docker-compose.yml

services:
  opensearch:
    image: langflowai/openrag-opensearch:${OPENRAG_VERSION:-latest}
    # build:
    #   context: .
    #   dockerfile: Dockerfile
    container_name: os
    depends_on:
      - openrag-backend
    environment:
      - discovery.type=single-node
      - OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_PASSWORD}
      - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g
    # NOTE: do NOT add `extra_hosts: openrag-backend:host-gateway` here.
    # `extra_hosts` writes to /etc/hosts, which libc resolves BEFORE
    # docker DNS — so the alias overrides docker-compose service-name
    # resolution unconditionally and routes OpenSearch's JWKS lookup to
    # the host gateway. In CI the host has nothing on port 8000, so JWT
    # validation breaks (every /search returns 401). Dev-local users who
    # run `make backend` on the host need the alias and should add it via
    # an override file (see AGENTS.md → Operational constraints).
    ports:
      - "9200:9200"
      - "9600:9600"
    volumes:
      - opensearch-data:/usr/share/opensearch/data
    stop_grace_period: 2m
    healthcheck:
      test: ["CMD-SHELL", "curl -ku admin:$$OPENSEARCH_PASSWORD 'https://localhost:9200/_cluster/health' -s | grep -qE '\"status\":\"(green|yellow)\"'"]
      interval: 15s
      timeout: 10s
      retries: 20
      start_period: 60s
    restart: unless-stopped

  dashboards:
    image: opensearchproject/opensearch-dashboards:3.0.0
    container_name: osdash
    depends_on:
      - opensearch
    environment:
      OPENSEARCH_HOSTS: '["https://${OPENSEARCH_HOST:-opensearch}:${OPENSEARCH_PORT:-9200}"]'
      OPENSEARCH_USERNAME: "${OPENSEARCH_USERNAME:-admin}"
      OPENSEARCH_PASSWORD: ${OPENSEARCH_PASSWORD}
    ports:
      - "5601:5601"

  openrag-backend:
    image: langflowai/openrag-backend:${OPENRAG_VERSION:-latest}
    build:
      context: .
      dockerfile: Dockerfile.backend
    container_name: openrag-backend
    depends_on:
      - langflow
    environment:
      - OPENSEARCH_HOST=${OPENSEARCH_HOST:-opensearch}
      - LANGFLOW_URL=http://langflow:7860
      - OPENRAG_BACKEND_INTERNAL_URL=${OPENRAG_BACKEND_INTERNAL_URL:-http://openrag-backend:8000}
      - OPENRAG_BACKEND_ROUTER_ENABLE=${OPENRAG_BACKEND_ROUTER_ENABLE:-false}
      - LANGFLOW_PUBLIC_URL=${LANGFLOW_PUBLIC_URL}
      - LANGFLOW_AUTO_LOGIN=${LANGFLOW_AUTO_LOGIN}
      - LANGFLOW_SUPERUSER=${LANGFLOW_SUPERUSER}
      - LANGFLOW_SUPERUSER_PASSWORD=${LANGFLOW_SUPERUSER_PASSWORD}
      - LANGFLOW_CHAT_FLOW_ID=${LANGFLOW_CHAT_FLOW_ID}
      - LANGFLOW_INGEST_FLOW_ID=${LANGFLOW_INGEST_FLOW_ID}
      - LANGFLOW_URL_INGEST_FLOW_ID=${LANGFLOW_URL_INGEST_FLOW_ID}
      - DISABLE_INGEST_WITH_LANGFLOW=${DISABLE_INGEST_WITH_LANGFLOW:-false}
      - INGEST_SAMPLE_DATA=${INGEST_SAMPLE_DATA:-true}
      - NUDGES_FLOW_ID=${NUDGES_FLOW_ID}
      - OPENSEARCH_PORT=${OPENSEARCH_PORT:-9200}
      - LANGFLOW_OPENSEARCH_HOST=${LANGFLOW_OPENSEARCH_HOST:-${OPENSEARCH_HOST:-opensearch}}
      - LANGFLOW_OPENSEARCH_PORT=${LANGFLOW_OPENSEARCH_PORT:-${OPENSEARCH_PORT:-9200}}
      - OPENSEARCH_USERNAME=${OPENSEARCH_USERNAME:-admin}
      - OPENSEARCH_PASSWORD=${OPENSEARCH_PASSWORD}
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - WATSONX_API_KEY=${WATSONX_API_KEY}
      - WATSONX_ENDPOINT=${WATSONX_ENDPOINT}
      - WATSONX_PROJECT_ID=${WATSONX_PROJECT_ID}
      - OLLAMA_ENDPOINT=${OLLAMA_ENDPOINT}
      - GOOGLE_OAUTH_CLIENT_ID=${GOOGLE_OAUTH_CLIENT_ID}
      - GOOGLE_OAUTH_CLIENT_SECRET=${GOOGLE_OAUTH_CLIENT_SECRET}
      - MICROSOFT_GRAPH_OAUTH_CLIENT_ID=${MICROSOFT_GRAPH_OAUTH_CLIENT_ID}
      - MICROSOFT_GRAPH_OAUTH_CLIENT_SECRET=${MICROSOFT_GRAPH_OAUTH_CLIENT_SECRET}
      - WEBHOOK_BASE_URL=${WEBHOOK_BASE_URL}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
      - AWS_S3_ENDPOINT=${AWS_S3_ENDPOINT}
      - AWS_REGION=${AWS_REGION}
      - IBM_COS_API_KEY=${IBM_COS_API_KEY}
      - IBM_COS_SERVICE_INSTANCE_ID=${IBM_COS_SERVICE_INSTANCE_ID}
      - IBM_COS_ENDPOINT=${IBM_COS_ENDPOINT}
      - IBM_COS_HMAC_ACCESS_KEY_ID=${IBM_COS_HMAC_ACCESS_KEY_ID}
      - IBM_COS_HMAC_SECRET_ACCESS_KEY=${IBM_COS_HMAC_SECRET_ACCESS_KEY}
      - IBM_COS_AUTH_ENDPOINT=${IBM_COS_AUTH_ENDPOINT}
      - OPENSEARCH_INDEX_NAME=${OPENSEARCH_INDEX_NAME:-documents}
      - LANGFLOW_KEY=${LANGFLOW_KEY}
      - SEGMENT_WRITE_KEY=${SEGMENT_WRITE_KEY:-}
      - ENVIRONMENT=${ENVIRONMENT:-production}
      - LANGFLOW_KEY_RETRIES=${LANGFLOW_KEY_RETRIES:-15}
      - LANGFLOW_KEY_RETRY_DELAY=${LANGFLOW_KEY_RETRY_DELAY:-2.0}
      - LANGFLOW_VERSION=${LANGFLOW_VERSION}
      - LOG_FORMAT=${LOG_FORMAT}
      - SERVICE_NAME=${SERVICE_NAME}
      - SESSION_SECRET=${SESSION_SECRET:-your-secret-key-change-in-production}
      - JWT_SIGNING_KEY=${JWT_SIGNING_KEY}
      - OPENRAG_ENCRYPTION_KEY=${OPENRAG_ENCRYPTION_KEY}
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
      - NO_COLOR=${NO_COLOR:-}
      - ACCESS_LOG=${ACCESS_LOG:-true}
      - LANGFLOW_TIMEOUT=${LANGFLOW_TIMEOUT:-2400}
      - LANGFLOW_CONNECT_TIMEOUT=${LANGFLOW_CONNECT_TIMEOUT:-30}
      - INGESTION_TIMEOUT=${INGESTION_TIMEOUT:-3600}
      - UPLOAD_BATCH_SIZE=${UPLOAD_BATCH_SIZE:-25}
      - MAX_WORKERS=${MAX_WORKERS:-4}
      - IBM_AUTH_ENABLED=${IBM_AUTH_ENABLED:-false}
      - PLATFORM_AUTH_DEV_MODE=${PLATFORM_AUTH_DEV_MODE:-false}
      - PLATFORM_USERNAME=${PLATFORM_USERNAME}
      - PLATFORM_PASSWORD=${PLATFORM_PASSWORD}
      - DOCLING_SERVE_URL=${DOCLING_SERVE_URL:-http://host.docker.internal:5001}
      - DOCLING_SERVE_VERIFY_SSL=${DOCLING_SERVE_VERIFY_SSL:-true}
    volumes:
      - ${OPENRAG_DOCUMENTS_PATH:-./openrag-documents}:/app/openrag-documents:U,z
      - ${OPENRAG_KEYS_PATH:-./keys}:/app/keys:U,z
      - ${OPENRAG_FLOWS_PATH:-./flows}:/app/flows:U,z
      - ${OPENRAG_FLOWS_BACKUP_PATH:-./flows/backup}:/app/flows/backup:U,z
      - ${OPENRAG_CONFIG_PATH:-./config}:/app/config:U,z
      - ${OPENRAG_DATA_PATH:-./data}:/app/data:U,z
    # Linux: Docker Engine does not auto-inject host.docker.internal; map it to the host gateway
    extra_hosts:
      - "host.docker.internal:host-gateway"

  openrag-frontend:
    image: langflowai/openrag-frontend:${OPENRAG_VERSION:-latest}
    build:
      context: .
      dockerfile: Dockerfile.frontend
    container_name: openrag-frontend
    depends_on:
      - openrag-backend
    environment:
      - OPENRAG_BACKEND_HOST=openrag-backend
    ports:
      - "${FRONTEND_PORT:-3000}:3000"

  langflow:
    image: langflowai/openrag-langflow:${OPENRAG_VERSION:-latest}
    build:
      context: .
      dockerfile: Dockerfile.langflow
    container_name: langflow
    ports:
      - "${LANGFLOW_PORT:-7860}:7860"
    volumes:
      - ${OPENRAG_FLOWS_PATH:-./flows}:/app/flows:U,z
      - ${LANGFLOW_DATA_PATH:-./langflow-data}:/app/langflow-data:U,z
    # Linux: Docker Engine does not auto-inject host.docker.internal; map it to the host gateway
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      - LANGFUSE_SECRET_KEY=${LANGFUSE_SECRET_KEY:-}
      - LANGFUSE_PUBLIC_KEY=${LANGFUSE_PUBLIC_KEY:-}
      - LANGFUSE_HOST=${LANGFUSE_HOST:-}
      - LANGFLOW_DEACTIVATE_TRACING
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - WATSONX_APIKEY=${WATSONX_API_KEY}
      - WATSONX_URL=${WATSONX_URL:-${WATSONX_ENDPOINT}}
      - WATSONX_PROJECT_ID=${WATSONX_PROJECT_ID}
      - WATSONX_MAX_RETRIES=${WATSONX_MAX_RETRIES:-10}
      - WATSONX_DELAY_TIME=${WATSONX_DELAY_TIME:-0.5}
      - OLLAMA_BASE_URL=${OLLAMA_ENDPOINT}
      - LANGFLOW_CONFIG_DIR=/app/langflow-data
      - LANGFLOW_DATABASE_URL=${LANGFLOW_DATABASE_URL:-sqlite:////app/langflow-data/langflow.db}
      - LANGFLOW_SECRET_KEY=${LANGFLOW_SECRET_KEY}
      - JWT=None
      - OWNER=None
      - OWNER_NAME=None
      - OWNER_EMAIL=None
      - CONNECTOR_TYPE=system
      - CONNECTOR_TYPE_URL=url
      - DOCUMENT_ID=None
      - SOURCE_URL=None
      - ALLOWED_USERS=[]
      - ALLOWED_GROUPS=[]
      - ALLOWED_PRINCIPALS=[]
      - OPENRAG-QUERY-FILTER="{}"
      - OPENRAG_INGEST_URL=OPENRAG_INGEST_URL
      - OPENRAG_INGEST_TOKEN=OPENRAG_INGEST_TOKEN
      - OPENRAG_INGEST_RUN_ID=OPENRAG_INGEST_RUN_ID
      - OPENRAG_INGEST_BATCH_SIZE=100
      - OPENSEARCH_PASSWORD=${OPENSEARCH_PASSWORD}
      - OPENSEARCH_HOST=${LANGFLOW_OPENSEARCH_HOST:-${OPENSEARCH_HOST:-opensearch}}
      - OPENSEARCH_PORT=${LANGFLOW_OPENSEARCH_PORT:-${OPENSEARCH_PORT:-9200}}
      - OPENSEARCH_URL=https://${LANGFLOW_OPENSEARCH_HOST:-${OPENSEARCH_HOST:-opensearch}}:${LANGFLOW_OPENSEARCH_PORT:-${OPENSEARCH_PORT:-9200}}
      - OPENSEARCH_INDEX_NAME=${OPENSEARCH_INDEX_NAME:-documents}
      - DOCLING_SERVE_URL=${DOCLING_SERVE_URL:-http://host.docker.internal:5001}
      - DOCLING_TASK_ID=None
      - FILENAME=None
      - MIMETYPE=None
      - FILESIZE=0
      - SELECTED_EMBEDDING_MODEL=${SELECTED_EMBEDDING_MODEL:-text-embedding-3-small}
      - LANGFLOW_VARIABLES_TO_GET_FROM_ENVIRONMENT=JWT,OPENRAG-QUERY-FILTER,OPENSEARCH_PASSWORD,OPENSEARCH_URL,DOCLING_SERVE_URL,DOCLING_TASK_ID,OWNER,OWNER_NAME,OWNER_EMAIL,CONNECTOR_TYPE,DOCUMENT_ID,SOURCE_URL,ALLOWED_USERS,ALLOWED_GROUPS,ALLOWED_PRINCIPALS,FILENAME,MIMETYPE,FILESIZE,SELECTED_EMBEDDING_MODEL,OPENAI_API_KEY,ANTHROPIC_API_KEY,WATSONX_APIKEY,WATSONX_URL,WATSONX_PROJECT_ID,OLLAMA_BASE_URL,OPENSEARCH_INDEX_NAME,OPENRAG_INGEST_URL,OPENRAG_INGEST_TOKEN,OPENRAG_INGEST_RUN_ID,OPENRAG_INGEST_BATCH_SIZE
      - LANGFLOW_LOG_LEVEL=DEBUG
      - LANGFLOW_WORKERS=${LANGFLOW_WORKERS:-1}
      - LANGFLOW_AUTO_LOGIN=${LANGFLOW_AUTO_LOGIN}
      - LANGFLOW_SUPERUSER=${LANGFLOW_SUPERUSER}
      - LANGFLOW_SUPERUSER_PASSWORD=${LANGFLOW_SUPERUSER_PASSWORD}
      - LANGFLOW_NEW_USER_IS_ACTIVE=${LANGFLOW_NEW_USER_IS_ACTIVE}
      - LANGFLOW_ENABLE_SUPERUSER_CLI=${LANGFLOW_ENABLE_SUPERUSER_CLI}
      # - DEFAULT_FOLDER_NAME=OpenRAG
      - HIDE_GETTING_STARTED_PROGRESS=true

volumes:
  opensearch-data: