docker-compose.yml

services:
  graph:
    profiles: [""]
    build:
      context: .
    # Localhost-bound, not the bare "8000:8000": the key below is committed, so publishing on
    # every interface would hand the graph to anyone on the network. Drop the prefix to reach
    # this from another machine, and set your own key in the same edit.
    ports:
      - "127.0.0.1:8000:8000"
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://localhost:8000/healthcheck')",
        ]
      interval: 10s
      timeout: 5s
      retries: 3
    depends_on:
      neo4j:
        condition: service_healthy
    # Everything else comes straight from .env, so the settings documented in .env.example
    # reach the container. Listing them individually would pass a blank for each one left
    # out, and blank is not unset: SEMAPHORE_LIMIT is read as int(os.getenv(...)), so '' is a
    # crash on import.
    env_file:
      - path: .env
        required: false
    # Compose-specific wiring, which has to win over .env — these hostnames only exist on the
    # compose network. environment takes precedence over env_file.
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      # Mandatory, so the stack needs one to boot. Named insecure- because it is committed and
      # protects nothing; the localhost binding above is what does.
      - GRAPHITI_API_KEY=${GRAPHITI_API_KEY:-insecure-local-dev-key}
      - NEO4J_URI=bolt://neo4j:${NEO4J_PORT:-7687}
      - NEO4J_USER=${NEO4J_USER:-neo4j}
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
      - DB_BACKEND=neo4j
      # Pinned because the CMD honours PORT: the mapping and healthcheck both name 8000, so a
      # PORT inherited from .env would move the server out from under them. To publish
      # elsewhere, change the left-hand side of the mapping.
      - PORT=8000
  neo4j:
    image: neo4j:5.26.2
    profiles: [""]
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -qO- http://localhost:${NEO4J_PORT:-7474} || exit 1",
        ]
      interval: 1s
      timeout: 10s
      retries: 10
      start_period: 3s
    # Localhost-bound, as above, with more at stake: the password defaults to `password` and
    # Bolt is unmediated write access.
    ports:
      - "127.0.0.1:7474:7474" # HTTP
      - "127.0.0.1:${NEO4J_PORT:-7687}:${NEO4J_PORT:-7687}" # Bolt
    volumes:
      - neo4j_data:/data
    environment:
      - NEO4J_AUTH=${NEO4J_USER:-neo4j}/${NEO4J_PASSWORD:-password}

  falkordb:
    # Kept in step with render.yaml so local dev matches what Render runs.
    image: falkordb/falkordb:v4.20.1
    profiles: ["falkordb"]
    # Localhost-bound, as above, and FalkorDB has no password at all. On Render it's a pserv
    # reachable only from graphiti-api; this is the closest local equivalent.
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - falkordb_data:/var/lib/falkordb/data
    environment:
      # REDIS_ARGS goes to redis-server, FALKORDB_ARGS to the module. The flags that used to
      # sit in FALKORDB_ARGS were redis-server flags in the module's slot, and both were
      # already the defaults. Append-only matches render.yaml.
      - REDIS_ARGS=--appendonly yes
    healthcheck:
      test: ["CMD", "redis-cli", "-p", "6379", "ping"]
      interval: 1s
      timeout: 10s
      retries: 10
      start_period: 3s
  graph-falkordb:
    build:
      args:
        INSTALL_FALKORDB: "true"
      context: .
    profiles: ["falkordb"]
    # Localhost-bound, as above.
    ports:
      - "127.0.0.1:8001:8000"
    depends_on:
      falkordb:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/healthcheck')"]
      interval: 10s
      timeout: 5s
      retries: 3
    # See the note on the graph service above.
    env_file:
      - path: .env
        required: false
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      # See the note on the graph service above.
      - GRAPHITI_API_KEY=${GRAPHITI_API_KEY:-insecure-local-dev-key}
      - FALKORDB_HOST=falkordb
      - FALKORDB_PORT=6379
      - FALKORDB_DATABASE=default_db
      - DB_BACKEND=falkordb
      # Pinned as on the graph service above. Published on 8001 to leave 8000 free for the
      # neo4j profile; the container still listens on 8000.
      - PORT=8000

volumes:
  neo4j_data:
  falkordb_data: