

nats

NATS is an open-source, high-performance, cloud native messaging system.

Pulls

100M+

Stars

522

Last Updated

about 17 hours

Image
Repository logo

cloudflare/cloudflared

Client for Cloudflare Tunnel, a daemon that exposes private services through the Cloudflare edge.

Pulls

100M+

Stars

591

Last Updated

2 days

Image
Repository logo

natsio/nats-box

Lightweight container with NATS and NATS Streaming utilities

Pulls

50M+

Stars

5

Last Updated

1 day

Image

harlenalvarez/huddle-postgres

Pulls

2.3K

Stars

0

Last Updated

2 days

Image

harlenalvarez/huddle-api

Pulls

2.1K

Stars

0

Last Updated

1 day

Image

harlenalvarez/huddle-web

Pulls

1.8K

Stars

0

Last Updated

2 days

Image

harlenalvarez/huddle-landing-web

Pulls

894

Stars

0

Last Updated

2 days