Zach Kelling
3095f81028
- Replace all LibreChat/danny-avila image refs with hanzoai/chat - Remove LibreChat branding from UI, emails, docs, and configs - Configure zen4 model series as defaults via api.hanzo.ai - Add Hanzo IAM OIDC authentication (hanzo.id) - Update Docker publish workflow for GHCR + Docker Hub - Add librechat.yaml with Hanzo Cloud endpoint config
131 lines
4.4 KiB
YAML
131 lines
4.4 KiB
YAML
# Hanzo AI Chat - Production Override
|
|
# Use with: docker compose -f compose.yml -f compose.prod.yml up -d
|
|
# Requires Traefik reverse proxy running
|
|
|
|
services:
|
|
# Production chat configuration
|
|
chat:
|
|
image: hanzoai/chat:${VERSION:-latest}
|
|
container_name: hanzo-chat-prod
|
|
restart: unless-stopped
|
|
ports: [] # No direct port exposure in production
|
|
environment:
|
|
# Production settings
|
|
NODE_ENV: production
|
|
DOMAIN_CLIENT: https://hanzo.chat
|
|
DOMAIN_SERVER: https://hanzo.chat
|
|
ALLOW_REGISTRATION: ${ALLOW_REGISTRATION:-false}
|
|
|
|
# All AI requests go through Hanzo API gateway
|
|
OPENAI_BASE_URL: https://api.hanzo.ai/v1
|
|
|
|
# Production secrets (use real values)
|
|
JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
|
|
JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:?JWT_REFRESH_SECRET is required}
|
|
CREDS_KEY: ${CREDS_KEY:?CREDS_KEY is required}
|
|
CREDS_IV: ${CREDS_IV:?CREDS_IV is required}
|
|
OPENAI_API_KEY: ${OPENAI_API_KEY:?OPENAI_API_KEY is required}
|
|
|
|
# Hanzo IAM OpenID Connect
|
|
OPENID_CLIENT_ID: ${OPENID_CLIENT_ID:?OPENID_CLIENT_ID is required}
|
|
OPENID_CLIENT_SECRET: ${OPENID_CLIENT_SECRET:?OPENID_CLIENT_SECRET is required}
|
|
OPENID_ISSUER: https://hanzo.id
|
|
OPENID_SESSION_SECRET: ${OPENID_SESSION_SECRET:?OPENID_SESSION_SECRET is required}
|
|
OPENID_SCOPE: openid profile email
|
|
OPENID_CALLBACK_URL: /oauth/openid/callback
|
|
OPENID_BUTTON_LABEL: Log in with Hanzo
|
|
OPENID_IMAGE_URL: https://hanzo.ai/logo/icon.svg
|
|
OPENID_USERNAME_CLAIM: name
|
|
OPENID_NAME_CLAIM: name
|
|
OPENID_USE_PKCE: "true"
|
|
labels:
|
|
# Traefik routing
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik"
|
|
|
|
# HTTPS router
|
|
- "traefik.http.routers.hanzo-chat.rule=Host(`chat.hanzo.ai`)"
|
|
- "traefik.http.routers.hanzo-chat.entrypoints=websecure"
|
|
- "traefik.http.routers.hanzo-chat.tls=true"
|
|
- "traefik.http.routers.hanzo-chat.tls.certresolver=letsencrypt"
|
|
|
|
# Service
|
|
- "traefik.http.services.hanzo-chat.loadbalancer.server.port=3080"
|
|
|
|
# Security headers
|
|
- "traefik.http.middlewares.hanzo-chat-headers.headers.stsSeconds=31536000"
|
|
- "traefik.http.middlewares.hanzo-chat-headers.headers.stsIncludeSubdomains=true"
|
|
- "traefik.http.middlewares.hanzo-chat-headers.headers.stsPreload=true"
|
|
- "traefik.http.middlewares.hanzo-chat-headers.headers.contentTypeNosniff=true"
|
|
- "traefik.http.middlewares.hanzo-chat-headers.headers.browserXssFilter=true"
|
|
- "traefik.http.middlewares.hanzo-chat-headers.headers.referrerPolicy=strict-origin-when-cross-origin"
|
|
- "traefik.http.middlewares.hanzo-chat-headers.headers.customFrameOptionsValue=SAMEORIGIN"
|
|
|
|
# Apply middlewares
|
|
- "traefik.http.routers.hanzo-chat.middlewares=hanzo-chat-headers"
|
|
networks:
|
|
- hanzo-network
|
|
- traefik
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2'
|
|
memory: 2G
|
|
reservations:
|
|
cpus: '0.5'
|
|
memory: 512M
|
|
|
|
# MongoDB production settings
|
|
mongodb:
|
|
restart: unless-stopped
|
|
volumes:
|
|
- mongodb_data:/data/db
|
|
- mongodb_backup:/backup
|
|
environment:
|
|
MONGO_INITDB_ROOT_USERNAME: ${MONGO_USERNAME:?MONGO_USERNAME is required}
|
|
MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD:?MONGO_PASSWORD is required}
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '1'
|
|
memory: 1G
|
|
|
|
# Meilisearch production settings
|
|
meilisearch:
|
|
restart: unless-stopped
|
|
environment:
|
|
MEILI_ENV: production
|
|
MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?MEILI_MASTER_KEY is required}
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '1'
|
|
memory: 1G
|
|
|
|
# Optional: MongoDB backup service
|
|
mongodb-backup:
|
|
image: hanzoai/mongodb-backup:latest
|
|
container_name: hanzo-mongodb-backup
|
|
restart: unless-stopped
|
|
environment:
|
|
MONGO_URI: mongodb://${MONGO_USERNAME}:${MONGO_PASSWORD}@mongodb:27017/HanzoChat?authSource=admin
|
|
BACKUP_SCHEDULE: "0 2 * * *" # Daily at 2 AM
|
|
BACKUP_RETENTION_DAYS: 7
|
|
S3_BUCKET: ${BACKUP_S3_BUCKET:-}
|
|
AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
|
|
AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
|
|
volumes:
|
|
- mongodb_backup:/backup
|
|
depends_on:
|
|
- mongodb
|
|
networks:
|
|
- hanzo-network
|
|
profiles:
|
|
- with-backup
|
|
|
|
volumes:
|
|
mongodb_backup:
|
|
|
|
networks:
|
|
traefik:
|
|
external: true |