KryptoDB/kryptodb-compose.yml at main · HarK-github/KryptoDB · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# KryptoDB — Production Compose File
# Usage: docker compose -f kryptodb-compose.yml up -d
#
# Before first run:
#   1. Copy .env.example to .env and fill in secrets
#   2. Create kryptodb-scope-keys.json with your scope key definitions (see README)
#
# MCP client snippet:
#   docker run -i --rm --env-file .env \
#     -e KRYPTODB_API_KEY=syn_live_<key> \
#     -e KRYPTODB_URL=http://kryptodb:8000 \
#     --network kryptodb_default \
#     ghcr.io/prolomaster/kryptodb:latest mcp

name: kryptodb

services:

  # ── Neo4j ─────────────────────────────────────────────────────────────────
  neo4j:
    image: neo4j:5.21.2-community
    restart: unless-stopped
    environment:
      NEO4J_AUTH: "neo4j/${NEO4J_PASSWORD:-changeme}"
      NEO4J_server_memory_heap_initial__size: "512m"
      NEO4J_server_memory_heap_max__size: "1G"
    volumes:
      - neo4j_data:/data
    # Bolt is internal only; expose browser port only for development
    expose:
      - "7687"
    healthcheck:
      test: ["CMD", "cypher-shell", "-u", "neo4j", "-p", "${NEO4J_PASSWORD:-changeme}", "RETURN 1"]
      interval: 20s
      timeout: 10s
      retries: 5
      start_period: 40s

  # ── Redis ─────────────────────────────────────────────────────────────────
  redis:
    image: redis:7.4-alpine
    restart: unless-stopped
    command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"]
    volumes:
      - redis_data:/data
    expose:
      - "6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ── KryptoDB application ──────────────────────────────────────────────────
  kryptodb:
    image: ghcr.io/prolomaster/kryptodb:${KRYPTODB_VERSION:-latest}
    # For local builds: uncomment the lines below and comment out `image:`
    # build:
    #   context: .
    #   dockerfile: Dockerfile
    restart: unless-stopped
    depends_on:
      neo4j:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      KRYPTODB_ENV: "${KRYPTODB_ENV:-production}"
      NEO4J_URI: "bolt://neo4j:7687"
      NEO4J_USER: "neo4j"
      NEO4J_PASSWORD: "${NEO4J_PASSWORD:-changeme}"
      REDIS_URL: "redis://redis:6379/0"
      KRYPTODB_MASTER_KEY: "${KRYPTODB_MASTER_KEY}"
      # KRYPTODB_ADMIN_API_KEY is NOT passed as an env var in production.
      # It is mounted as a Docker secret file read by the daemon at startup.
      # For local development only, you may set KRYPTODB_ADMIN_API_KEY as an env var.
      KRYPTODB_ADMIN_API_KEY_FILE: "/run/secrets/kryptodb-admin-key.txt"
      # Customer scope keys are always mounted as a secret file.
      KRYPTODB_SCOPE_KEYS_FILE: "/run/secrets/kryptodb-scope-keys.json"
    secrets:
      - kryptodb-admin-key.txt
      - kryptodb-scope-keys.json
    volumes:
      - kryptodb_data:/data
    ports:
      - "8000:8000"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
      interval: 15s
      timeout: 5s
      retries: 4
      start_period: 20s

# ── Volumes ───────────────────────────────────────────────────────────────────
volumes:
  neo4j_data:
  redis_data:
  kryptodb_data:

# ── Secrets (Docker secret files) ─────────────────────────────────────────────
# Create admin key file:
#   printf 'your-admin-key-value' > kryptodb-admin-key.txt && chmod 600 kryptodb-admin-key.txt
#
# After first startup, bootstrap an agent key instead of using curl:
#   kryptodb bootstrap \
#     --agent-id Agent-1 --scopes research \
#     --admin-key-file kryptodb-admin-key.txt \
#     --out-file agent-key.txt
#
# Create scope keys file:
#   printf '{"research":{"key_id":"research:v1","key":"<base64-32-bytes>"}}' \
#     > kryptodb-scope-keys.json && chmod 600 kryptodb-scope-keys.json
secrets:
  kryptodb-admin-key.txt:
    file: ./kryptodb-admin-key.txt
  kryptodb-scope-keys.json:
    file: ./kryptodb-scope-keys.json