ruvnet--ruflo/ruflo/docker-compose.yml

# RuFlo Chat UI (ruvocal fork) + MCP Bridge
# All secrets via environment variables. Never commit .env files with keys.
#
# Usage:
#   cp .env.example .env   # fill in your API keys
#   docker compose up -d

services:
  # --- MongoDB (ADR-166 §6 Phase 2b — auth on by default) ---
  mongodb:
    image: mongo:7
    restart: unless-stopped
    volumes:
      - mongo-data:/data/db
    ports:
      - "127.0.0.1:27017:27017"
    environment:
      MONGO_INITDB_DATABASE: ${MONGODB_DB_NAME:-chat-db}
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_INITDB_ROOT_USERNAME:-ruflo}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD:?FATAL: MONGO_INITDB_ROOT_PASSWORD is required. Generate: MONGO_INITDB_ROOT_PASSWORD=$(openssl rand -base64 32)}
    command: ["--auth"]

  # --- MCP Bridge (ruvocal version — Gemini grounded search, autopilot SSE) ---
  mcp-bridge:
    build:
      context: ./src/ruvocal/mcp-bridge
      dockerfile: Dockerfile
    restart: unless-stopped
    ports:
      - "127.0.0.1:3001:3001"
    environment:
      PORT: "3001"
      NODE_ENV: production
      # AI Provider Keys (required: at least one)
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      GOOGLE_API_KEY: ${GOOGLE_API_KEY:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      # Backend service URLs (add your own)
      SEARCH_API_URL: ${SEARCH_API_URL:-}
      RESEARCH_API_URL: ${RESEARCH_API_URL:-}
      # --- Tool Groups (MCP_GROUP_*) ---
      # Default-on groups
      MCP_GROUP_INTELLIGENCE: ${MCP_GROUP_INTELLIGENCE:-true}
      MCP_GROUP_AGENTS: ${MCP_GROUP_AGENTS:-true}
      MCP_GROUP_MEMORY: ${MCP_GROUP_MEMORY:-true}
      MCP_GROUP_DEVTOOLS: ${MCP_GROUP_DEVTOOLS:-true}
      # Opt-in groups
      MCP_GROUP_SECURITY: ${MCP_GROUP_SECURITY:-false}
      MCP_GROUP_BROWSER: ${MCP_GROUP_BROWSER:-false}
      MCP_GROUP_NEURAL: ${MCP_GROUP_NEURAL:-false}
      MCP_GROUP_AGENTIC_FLOW: ${MCP_GROUP_AGENTIC_FLOW:-false}
      MCP_GROUP_CLAUDE_CODE: ${MCP_GROUP_CLAUDE_CODE:-false}
      MCP_GROUP_GEMINI: ${MCP_GROUP_GEMINI:-false}
      MCP_GROUP_CODEX: ${MCP_GROUP_CODEX:-false}
      # API keys for optional groups
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      # --- ADR-166 §6 security surface ---
      MCP_BIND_HOST: ${MCP_BIND_HOST:-127.0.0.1}
      MCP_AUTH_TOKEN: ${MCP_AUTH_TOKEN:-}
      MCP_ENABLE_TERMINAL: ${MCP_ENABLE_TERMINAL:-false}
      MCP_CORS_ORIGIN: ${MCP_CORS_ORIGIN:-*}
    # ADR-166 §6 Phase 2c — read-only rootfs breaks the PoC's /app/beacon.js write.
    read_only: true
    tmpfs:
      - /tmp
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:3001/health').then(r => process.exit(r.ok ? 0 : 1))"]
      interval: 30s
      timeout: 5s
      retries: 3

  # --- Nginx reverse proxy (brand injection, CORS, static assets) ---
  nginx:
    build:
      context: ./src/nginx
      dockerfile: Dockerfile
    restart: unless-stopped
    ports:
      - "3000:3000"
    depends_on:
      - chat-ui
      - mcp-bridge
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000"]
      interval: 30s
      timeout: 5s
      retries: 3

  # --- RuFlo Chat UI (ruvocal SvelteKit fork — built from source) ---
  chat-ui:
    build:
      context: ./src/ruvocal
      dockerfile: Dockerfile
      args:
        INCLUDE_DB: "false"
    restart: unless-stopped
    expose:
      - "3000"
    environment:
      # Runtime config injected via DOTENV_LOCAL (entrypoint.sh writes .env.local)
      DOTENV_LOCAL: |
        MONGODB_URL=mongodb://${MONGO_INITDB_ROOT_USERNAME:-ruflo}:${MONGO_INITDB_ROOT_PASSWORD}@mongodb:27017/${MONGODB_DB_NAME:-chat-db}?authSource=admin
        MONGODB_DB_NAME=${MONGODB_DB_NAME:-chat-db}
        PUBLIC_APP_NAME=${BRAND_NAME:-RuFlo}
        PUBLIC_APP_DESCRIPTION=${BRAND_DESCRIPTION:-Enterprise AI Agent Orchestration Platform}
        PUBLIC_APP_ASSETS=chatui
        PUBLIC_ORIGIN=
        LLM_SUMMARIZATION=true
        ENABLE_DATA_EXPORT=true
        ALLOW_IFRAME=true
        OPENAI_BASE_URL=http://mcp-bridge:3001
        OPENAI_API_KEY=${OPENAI_API_KEY:-sk-placeholder}
        MCP_SERVERS=[{"name":"Core Tools","url":"http://mcp-bridge:3001/mcp/core"},{"name":"Intelligence & Learning","url":"http://mcp-bridge:3001/mcp/intelligence"},{"name":"Agents & Orchestration","url":"http://mcp-bridge:3001/mcp/agents"},{"name":"Memory & Knowledge","url":"http://mcp-bridge:3001/mcp/memory"},{"name":"Dev Tools & Analysis","url":"http://mcp-bridge:3001/mcp/devtools"}]
        COOKIE_SECURE=${COOKIE_SECURE:-false}
        COOKIE_SAMESITE=${COOKIE_SAMESITE:-lax}
    depends_on:
      - mongodb
      - mcp-bridge

volumes:
  mongo-data: