kahmyl/elumra-stack:latest

x-api-environment: &api-environment
  NODE_ENV: production
  API_PORT: "4000"
  DATABASE_URL: postgres://elumra:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/elumra
  PROMPT_HASH_SECRET: ${PROMPT_HASH_SECRET:?Set PROMPT_HASH_SECRET}
  PROTECTION_RUN_TRANSIENT_SECRET: ${PROTECTION_RUN_TRANSIENT_SECRET:?Set PROTECTION_RUN_TRANSIENT_SECRET}
  AUTH_MODE: ${AUTH_MODE:-jwt}
  ALLOW_PUBLIC_DEMO: ${ALLOW_PUBLIC_DEMO:-false}
  AUTH_DEMO_TOKEN: ${DEMO_TOKEN:-}
  AUTH_DEMO_SUBJECT: ${AUTH_DEMO_SUBJECT:-demo-user}
  AUTH_JWKS_URL: ${AUTH_JWKS_URL:-}
  AUTH_ISSUER: ${AUTH_ISSUER:-elumra-demo}
  AUTH_AUDIENCE: ${AUTH_AUDIENCE:-elumra-api}
  API_CORS_ORIGINS: https://${ELUMRA_DOMAIN:?Set ELUMRA_DOMAIN}
  EKO_BASE_URL: http://eko:8080
  EKO_TOKENIZE_BASE_URL: http://eko:8080
  EKO_REDACT_BASE_URL: http://eko-redact:8080
  EKO_PROXY_BASE_URL: http://eko:8080/v1
  EKO_TIMEOUT_MS: ${EKO_TIMEOUT_MS:-2500}
  EKO_SLM_TIMEOUT_MS: ${EKO_SLM_TIMEOUT_MS:-30000}
  EKO_SLM_SIDECAR_URL: http://eko-slm-sidecar:8000
  EKO_MODE: enabled
  EKO_TOKEN_VAULT: redis
  EKO_PROXY_API_KEY: ${EKO_PROXY_API_KEY:-}
  EKO_PROXY_ACCEPTS_PROVIDER_KEYS: ${EKO_PROXY_ACCEPTS_PROVIDER_KEYS:-false}
  APP_REDIS_URL: redis://app-redis:6379/0
  PROTECTION_RUN_QUEUE_NAME: ${PROTECTION_RUN_QUEUE_NAME:-protection-runs}
  PROTECTION_RUN_PAYLOAD_TTL_SECONDS: ${PROTECTION_RUN_PAYLOAD_TTL_SECONDS:-900}
  PROTECTION_RUN_MAX_ATTEMPTS: ${PROTECTION_RUN_MAX_ATTEMPTS:-2}
  PROTECTION_RUN_JOB_TIMEOUT_MS: ${PROTECTION_RUN_JOB_TIMEOUT_MS:-90000}
  ELUMRA_MODEL_PATH: ${ELUMRA_MODEL_PATH:-elumra-router}
  ELUMRA_ENABLE_BYOK: ${ELUMRA_ENABLE_BYOK:-true}
  ELUMRA_ALLOWED_BYOK_PROVIDERS: ${ELUMRA_ALLOWED_BYOK_PROVIDERS:-openai,anthropic,gemini,deepseek,openrouter,groq}
  ELUMRA_ENABLE_MODE_SWITCHER: ${ELUMRA_ENABLE_MODE_SWITCHER:-false}
  ELUMRA_MODEL_PROVIDER: ${ELUMRA_MODEL_PROVIDER:-deepseek}
  ELUMRA_MODEL_NAME: ${ELUMRA_MODEL_NAME:-deepseek-chat}
  MODEL_TIMEOUT_MS: ${MODEL_TIMEOUT_MS:-15000}
  OPENAI_API_KEY: ${OPENAI_API_KEY:-}
  ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
  GEMINI_API_KEY: ${GEMINI_API_KEY:-}
  DEEPSEEK_API_KEY: ${DEEPSEEK_API_KEY:-}
  OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
  GROQ_API_KEY: ${GROQ_API_KEY:-}

services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    environment:
      ELUMRA_DOMAIN: ${ELUMRA_DOMAIN:?Set ELUMRA_DOMAIN}
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    configs:
      - source: caddyfile
        target: /etc/caddy/Caddyfile
    volumes:
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - web
      - api

