compose-files/ai/ai.yaml

services:
  open-webui:
    image: ghcr.io/open-webui/open-webui:0.11.1
    entrypoint:
    - /bin/bash
    - /app/tools/startup.sh
    healthcheck:
      test:
      - CMD
      - curl
      - -f
      - http://localhost:8080/health
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    environment:
    - OLLAMA_BASE_URL=http://ollama-intel-arc:11434
    - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
    - WEBUI_DB_HOST=postgresql
    - DATABASE_URL=${OPEN_WEBUI_DATABASE_URL}
    - ENABLE_TOOL_SERVER_CALLING=true
    - TOOL_SERVER_CALLING=true
    - WEBUI_URL=${WEBUI_URL}
    - ENABLE_OAUTH_SIGNUP=${ENABLE_OAUTH_SIGNUP}
    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
    - OAUTH_PROVIDER_NAME=${OAUTH_PROVIDER_NAME}
    - OPENID_PROVIDER_URL=${OPENID_PROVIDER_URL}
    - OAUTH_CLIENT_ID=${OAUTH_CLIENT_ID}
    - OAUTH_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
    - OAUTH_SCOPES=${OAUTH_SCOPES}
    - OPENID_REDIRECT_URI=${OPENID_REDIRECT_URI}
    networks:
    - traefik_backend
    - postgresql_db-backend
    extra_hosts:
    - host.docker.internal:host-gateway
    volumes:
    - /volume1/docker/open-webui/data:/app/backend/data
    - /volume1/docker/open-webui/startup.sh:/app/tools/startup.sh
    stop_grace_period: 120s
    deploy:
      replicas: 2
      placement:
        max_replicas_per_node: 1
      labels:
      - traefik.enable=true
      - traefik.http.routers.open-webui.rule=Host(`ai.bryanmail.net`)
      - traefik.http.routers.open-webui.tls=true
      - traefik.http.routers.open-webui.tls.certresolver=letsencrypt
      - traefik.http.routers.open-webui.entrypoints=websecure
      - traefik.http.services.open-webui.loadbalancer.server.port=8080
      - traefik.http.services.open-webui.loadbalancer.server.scheme=http
      - traefik.http.services.open-webui.loadbalancer.sticky.cookie=true
      - traefik.http.services.open-webui.loadbalancer.sticky.cookie.name=owui_sticky
      - traefik.http.services.open-webui.loadbalancer.sticky.cookie.secure=true
      - traefik.http.services.open-webui.loadbalancer.sticky.cookie.httponly=true
      - traefik.swarm.network=traefik_backend
  litellm:
    image: docker.litellm.ai/berriai/litellm-database:v1.93.0  # upgraded from v1.92.1; fixes Bedrock parallel tool call truncation bug
    command: --config /app/config.yaml --port 4000
    environment:
    - AWS_ACCESS_KEY_ID=${AI_AWS_ACCESS_KEY_ID}
    - AWS_SECRET_ACCESS_KEY=${AI_AWS_SECRET_ACCESS_KEY}
    - AWS_REGION_NAME=${AWS_REGION_NAME}
    - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY}
    - LITELLM_SALT_KEY=${LITELLM_SALT_KEY}
    - DATABASE_URL=${DATABASE_URL}
    - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    - LITELLM_MODIFY_PARAMS=${LITELLM_MODIFY_PARAMS}
    - LITELLM_DATABASE_MIGRATIONS=${LITELLM_DATABASE_MIGRATIONS}
    networks:
    - traefik_backend
    - postgresql_db-backend
    volumes:
    - type: bind
      source: /volume1/docker/litellm/app/config.yaml
      target: /app/config.yaml
      read_only: true
    deploy:
      labels:
      - traefik.enable=true
      - traefik.http.routers.litellm.rule=Host(`llm.bryanmail.net`)
      - traefik.http.routers.litellm.tls=true
      - traefik.http.routers.litellm.tls.certresolver=letsencrypt
      - traefik.http.routers.litellm.entrypoints=websecure
      - traefik.http.services.litellm.loadbalancer.server.port=4000
      - traefik.http.services.litellm.loadbalancer.server.scheme=http
      - traefik.swarm.network=traefik_backend
      - traefik.http.routers.litellm.middlewares=forwardAuth-authentik@file, crowdsec@file,
        litellm-headers
      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Forwarded-For=
      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Forwarded-Host=
      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Forwarded-Proto=
      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Forwarded-Port=
      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Real-Ip=
      update_config:
        parallelism: 1
        delay: 15s
        failure_action: rollback
  searxng:
    image: searxng/searxng:latest
    environment:
    - SEARXNG_BASE_URL=http://searxng:8080
    volumes:
    - /volume1/docker/searxng/etc/searxng:/etc/searxng
    networks:
    - traefik_backend
  mcpo-critical: #do not modify or Proxmox access will be lost
    image: ghcr.io/open-webui/mcpo:main
    command:
    - --config
    - /app/config/config.json
    - --api-key
    - ${MCPO_API_KEY}
    - --hot-reload
    environment:
    - PROXMOX_ALLOW_UNSAFE_COMMANDS=false
    volumes:
    - /volume1/docker/mcpo/config-critical.json:/app/config/config.json:ro
    - /volume1/docker/mcpo/data:/mcpo_data
    - /volume1/docker/cronicle/ssh_keys:/app/ssh_keys:ro
    - /volume1/docker/mcpo/uv-cache:/app/uv-cache
    networks:
    - traefik_backend
    deploy:
      labels:
      - traefik.enable=false
  mcpo:
    image: ghcr.io/open-webui/mcpo:main
    command:
    - --config
    - /app/config/config.json
    - --api-key
    - ${MCPO_API_KEY}
    - --hot-reload
    environment:
    - PROXMOX_ALLOW_UNSAFE_COMMANDS=true
    volumes:
    - /volume1/docker/mcpo/config.json:/app/config/config.json:ro
    - /volume1/docker/mcpo/data:/mcpo_data
    - /volume1/docker/cronicle/ssh_keys:/app/ssh_keys:ro
    - /volume1/docker/mcpo/uv-cache:/app/uv-cache
    networks:
    - traefik_backend
    deploy:
      labels:
      - traefik.enable=false
  n8n:
    image: docker.n8n.io/n8nio/n8n
    networks:
    - traefik_backend
    - postgresql_db-backend
    volumes:
    - /volume1/docker/n8n/data:/home/node/.n8n
    - /volume1/docker/n8n/files:/files
    deploy:
      labels:
      - traefik.enable=true
      - traefik.http.routers.n8n.rule=Host(`agent.bryanmail.net`)
      - traefik.http.routers.n8n.tls=true
      - traefik.http.routers.n8n.tls.certresolver=letsencrypt
      - traefik.http.routers.n8n.entrypoints=websecure
      - traefik.http.services.n8n.loadbalancer.server.port=5678
      - traefik.http.services.n8n.loadbalancer.server.scheme=http
      - traefik.http.middlewares.n8n.headers.SSLRedirect=true
      - traefik.http.middlewares.n8n.headers.STSSeconds=31536000
      - traefik.http.middlewares.n8n.headers.browserXSSFilter=true
      - traefik.http.middlewares.n8n.headers.contentTypeNosniff=true
      - traefik.http.middlewares.n8n.headers.forceSTSHeader=true
      - traefik.http.middlewares.n8n.headers.SSLHost=${DOMAIN_NAME}
      - traefik.http.middlewares.n8n.headers.STSIncludeSubdomains=true
      - traefik.http.middlewares.n8n.headers.STSPreload=true
      - traefik.http.routers.n8n.middlewares=forwardAuth-authentik@file, crowdsec@file
      - traefik.swarm.network=traefik_backend
networks:
  traefik_backend:
    external: true
  postgresql_db-backend:
    external: true