docker-compose.yaml
Rama main · réplica de lectura del repositorio original.
# Dograh deployment stack — driven by the helper scripts, not by a bare
# `docker compose up`.
#
# This stack needs a generated .env (secrets, public host/URL) and, for the
# remote/TURN profiles, runtime nginx/coturn config rendered by the dograh-init
# service. The setup scripts create those for you — start with them:
#
# Local: ./start_docker.sh (Windows: .\start_docker.ps1)
# Remote server: sudo ./setup_remote.sh then ./remote_up.sh
#
# Running `docker compose up` against a fresh checkout will fail or come up
# misconfigured (e.g. OSS_JWT_SECRET is required). Full guide:
# https://docs.dograh.com/deployment/docker
services:
postgres:
image: pgvector/pgvector:pg17
environment:
POSTGRES_USER: postgres
# Sourced from .env. Defaults to "postgres"
# NOTE: changing this on an existing install does NOT
# re-key the database — the password is baked into the volume on first init.
# You can manually change the password using psql in the container
POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-postgres}"
POSTGRES_DB: postgres
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
ports:
- "5432:5432"
volumes:
- postgres_data:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres"]
interval: 3s
timeout: 3s
retries: 10
networks:
- app-network
redis:
image: redis:7
ports:
- "6379:6379"
command: >
--requirepass ${REDIS_PASSWORD:-redissecret}
volumes:
- redis_data:/data
healthcheck:
test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-redissecret}", "ping"]
interval: 3s
timeout: 10s
retries: 10
networks:
- app-network
minio:
# Built from the community MinIO fork by github.com/dograh-hq/minio; upstream
# MinIO no longer publishes images.
image: ${REGISTRY:-dograhai}/minio:2026.09.22
container_name: minio
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: "${MINIO_ROOT_USER:-minioadmin}"
MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD:-minioadmin}"
MINIO_API_CORS_ALLOW_ORIGIN: "*"
ports:
- "127.0.0.1:9000:9000" # Bind to localhost explicitly
- "127.0.0.1:9001:9001"
volumes:
- minio-data:/data
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
interval: 10s
timeout: 5s
retries: 5
networks:
- app-network
dograh-init:
image: bash:5.2
container_name: dograh_init
profiles: ["remote", "local-turn"]
environment:
ENVIRONMENT: "${ENVIRONMENT:-local}"
SERVER_IP: "${SERVER_IP:-}"
PUBLIC_HOST: "${PUBLIC_HOST:-}"
PUBLIC_BASE_URL: "${PUBLIC_BASE_URL:-}"
BACKEND_API_ENDPOINT: "${BACKEND_API_ENDPOINT:-http://localhost:8000}"
MINIO_PUBLIC_ENDPOINT: "${MINIO_PUBLIC_ENDPOINT:-http://localhost:9000}"
TURN_HOST: "${TURN_HOST:-}"
TURN_SECRET: "${TURN_SECRET:-}"
FASTAPI_WORKERS: "${FASTAPI_WORKERS:-1}"
volumes:
- ./scripts:/workspace/scripts:ro
- ./deploy:/workspace/deploy:ro
- ./certs:/certs:ro
- nginx-generated:/generated/nginx
- coturn-generated:/generated/coturn
command:
- /workspace/scripts/run_dograh_init.sh
nginx:
image: nginx:alpine
container_name: nginx_https
profiles: ["remote"]
depends_on:
dograh-init:
condition: service_completed_successfully
ui:
condition: service_started
ports:
- "80:80"
- "443:443"
volumes:
- nginx-generated:/etc/nginx/conf.d:ro
- ./certs:/etc/nginx/certs:ro
networks:
- app-network
coturn:
image: coturn/coturn:4.8.0
container_name: coturn
restart: unless-stopped
profiles: ["remote", "local-turn"]
depends_on:
dograh-init:
condition: service_completed_successfully
ports:
- "3478:3478/udp"
- "3478:3478/tcp"
- "5349:5349/udp"
- "5349:5349/tcp"
- "49152-49200:49152-49200/udp"
volumes:
- coturn-generated:/etc/coturn:ro
command:
- -c
- /etc/coturn/turnserver.conf
networks:
- app-network
api:
image: ${REGISTRY:-dograhai}/dograh-api:latest
environment:
# Core application config
ENVIRONMENT: "${ENVIRONMENT:-local}"
LOG_LEVEL: "INFO"
# Set to "false" in .env to disable public signup (invite-only installs).
ENABLE_SIGNUP: "${ENABLE_SIGNUP:-true}"
# Public origin for this deployment. The API derives BACKEND_API_ENDPOINT,
# MINIO_PUBLIC_ENDPOINT and TURN_HOST from PUBLIC_BASE_URL / PUBLIC_HOST when
# they are not set explicitly (see api/constants.py), so a standard remote
# install only needs PUBLIC_BASE_URL + PUBLIC_HOST in .env.
PUBLIC_BASE_URL: "${PUBLIC_BASE_URL:-}"
PUBLIC_HOST: "${PUBLIC_HOST:-}"
# Optional explicit override of the public URL the backend builds webhook /
# embed links from. Defaults to PUBLIC_BASE_URL. When the value is non-public
# (localhost or a private/reserved IP), the API resolves a running Cloudflare
# tunnel's URL at runtime instead (see api/utils/common.py).
BACKEND_API_ENDPOINT: "${BACKEND_API_ENDPOINT:-}"
# Database configuration (using containerized postgres)
DATABASE_URL: "postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/postgres"
# Redis configuration (using containerized redis)
REDIS_URL: "redis://:${REDIS_PASSWORD:-redissecret}@redis:6379"
# Storage configuration - bundled MinIO by default. Set ENABLE_AWS_S3=true
# in .env to make the API use AWS S3 or another S3-compatible server.
ENABLE_AWS_S3: "${ENABLE_AWS_S3:-false}"
# S3 backend configuration. Compose's .env file is used for interpolation,
# but those values are not automatically injected into containers, so pass
# the S3 settings through explicitly.
AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID:-}"
AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY:-}"
AWS_SESSION_TOKEN: "${AWS_SESSION_TOKEN:-}"
S3_BUCKET: "${S3_BUCKET:-}"
S3_REGION: "${S3_REGION:-us-east-1}"
# For a non-AWS S3-compatible server, also set these in Compose's .env
# S3_ENDPOINT_URL e.g. https://s3.example.com
# S3_SIGNATURE_VERSION set "s3v4" if the server requires SigV4 (e.g. rustfs)
# S3_ADDRESSING_STYLE set "path" if the server / TLS cert requires path-style
# The S3 backend issues real presigned URLs, so the bucket can stay private.
S3_ENDPOINT_URL: "${S3_ENDPOINT_URL:-}"
S3_SIGNATURE_VERSION: "${S3_SIGNATURE_VERSION:-}"
S3_ADDRESSING_STYLE: "${S3_ADDRESSING_STYLE:-}"
# MinIO
MINIO_ENDPOINT: "minio:9000"
# Full URL (with scheme) browsers use to reach MinIO. Defaults to
# PUBLIC_BASE_URL for remote deployments (nginx proxies /voice-audio/) and to
# http://localhost:9000 for local; override only for a separate object store.
MINIO_PUBLIC_ENDPOINT: "${MINIO_PUBLIC_ENDPOINT:-}"
MINIO_ACCESS_KEY: "${MINIO_ROOT_USER:-minioadmin}"
MINIO_SECRET_KEY: "${MINIO_ROOT_PASSWORD:-minioadmin}"
MINIO_BUCKET: "voice-audio"
MINIO_SECURE: "false"
# Number of uvicorn worker processes (each is its own process bound to a
# distinct port starting at 8000). dograh-init renders nginx upstreams
# from this value and nginx load-balances across them with least_conn.
FASTAPI_WORKERS: "${FASTAPI_WORKERS:-1}"
# Optional singleton background services started by the container CMD
# (scripts/start_services_docker.sh). Both default to on; set either to
# "false" in .env to run this container as an API/worker node only — e.g. a
# scale-out replica that must not also run the telephony ARI bridge
# (ari_manager) or the outbound campaign loop (campaign_orchestrator).
ENABLE_ARI_MANAGER: "${ENABLE_ARI_MANAGER:-true}"
ENABLE_CAMPAIGN_ORCHESTRATOR: "${ENABLE_CAMPAIGN_ORCHESTRATOR:-true}"
# Scrape /api/v1/metrics on each worker's own port. See deploy/observability.
ENABLE_PROMETHEUS_METRICS: "${ENABLE_PROMETHEUS_METRICS:-false}"
DOGRAH_DEVOPS_SECRET: "${DOGRAH_DEVOPS_SECRET:-}"
# Trust X-Forwarded-* headers from any peer so uvicorn honors nginx's
# `X-Forwarded-Proto: https`. nginx runs as its own container and reaches
# uvicorn from a Docker-network IP (not loopback), but uvicorn trusts only
# 127.0.0.1 by default — so without this it ignores the header, request.url
# comes back as http://…, and inbound webhook signature checks fail for
# every provider at once (telephony providers sign the public https URL, so
# the recomputed signature won't match). "*" trusts all peers; the api port
# (8000) is published, so firewall/harden it at the host — or narrow this
# to your Docker bridge subnet — if that exposure matters to you.
FORWARDED_ALLOW_IPS: "*"