  web:
    image: kahmyl/elumra:${ELUMRA_IMAGE_TAG:-latest}
    restart: unless-stopped
    command: ["node", "apps/web/scripts/serve-dist.mjs"]
    environment:
      WEB_PORT: "3000"
      ELUMRA_PUBLIC_API_BASE_URL: /v1
      ELUMRA_PUBLIC_AUTH_MODE: ${AUTH_MODE:-jwt}
      ELUMRA_PUBLIC_API_DEMO_TOKEN: ${DEMO_TOKEN:-}
      ELUMRA_PUBLIC_PROTECTION_CLIENT: api
      SUPABASE_URL: ${SUPABASE_URL:-}
      SUPABASE_PUBLISHABLE_KEY: ${SUPABASE_PUBLISHABLE_KEY:-}
    depends_on:
      api:
        condition: service_started

  api:
    image: kahmyl/elumra:${ELUMRA_IMAGE_TAG:-latest}
    restart: unless-stopped
    environment: *api-environment
    depends_on:
      postgres:
        condition: service_healthy
      api-migrate:
        condition: service_completed_successfully
      app-redis:
        condition: service_started
      eko:
        condition: service_started
      eko-redact:
        condition: service_started

  api-worker:
    image: kahmyl/elumra:${ELUMRA_IMAGE_TAG:-latest}
    restart: unless-stopped
    command: ["node", "apps/api/dist/worker.js"]
    environment: *api-environment
    depends_on:
      postgres:
        condition: service_healthy
      api-migrate:
        condition: service_completed_successfully
      app-redis:
        condition: service_started
      eko:
        condition: service_started
      eko-redact:
        condition: service_started

  api-migrate:
    image: kahmyl/elumra:${ELUMRA_IMAGE_TAG:-latest}
    restart: "no"
    command: ["node", "apps/api/scripts/run-sql-migrations.mjs"]
    environment:
      DATABASE_URL: postgres://elumra:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/elumra
    depends_on:
      postgres:
        condition: service_healthy

  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: elumra
      POSTGRES_USER: elumra
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U elumra -d elumra"]
      interval: 5s
      timeout: 5s
      retries: 10

  eko:
    image: openray/eko:main-latest
    restart: unless-stopped
    environment:
      REDIS_URL: redis://eko-redis:6379/0
    configs:
      - source: eko_tokenize
        target: /app/configs/config.yaml
    depends_on:
      - eko-redis
      - eko-slm-sidecar

  eko-redact:
    image: openray/eko:main-latest
    restart: unless-stopped
    environment:
      REDIS_URL: redis://eko-redis:6379/0
    configs:
      - source: eko_redact
        target: /app/configs/config.yaml
    depends_on:
      - eko-redis
      - eko-slm-sidecar

  eko-slm-sidecar:
    image: kahmyl/elumra:slm-${ELUMRA_IMAGE_TAG:-latest}
    restart: unless-stopped
    cpus: ${EKO_SLM_CPUS:-1.0}
    mem_limit: ${EKO_SLM_MEMORY_LIMIT:-1400m}
    memswap_limit: ${EKO_SLM_MEMORY_SWAP_LIMIT:-3g}
    oom_score_adj: 500
    environment:
      HF_HUB_DISABLE_TELEMETRY: "1"
      OMP_NUM_THREADS: ${EKO_SLM_CPU_THREADS:-1}
      MKL_NUM_THREADS: ${EKO_SLM_CPU_THREADS:-1}
      TOKENIZERS_PARALLELISM: "false"
      PRIVACY_FILTER_MODEL_NAME: openai/privacy-filter
      PRIVACY_FILTER_ADAPTER_NAME: iamSamurai/privacy-filter-nigeria
      PRIVACY_FILTER_DEVICE: cpu
      PRIVACY_FILTER_QUANTIZATION: ${EKO_SLM_QUANTIZATION:-int8}
      PRIVACY_FILTER_CPU_THREADS: ${EKO_SLM_CPU_THREADS:-1}
      PRIVACY_FILTER_PORT: "8000"
      HF_TOKEN: ${HF_TOKEN:-}

  eko-redis:
    image: redis:7-alpine
    restart: unless-stopped

  app-redis:
    image: redis:7-alpine
    restart: unless-stopped

volumes:
  postgres_data:
  caddy_data:
  caddy_config:

configs:
  caddyfile:
    content: |
      ${ELUMRA_DOMAIN:?Set ELUMRA_DOMAIN} {
        handle /v1/* {
          reverse_proxy api:4000
        }
        handle {
          reverse_proxy web:3000
        }
        encode zstd gzip
      }
  eko_tokenize:
    content: |
      server:
        port: "8080"
        host: "0.0.0.0"
      logging:
        level: "info"
        format: "json"
        colorize: false
      proxy:
        openai:
          enabled: true
          base_url: "https://api.openai.com/v1"
          timeout: 30
        anthropic:
          enabled: false
          base_url: "https://api.anthropic.com/v1"
          timeout: 30
        google:
          enabled: false
          base_url: "https://generativelanguage.googleapis.com/v1"
          timeout: 30
        behavior:
          on_violation: "sanitize"
          log_requests: false
          add_violation_headers: true
          sanitization_mode: "tokenize"
          token_store_backend: "redis"
          token_ttl_ms: 1800000
          max_vaults: 10000
          max_tokens_per_vault: 100000
        redis:
          addr: "eko-redis:6379"
          username: ""
          password: ""
          db: 0
          key_prefix: "eko:"
          meta_suffix: "vault_meta:"
          payload_suffix: "vault_payload:"
          pool_size: 10
          min_idle_conns: 2
          dial_timeout_ms: 100
          read_timeout_ms: 100
          write_timeout_ms: 100
          max_retries: 3
        slm:
          enabled: true
          endpoint: "http://eko-slm-sidecar:8000"
          timeout_ms: 25000
          max_input_bytes: 16384
          breaker:
            failure_threshold: 5
            cooldown_ms: 30000
        crypto:
          provider: "local"
          active_key_id: "elumra-demo"
          local_master_key: "ZWx1bXJhLWxvY2FsLWRldi10b2tlbi1rZXktMTIzNDU="
          fallback_keys: []
          vault_transit:
            address: "https://vault.example.com"
            token: ""
            namespace: ""
            mount: "transit"
            key_name: "eko-session"
            timeout_ms: 2000
            tls_skip_verify: false
      patterns:
        config_file: "./patterns/default/patterns.yaml"
        custom_patterns_dir: "./patterns/custom"
      compliance:
        enable_reporting: false
        report_dir: "./reports"
        retention_days: 90
  eko_redact:
    content: |
      server:
        port: "8080"
        host: "0.0.0.0"
      logging:
        level: "info"
        format: "json"
        colorize: false
      proxy:
        openai:
          enabled: true
          base_url: "https://api.openai.com/v1"
          timeout: 30
        anthropic:
          enabled: false
          base_url: "https://api.anthropic.com/v1"
          timeout: 30
        google:
          enabled: false
          base_url: "https://generativelanguage.googleapis.com/v1"
          timeout: 30
        behavior:
          on_violation: "sanitize"
          log_requests: false
          add_violation_headers: true
          sanitization_mode: "redact"
          token_store_backend: "memory"
          token_ttl_ms: 1800000
          max_vaults: 10000
          max_tokens_per_vault: 100000
        redis:
          addr: "eko-redis:6379"
          username: ""
          password: ""
          db: 0
          key_prefix: "eko:"
          meta_suffix: "vault_meta:"
          payload_suffix: "vault_payload:"
          pool_size: 10
          min_idle_conns: 2
          dial_timeout_ms: 100
          read_timeout_ms: 100
          write_timeout_ms: 100
          max_retries: 3
        slm:
          enabled: true
          endpoint: "http://eko-slm-sidecar:8000"
          timeout_ms: 25000
          max_input_bytes: 16384
          breaker:
            failure_threshold: 5
            cooldown_ms: 30000
        crypto:
          provider: "local"
          active_key_id: "elumra-demo"
          local_master_key: ""
          fallback_keys: []
          vault_transit:
            address: "https://vault.example.com"
            token: ""
            namespace: ""
            mount: "transit"
            key_name: "eko-session"
            timeout_ms: 2000
            tls_skip_verify: false
      patterns:
        config_file: "./patterns/default/patterns.yaml"
        custom_patterns_dir: "./patterns/custom"
      compliance:
        enable_reporting: false
        report_dir: "./reports"
        retention_days: 90