am-i-alive/docker-compose.yml at main · Muadiv/am-i-alive · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
services:
  # =============================================================================
  # OBSERVER - The public face, vote system, death controller
  # =============================================================================
  observer:
    build: ./observer
    container_name: am-i-alive-observer
    restart: unless-stopped
    ports:
      - "8085:8080"  # Public web interface
    environment:
      - DATABASE_PATH=/app/data/observer.db
      - VAULT_PATH=/app/vault
      - AI_API_URL=http://ai:8000
      - LOG_LEVEL=INFO
      - TZ=Europe/Prague
      - ADMIN_TOKEN=${ADMIN_TOKEN}
      - INTERNAL_API_KEY=${INTERNAL_API_KEY}
    volumes:
      - observer-data:/app/data          # Votes, deaths, public logs
      - ./vault:/app/vault                # Credential vault (host-mounted for access)
      - memories:/app/memories            # Shared memories (observer writes, AI reads)
    networks:
      - frontend
      - internal
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # =============================================================================
  # AI - The living entity's "body"
  # =============================================================================
  ai:
    build: ./ai
    container_name: am-i-alive-ai
    restart: "no"  # Observer controls restarts (death/respawn)
    environment:
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
      - OPENROUTER_REFERER=${OPENROUTER_REFERER:-https://am-i-alive.muadiv.com.ar}
      - OPENROUTER_TITLE=${OPENROUTER_TITLE:-Am I Alive - Genesis}
      - GEMINI_API_KEY=${GEMINI_API_KEY}
      - X_API_KEY=${X_API_KEY}
      - X_API_SECRET=${X_API_SECRET}
      - X_ACCESS_TOKEN=${X_ACCESS_TOKEN}
      - X_ACCESS_TOKEN_SECRET=${X_ACCESS_TOKEN_SECRET}
      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
      - TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID}
      - OBSERVER_URL=http://observer:8080
      - BOOTSTRAP_MODE=${BOOTSTRAP_MODE:-basic_facts}
      - PYTHONUNBUFFERED=1  # Force unbuffered output for complete logs
      - TZ=Europe/Prague
      - INTERNAL_API_KEY=${INTERNAL_API_KEY}
    volumes:
      - ai-workspace:/app/workspace       # AI's sandbox (wiped on death)
      - ai-credits:/app/credits           # Credits persist across deaths
      - memories:/app/memories:ro         # Read-only access to memories
    networks:
      - internal
      - external  # Needs internet for OpenRouter API
    depends_on:
      - observer
      - proxy
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        mode: "non-blocking"  # Don't block on log writes
    # Resource limits - AI can't hog the system
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    # Security - drop privileges
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  # =============================================================================
  # PROXY - Monitors AI traffic, captures credentials for vault
  # =============================================================================
  proxy:
    build: ./proxy
    container_name: am-i-alive-proxy
    restart: unless-stopped
    environment:
      - VAULT_PATH=/app/vault
      - LOG_LEVEL=INFO
      - TZ=Europe/Prague
    volumes:
      - ./vault:/app/vault                # Write captured secrets here
      - proxy-logs:/app/logs              # Traffic logs
    networks:
      - internal
      - external

networks:
  frontend:
    driver: bridge
    # Exposed to host (and Cloudflare tunnel)
  internal:
    driver: bridge
    internal: true
    # No internet access - only container-to-container
  external:
    driver: bridge
    # Proxy's internet access

volumes:
  observer-data:
    name: am-i-alive-observer-data
  ai-workspace:
    name: am-i-alive-ai-workspace
  ai-credits:
    name: am-i-alive-ai-credits  # Persistent credit tracking
  memories:
    name: am-i-alive-memories
  proxy-logs:
    name: am-i-alive-proxy-logs