# Langfuse — credentials can be set here or per-organization via the UI
# at /settings. Tracing is automatically active when credentials are
# available; uncomment to set defaults for all organizations.
# LANGFUSE_SECRET_KEY: ""
# LANGFUSE_PUBLIC_KEY: ""
# LANGFUSE_HOST: ""
# LANGFUSE_PROJECT_ID: ""
# Traces are private by default. Set to "true" to make traces in the
# project above readable by anyone holding the trace URL, with no
# Langfuse login. Organizations that connected their own Langfuse project
# in the UI carry their own visibility setting instead.
LANGFUSE_TRACES_PUBLIC: "${LANGFUSE_TRACES_PUBLIC:-false}"
# TURN server configuration (for WebRTC NAT traversal in remote server)
# Uses time-limited credentials via TURN REST API (HMAC-SHA1).
ENABLE_COTURN: "${ENABLE_COTURN:-false}"
TURN_HOST: "${TURN_HOST:-}"
TURN_SECRET: "${TURN_SECRET:-}"
FORCE_TURN_RELAY: "${FORCE_TURN_RELAY:-false}"
SERVER_IP: "${SERVER_IP:-}"
OSS_JWT_SECRET: "${OSS_JWT_SECRET:?OSS_JWT_SECRET must be set to a strong secret}"
# Telephony media WebSocket capability token. The carrier dials the media
# socket back, so its URL is caller-visible and the ids in it are otherwise
# guessable. Set a secret in .env to have providers sign that URL and the
# handler verify it; leave it unset and nothing changes. Roll out in two
# steps: set the secret first (invalid tokens are logged but allowed), then
# set ENFORCE=true once the logs stay clean.
TELEPHONY_WS_TOKEN_SECRET: "${TELEPHONY_WS_TOKEN_SECRET:-}"
TELEPHONY_WS_TOKEN_ENFORCE: "${TELEPHONY_WS_TOKEN_ENFORCE:-false}"
# Telemetry
ENABLE_TELEMETRY: "${ENABLE_TELEMETRY:-true}"
POSTHOG_API_KEY: "phc_ItizB1dP6yv7ZYobbcqrpxTdbomDA8hJFSEmAMdYvIr"
POSTHOG_HOST: "https://us.i.posthog.com"
ports:
- "8000:8000"
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
minio:
condition: service_healthy
healthcheck:
test:
[
"CMD-SHELL",
'python -c "import urllib.request; urllib.request.urlopen(''http://localhost:8000/api/v1/health'').read()"',
]
interval: 30s
timeout: 10s
retries: 3
start_period: 60s
networks:
- app-network
ui:
image: ${REGISTRY:-dograhai}/dograh-ui:latest
environment:
# Bind the Next.js standalone server to all interfaces
HOSTNAME: "0.0.0.0"
# Server-side URL (SSR, internal Docker network)
BACKEND_URL: "${BACKEND_URL:-http://api:8000}"
NODE_ENV: "oss"
# Flag to enable/ disable posthog
ENABLE_TELEMETRY: "${ENABLE_TELEMETRY:-true}"
# Posthog
POSTHOG_KEY: "phc_ItizB1dP6yv7ZYobbcqrpxTdbomDA8hJFSEmAMdYvIr"
POSTHOG_HOST: "https://us.posthog.com"
ports:
- "3010:3010"
depends_on:
api:
condition: service_healthy
healthcheck:
test:
[
"CMD-SHELL",
"wget --no-verbose --tries=1 --spider http://127.0.0.1:3010 || exit 1",
]
interval: 30s
timeout: 10s
retries: 3
start_period: 30s
networks:
- app-network
# Cloudflare tunnel for inbound webhook / WSS reachability when the host has no
# usable public IP (behind NAT or a firewall). Gated behind the "tunnel" profile
# so public-IP installs (served directly by nginx) never start it, and the api
# service no longer hard-depends on it. Two modes, chosen by the token:
# - CLOUDFLARE_TUNNEL_TOKEN set -> named tunnel with a stable hostname. Point
# its ingress at http://api:8000 in the Cloudflare dashboard and set
# BACKEND_API_ENDPOINT in .env to that hostname.
# - token unset -> quick tunnel with an ephemeral
# *.trycloudflare.com URL the API discovers from the metrics endpoint
# (api/utils/tunnel.py). Convenient for local dev.
cloudflared:
image: cloudflare/cloudflared:latest
container_name: cloudflared-tunnel
profiles: ["tunnel"]
restart: unless-stopped
environment:
# cloudflared automatically picks up the token from TUNNEL_TOKEN when
# running `tunnel run`. Leave empty to fall back to a quick tunnel.
TUNNEL_TOKEN: "${CLOUDFLARE_TUNNEL_TOKEN:-}"
# The cloudflared image is distroless (no `sh`), so a `sh -c` conditional
# entrypoint can't run. The image's own entrypoint is already
# `cloudflared --no-autoupdate`; pick the mode via a single command instead:
# - token set -> set CLOUDFLARED_COMMAND="tunnel run" in .env for a named
# tunnel (cloudflared reads TUNNEL_TOKEN from the env above).
# - token unset -> the default below runs a quick tunnel with an ephemeral
# *.trycloudflare.com URL the API discovers from the metrics endpoint.
command: ${CLOUDFLARED_COMMAND:-tunnel --url http://api:8000 --metrics 0.0.0.0:2000}
ports:
- "2000:2000" # metrics endpoint (quick-tunnel URL discovery)
networks:
- app-network
volumes:
postgres_data:
redis_data:
minio-data:
driver: local
nginx-generated:
driver: local
coturn-generated:
driver: local
networks:
app-network:
driver: bridge