Starguard/docker-compose.yml at main · LibreChat-AI/Starguard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Bot + OAuth server only. Point MONGO_HOST at your own MongoDB, or add the
# bundled one by copying override.example.yml to docker-compose.override.yml.
services:
  discord-bot:
    container_name: StarGuardBot
    # Pulled from the GitHub Packages registry, built and signed by this
    # repository's Release workflow. :latest follows the newest stable
    # release; pin STARGUARD_IMAGE_TAG to a version (v1.2.0) if you would
    # rather decide when to move. To build from this checkout instead, add
    # -f docker-compose.build.yml to the command (see that file).
    image: ghcr.io/${STARGUARD_IMAGE_OWNER:-librechat-ai}/starguard-bot:${STARGUARD_IMAGE_TAG:-latest}
    restart: always
    env_file:
      - .env
    healthcheck:
      # python:3.12-slim has neither curl nor wget, so this uses the stdlib.
      # BOT_HEALTH_HOST/PORT default to 127.0.0.1:8080, reachable from inside
      # the container without publishing anything on the host. A generous
      # start_period because the bot has to connect to the Discord gateway
      # before /healthz reports ready.
      test: ["CMD", "python", "-c",
             "import urllib.request, sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:${BOT_HEALTH_PORT:-8080}/healthz', timeout=5).status == 200 else 1)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M
        reservations:
          memory: 128M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - Starguard

  server:
    container_name: StarGuardServer
    # Pulled from the GitHub Packages registry, built and signed by this
    # repository's Release workflow. :latest follows the newest stable
    # release; pin STARGUARD_IMAGE_TAG to a version (v1.2.0) if you would
    # rather decide when to move. To build from this checkout instead, add
    # -f docker-compose.build.yml to the command (see that file).
    image: ghcr.io/${STARGUARD_IMAGE_OWNER:-librechat-ai}/starguard-server:${STARGUARD_IMAGE_TAG:-latest}
    ports:
      # SERVER_PORT is the port published on the host. SERVER_BIND_PORT is the
      # port the application listens on inside the container (default 5000,
      # matching the target side of this mapping); it used to be hardcoded
      # while a different mapping assumed 5000, so any host port other than
      # 5000 was unreachable. If you change SERVER_BIND_PORT, this mapping
      # tracks it automatically.
      # Bound to the loopback interface, so the only thing that can reach
      # the application is a reverse proxy on this host. That is not a
      # restriction: DOMAIN has to be an absolute https URL and is checked
      # at startup, so a proxy terminating TLS is already required, and
      # nothing legitimate ever arrives on this port from off the machine.
      # It also makes TRUSTED_PROXY_COUNT=1 mean what it says. Published on
      # every interface, a client could skip the proxy, reach ProxyFix
      # directly, and put any address it liked in X-Forwarded-For, taking a
      # fresh rate-limit bucket per request. If your proxy runs on another
      # machine, drop the 127.0.0.1 here and set TRUSTED_PROXY_COUNT to
      # match your real hop count, knowing the origin is then reachable
      # without TLS by anything that can route to it.
      - 127.0.0.1:${SERVER_PORT:-5000}:${SERVER_BIND_PORT:-5000}
    restart: always
    env_file:
      - .env
    healthcheck:
      test: ["CMD", "python", "-c",
             "import urllib.request; urllib.request.urlopen('http://127.0.0.1:${SERVER_BIND_PORT:-5000}/healthz')"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M
        reservations:
          memory: 128M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - Starguard

networks:
  Starguard: