# ============================================================================ # Banking demo — memory-enabled CopilotKit Intelligence stack. # # Vendored from the proven `memory-chat` local recipe in the Intelligence # repo (docker-compose.deps.yml + docker-compose.yml + run-demo.sh). It stands # up everything the durable cross-thread memory feature needs: # # postgres (pgvector) :7156 app DB + halfvec memory store # redis :7158 session / realtime fan-out # minio :7160 realtime-gateway event archive (S3 API) # minio console :7161 # tei :7167 Qwen3-Embedding-0.6B embeddings sidecar # intelligence :7050 app-api (REST /api/memories + gated /mcp) # :7053 realtime-gateway (thread/conversation state) # # `intelligence` is the single composite image (Dockerfile.composite) that # runs app-api + realtime-gateway + thread-culler + the db-migrations oneshot # under s6-overlay. The MEMORY_ENABLED / SL_ENABLED gates are compiled into # app-api, so the memory MCP tools and the /api/memories REST surface come # from the same binary the demo will eventually ship as a standalone app. # # cd examples/showcases/banking # docker compose up -d --wait # # The build context for the `intelligence` image is the Intelligence repo # checkout (it is NOT vendored into this repo — its Dockerfile.composite does # `COPY . .` over the whole Intelligence workspace). Point INTELLIGENCE_REPO # at your local checkout; it defaults to the sibling layout used on the # reference machine. Once built, the image is tagged `cpki/intelligence-composite` # and reused on subsequent `up`s. # # Seeded by the app-db-migrations seed.sql (run by the composite's migrations # oneshot before app-api starts): # org casa-de-erlang project elixir4days # key cpk_sPRVSEED_seed0privat0longtoken00 # users jordan-beamson / morgan-fluxx # ============================================================================ name: banking-memory services: postgres: image: pgvector/pgvector:0.8.2-pg16 ports: # Banking-specific host-port range (715x) so a bare `docker compose up` # coexists with a developer's Intelligence dev deps (which use 705x). - "${POSTGRES_HOST_PORT:-7156}:5432" environment: POSTGRES_USER: intelligence POSTGRES_PASSWORD: intelligence POSTGRES_DB: postgres volumes: - postgres-data:/var/lib/postgresql/data # Creates intelligence_app + intelligence_app_shadow on first boot # (the migrations oneshot and app-api connect to intelligence_app). - ./docker/app-postgres-init:/docker-entrypoint-initdb.d:ro healthcheck: test: ["CMD-SHELL", "pg_isready -U intelligence -d intelligence_app"] interval: 5s timeout: 3s retries: 5 restart: unless-stopped redis: image: redis:7-alpine ports: - "${REDIS_HOST_PORT:-7158}:6379" volumes: - redis-data:/data healthcheck: test: ["CMD", "redis-cli", "ping"] interval: 5s timeout: 3s retries: 5 restart: unless-stopped minio: image: minio/minio:latest command: server /data --console-address ":9001" ports: - "${MINIO_HOST_PORT:-7160}:9000" - "${MINIO_CONSOLE_HOST_PORT:-7161}:9001" environment: MINIO_ROOT_USER: minioadmin MINIO_ROOT_PASSWORD: minioadmin volumes: - minio-data:/data healthcheck: test: ["CMD", "mc", "ready", "local"] interval: 10s timeout: 5s retries: 5 start_period: 10s restart: unless-stopped # One-shot: create the bucket the realtime-gateway archives events into. # `mc ready local` in minio's healthcheck guarantees the server is up first, # but the embedded Docker DNS resolver can briefly fail to resolve the `minio` # service name at container start, so retry `mc alias set` until it resolves. # The `$$` escapes compose interpolation so the container shell sees `$`. minio-init: image: minio/mc:latest depends_on: minio: condition: service_healthy entrypoint: - /bin/sh - -c - | i=0 until mc alias set local http://minio:9000 minioadmin minioadmin; do i=$$((i + 1)) if [ "$$i" -ge 30 ]; then echo 'minio unreachable after 30 tries' >&2; exit 1; fi echo 'waiting for minio dns/health...'; sleep 2 done mc mb --ignore-existing local/realtime-gateway-events echo 'minio bucket ready' restart: "no" # OpenAI-compatible embeddings sidecar. The cpu-1.9.3 tag publishes a # linux/amd64 manifest ONLY (no arm64 build), so on Apple Silicon Docker runs # it under emulation, where the Candle/safetensors backend is unavailable and # TEI falls back to the ONNX/ORT backend — which needs onnx/model.onnx files # that Qwen3-Embedding-0.6B does not publish (404), so it crash-loops. On # amd64/CI this is native and works. # # Therefore this service is gated behind the `cpu-fallback` profile: a bare # `docker compose up` does NOT start it. Apple Silicon runs a native Metal TEI # on the host instead (see run-demo.sh / README), pointing app-api at it via # MEMORY_EMBEDDINGS_URL=http://host.docker.internal:7067 (same version 1.9.3, # same model, byte-identical embeddings). On amd64/CI, opt back in with # `docker compose --profile cpu-fallback up -d --wait`. `intelligence`'s # dependency on tei is `required: false`, so it starts fine without it. tei: image: ghcr.io/huggingface/text-embeddings-inference:cpu-1.9.3 profiles: ["cpu-fallback"] platform: linux/amd64 # --auto-truncate is empirically required for the cpu-1.9.x image to serve # Qwen3-Embedding-0.6B (max_input_length 32768) cleanly; truncation is the # right behavior for memory content (capped at 8192 chars upstream). command: [ "--model-id", "Qwen/Qwen3-Embedding-0.6B", "--port", "80", "--auto-truncate", "--max-batch-tokens", "${TEI_MAX_BATCH_TOKENS:-16384}", ] ports: - "${TEI_HOST_PORT:-7167}:80" volumes: - tei-model-cache:/data healthcheck: test: ["CMD", "curl", "-fsS", "http://localhost:80/health"] interval: 10s timeout: 5s retries: 30 # First boot downloads the model and runs a warmup forward pass; on CPU # (especially x86 under emulation) this can take several minutes, so give # it a generous grace before counting failures. start_period: 600s restart: unless-stopped # app-api (:4201 -> host 7050) + realtime-gateway (:4401 -> host 7053) + # thread-culler + the db-migrations oneshot, all under s6-overlay. Built # from the Intelligence repo's Dockerfile.composite (memory/SL gates are # compiled in). The migrations oneshot runs graphile-migrate + seed.sql # against postgres before app-api/gateway start, so the seeded org/key/users # exist by the time the surface is healthy. intelligence: image: cpki/intelligence-composite:local build: context: ${INTELLIGENCE_REPO:-../../../../Intelligence} dockerfile: Dockerfile.composite ports: - "${APP_API_HOST_PORT:-7050}:4201" - "${GATEWAY_HOST_PORT:-7053}:4401" environment: DATABASE_URL: postgresql://intelligence:intelligence@postgres:5432/intelligence_app REDIS_URL: redis://redis:6379 MEMORY_ENABLED: "true" SL_ENABLED: "true" # REQUIRED — memory MCP tools attach by extending the SL /mcp server # Embedder is pluggable. Default = the bundled `tei` container (self-contained, # correct on amd64/CI/deploy). On a RAM-constrained Apple-Silicon dev box the # emulated TEI can OOM (exit 137); override to a host/native embedder, e.g. # MEMORY_EMBEDDINGS_URL=http://host.docker.internal:7067 docker compose up -d --wait \ # postgres redis minio minio-init intelligence # (omits the bundled tei — its dependency below is required:false). MEMORY_EMBEDDINGS_URL: ${MEMORY_EMBEDDINGS_URL:-http://tei:80} MEMORY_EMBEDDING_MODEL: Qwen/Qwen3-Embedding-0.6B # NOTE (main migration): main dropped the legacy DEFAULT_ORGANIZATION_ID. # Org is resolved from the authenticated cpk key (seeded to casa-de-erlang); # the header default falls back to 'self_hosted' when unset. COPILOTKIT_LICENSE_TOKEN: "${COPILOTKIT_LICENSE_TOKEN:-}" # main migration: self-hosted memory is gated behind a signed offline # license carrying the `memory` feature (MEMORY_NOT_ENTITLED otherwise). # BAKED_LICENSE_KEYS_JSON bakes the public key the verifier trusts, so a # locally-minted dev enterprise license (scripts/mint-dev-license) unlocks # memory without any master-key attestation. Dev-only local values. BAKED_LICENSE_KEYS_JSON: "${BAKED_LICENSE_KEYS_JSON:-}" # Auth / runtime secrets (exactly as in the reference run-demo.sh; the # AUTH_SECRET must be >= 32 chars per auth-server's env schema). These # are dev-only local values. AUTH_SECRET: "local-dev-auth-secret-at-least-32-bytes-long-000" AUTH_TRUST_HOST: "true" # main renamed the deployment-mode env and uses an underscore value; # the legacy `DEPLOYMENT_MODE=self-hosted` is rejected (crash-loop). INTELLIGENCE_DEPLOYMENT_MODE: self_hosted RUNNER_AUTH_SECRET: dev-runner-secret SECRET_KEY_BASE: local-realtime-gateway-secret-key-base-at-least-64-bytes-long PHX_HOST: localhost # S3 (minio) wiring for the realtime-gateway event archive. S3_ENDPOINT: http://minio:9000 S3_BUCKET: realtime-gateway-events S3_ACCESS_KEY_ID: minioadmin S3_SECRET_ACCESS_KEY: minioadmin S3_REGION: us-east-1 depends_on: postgres: condition: service_healthy redis: condition: service_healthy minio: condition: service_healthy minio-init: condition: service_completed_successfully tei: condition: service_healthy # Optional: when an external embedder is supplied via MEMORY_EMBEDDINGS_URL, # bring the stack up without the bundled tei (`up ... intelligence` omitting tei). required: false healthcheck: # app-api answers /api/health on 4201; gateway listens on 4401. test: [ "CMD-SHELL", "curl -fsS http://127.0.0.1:4201/api/health && nc -z 127.0.0.1 4401", ] interval: 10s timeout: 5s retries: 6 start_period: 90s restart: unless-stopped volumes: postgres-data: redis-data: minio-data: tei-model-cache: