brain/docker-compose.yml at main · lobrzut/brain · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
# Brain — edge profile (lightweight core, no Ollama/GPU)
#
# Three services, one image — mirrors linux/install.sh's systemd layout:
#   dashboard       FastAPI UI + REST API                      :7860
#   mcp-gateway     mcp-proxy, INTERNAL ONLY (no published port)
#   mcp-auth-proxy  Bearer-gated public entrypoint to MCP       :7862
#
# Put a reverse proxy (Caddyfile in this repo) in front for TLS + a domain.
# data/ persists in the brain-data volume — vault, library, vectordb, tokens.
#
# Quick start:
#   docker compose up -d --build
#   # SET THE ADMIN PASSWORD IMMEDIATELY — until you do, /api/auth/setup is open
#   # and every /api/* endpoint requires no login at all. Do this over a LAN/SSH
#   # tunnel BEFORE opening :7860 to the internet, or firewall it until done:
#   curl -X POST http://127.0.0.1:7860/api/auth/setup -H 'content-type: application/json' \
#     -d '{"username":"admin","password":"<a real password, 4+ chars minimum>"}'
#
services:
  dashboard:
    build: .
    image: brain-core:latest
    restart: unless-stopped
    ports:
      - "7860:7860"
    volumes:
      - brain-data:/data
    environment:
      - BRAIN_DATA_DIR=/data
      - BRAIN_EMBED_BACKEND=fastembed

  mcp-gateway:
    image: brain-core:latest
    restart: unless-stopped
    # No `ports:` — only mcp-auth-proxy is reachable from outside the
    # compose network. Other services reach this one as http://mcp-gateway:7863.
    # mcp-proxy (PyPI, sparfenyuk) multiplexes brain-vault/brain-library
    # (filesystem servers) + brain-rag (mcp_rag.py, default/unnamed server)
    # behind one HTTP/SSE port — verified against the real production
    # invocation running on the live brain server (systemctl cat
    # brain-mcp-http.service), NOT the supergateway --multiServerConfig flag
    # this originally shipped with, which no longer exists in supergateway 3.x.
    working_dir: /app/dashboard
    command: >
      mcp-proxy --host 0.0.0.0 --port 7863 --pass-environment
      --named-server brain-vault "mcp-server-filesystem /data/vault"
      --named-server brain-library "mcp-server-filesystem /data/library"
      python mcp_rag.py
    volumes:
      - brain-data:/data
    environment:
      - BRAIN_DATA_DIR=/data
      - BRAIN_EMBED_BACKEND=fastembed
    depends_on:
      - dashboard

  mcp-auth-proxy:
    image: brain-core:latest
    restart: unless-stopped
    ports:
      - "7862:7862"
    working_dir: /app
    command: >
      python -m uvicorn pipeline.mcp_auth_proxy:app
      --host 0.0.0.0 --port 7862
    volumes:
      - brain-data:/data
    environment:
      - BRAIN_DATA_DIR=/data
      - BRAIN_MCP_UPSTREAM=http://mcp-gateway:7863
      - BRAIN_MCP_BIND=0.0.0.0:7862
      # Set to 1 only if you trust everything on the compose network (e.g.
      # the dashboard talking to MCP directly) — does NOT affect external
      # callers, who always need a Bearer token from /api/mcp/tokens.
      - BRAIN_MCP_ALLOW_LOCAL=0
    depends_on:
      - mcp-gateway

volumes:
  brain-data: