story/deploy/server/compose.override.yaml

x-server-backend-environment: &server-backend-environment
  APP_ENV: local
  LOG_LEVEL: info
  DATABASE_URL: postgres://voice:${POSTGRES_PASSWORD}@postgres:5432/voice_platform?sslmode=disable
  REDIS_ADDR: redis:6379
  REDIS_PASSWORD: ${REDIS_PASSWORD}
  REDIS_DB: "0"
  AUTH_ISSUER_URL: ${PUBLIC_ORIGIN}/realms/voice-local
  AUTH_JWKS_URL: http://keycloak:8080/realms/voice-local/protocol/openid-connect/certs
  AUTH_AUDIENCE: voice-platform-web
  OTEL_EXPORTER_OTLP_ENDPOINT: ""
  OBJECT_STORE_ENDPOINT: minio:9000
  OBJECT_STORE_PUBLIC_ENDPOINT: ${PUBLIC_HOST}
  OBJECT_STORE_ACCESS_KEY: ${MINIO_ACCESS_KEY}
  OBJECT_STORE_SECRET_KEY: ${MINIO_SECRET_KEY}
  OBJECT_STORE_EXPORT_BUCKET: private-exports
  OBJECT_STORE_REGION: us-east-1
  OBJECT_STORE_SECURE: "false"
  OBJECT_STORE_PUBLIC_SECURE: "true"
  FIRMWARE_DOWNLOAD_BASE_URL: ${PUBLIC_ORIGIN}
  CURSOR_SIGNING_SECRET: ${CURSOR_SIGNING_SECRET}
  SHARE_TOKEN_SIGNING_SECRET: ${SHARE_TOKEN_SIGNING_SECRET}
  MEMORY_TOOL_BASE_URL: ${PUBLIC_ORIGIN}/internal/v1/tools/memory-search
  MEMORY_TOOL_SIGNING_SECRET: ${MEMORY_TOOL_SIGNING_SECRET}
  MODEL_CREDENTIAL_MASTER_KEY: ${MODEL_CREDENTIAL_MASTER_KEY}
  VIKING_MEMORY_RESOURCE_ID: ${VIKING_MEMORY_RESOURCE_ID:-}
  VIKING_MEMORY_COLLECTION_NAME: ${VIKING_MEMORY_COLLECTION_NAME:-}
  VIKING_MEMORY_EVENT_TYPE: ${VIKING_MEMORY_EVENT_TYPE:-event_v1}
  VIKING_MEMORY_PROFILE_TYPE: ${VIKING_MEMORY_PROFILE_TYPE:-profile_v1}
  EMBEDDING_PROVIDER: local
  VOICE_PROVIDER: ${VOICE_PROVIDER:-mock}

services:
  otel-collector:
    ports: !reset []

  prometheus:
    ports: !reset []

  grafana:
    ports: !reset []

  postgres:
    ports: !reset []
    environment:
      POSTGRES_DB: voice_platform
      POSTGRES_USER: voice
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    restart: unless-stopped

  redis:
    ports: !reset []
    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD}"]
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
    restart: unless-stopped

  minio:
    ports: !reset []
    environment:
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY}
    restart: unless-stopped

  keycloak:
    ports: !reset []
    command: ["start-dev", "--import-realm"]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN_USERNAME}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
      KC_HOSTNAME: ${PUBLIC_ORIGIN}
      KC_HTTP_ENABLED: "true"
      KC_PROXY_HEADERS: xforwarded
      JAVA_OPTS_KC_HEAP: -Xms128m -Xmx384m
    volumes:
      - ./deploy/keycloak:/opt/keycloak/data/import:ro
      - keycloak-data:/opt/keycloak/data
    restart: unless-stopped

  migrate:
    command:
      - -path=/migrations
      - -database=postgres://voice:${POSTGRES_PASSWORD}@postgres:5432/voice_platform?sslmode=disable
      - up

  seed:
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD}
    command:
      - sh
      - -ec
      - |
        sed "s#http://localhost:58180/realms/voice-local#${PUBLIC_ORIGIN}/realms/voice-local#g" /fixtures/local_seed.sql |
          psql -h postgres -U voice -d voice_platform -v ON_ERROR_STOP=1

  api:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      <<: *server-backend-environment
      HTTP_ADDR: 0.0.0.0:8080
      DEVICE_LOCAL_SECRET: ${DEVICE_LOCAL_SECRET:-}
      DEVICE_CREDENTIAL_MASTER_KEY: ${DEVICE_CREDENTIAL_MASTER_KEY}
      RTC_TOKEN_SIGNING_SECRET: ${RTC_TOKEN_SIGNING_SECRET}
      RTC_TOKEN_ISSUER: ${RTC_TOKEN_ISSUER:-local}
      RTC_APP_ID: ${RTC_APP_ID:-local-public-rtc-app}
      RTC_APP_KEY: ""
      RTC_APP_KEY_FILE: ${RTC_APP_KEY_FILE:-/run/secrets/voice-runtime/rtc-app-key}
      VOLC_HARDWARE_PROVISIONING_ENABLED: ${VOLC_HARDWARE_PROVISIONING_ENABLED:-false}
      VOLC_HARDWARE_INSTANCE_ID: ${VOLC_HARDWARE_INSTANCE_ID:-}
      VOLC_HARDWARE_PRODUCT_KEY: ${VOLC_HARDWARE_PRODUCT_KEY:-}
      VOLC_HARDWARE_AGENT_BOT_ID: ${VOLC_HARDWARE_AGENT_BOT_ID:-}
      VOLC_HARDWARE_AGENT_TRANSPORT: ${VOLC_HARDWARE_AGENT_TRANSPORT:-low_load}
      VOLC_HARDWARE_AGENT_MINIMUM_SDK_VERSION: ${VOLC_HARDWARE_AGENT_MINIMUM_SDK_VERSION:-1.0.0}
      VOLC_HARDWARE_PRODUCT_SECRET: ""
      VOLC_HARDWARE_PRODUCT_SECRET_FILE: ${VOLC_HARDWARE_PRODUCT_SECRET_FILE:-}
      VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY: ${VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY:-}
      VOLC_HARDWARE_DEVICE_NAME_PREFIX: ${VOLC_HARDWARE_DEVICE_NAME_PREFIX:-dt-}
      VIKING_MEMORY_API_KEY: ""
      VIKING_MEMORY_API_KEY_FILE: ${VIKING_MEMORY_API_KEY_FILE:-/run/secrets/voice-runtime/viking_memory_api_key}
    volumes:
      - /etc/data-terminal-cloud/voice-runtime:/run/secrets/voice-runtime:ro
    restart: unless-stopped

  callbacks:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      <<: *server-backend-environment
      HTTP_ADDR: 0.0.0.0:8081
      PROVIDER_CALLBACK_SECRET: ${PROVIDER_CALLBACK_SECRET}
      PLATFORM_HEALTH_CALLBACK_SECRET: ${PLATFORM_HEALTH_CALLBACK_SECRET}
      RATE_LIMIT_RPS: "1000"
      RATE_LIMIT_BURST: "1500"
    restart: unless-stopped

  worker:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      <<: *server-backend-environment
      HTTP_ADDR: 0.0.0.0:8082
      MOCK_PROVIDER_BASE_URL: http://mock-provider:8083
      MOCK_PROVIDER_API_KEY: ${MOCK_PROVIDER_API_KEY}
      ALERT_WEBHOOK_URL: http://mock-alert-receiver:8084/webhooks/alerts
      ALERT_WEBHOOK_SECRET: ${ALERT_WEBHOOK_SECRET}
      RTC_APP_ID: ${RTC_APP_ID:-local-public-rtc-app}
      VOLC_ACCESS_KEY_ID: ""
      VOLC_ACCESS_KEY_ID_FILE: ${VOLC_ACCESS_KEY_ID_FILE:-/run/secrets/voice-runtime/volc-access-key-id}
      VOLC_SECRET_ACCESS_KEY: ""
      VOLC_SECRET_ACCESS_KEY_FILE: ${VOLC_SECRET_ACCESS_KEY_FILE:-/run/secrets/voice-runtime/volc-secret-access-key}
      VOLC_RTC_REGION: ${VOLC_RTC_REGION:-cn-north-1}
      VOLC_RTC_API_VERSION: ${VOLC_RTC_API_VERSION:-2024-12-01}
      VOLC_VOICE_CHAT_TEMPLATE_FILE: ${VOLC_VOICE_CHAT_TEMPLATE_FILE:-/run/secrets/voice-runtime/voice-chat-template.json}
      CONTENT_GENERATOR: ${CONTENT_GENERATOR:-local}
      ARK_API_KEY: ""
      ARK_API_KEY_FILE: ${ARK_API_KEY_FILE:-/run/secrets/voice-runtime/ark-api-key}
      ARK_CONTENT_MODEL: ${ARK_CONTENT_MODEL:-}
      CONTENT_SAFETY_PROVIDER: local
      VIKING_MEMORY_API_KEY: ""
      VIKING_MEMORY_API_KEY_FILE: ${VIKING_MEMORY_API_KEY_FILE:-/run/secrets/voice-runtime/viking_memory_api_key}
    volumes:
      - /etc/data-terminal-cloud/voice-runtime:/run/secrets/voice-runtime:ro
    restart: unless-stopped

  mock-provider:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      HTTP_ADDR: 0.0.0.0:8083
      MOCK_PROVIDER_API_KEY: ${MOCK_PROVIDER_API_KEY}
      MOCK_PROVIDER_CALLBACK_URL: http://callbacks:8081/callbacks/v1/vertc/voice-chat
      PROVIDER_CALLBACK_SECRET: ${PROVIDER_CALLBACK_SECRET}
      MOCK_PROVIDER_START_DELAY: 100ms
      MOCK_PROVIDER_DUPLICATE_CALLBACKS: "2"
    restart: unless-stopped

  mock-alert-receiver:
    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      HTTP_ADDR: 0.0.0.0:8084
      ALERT_WEBHOOK_SECRET: ${ALERT_WEBHOOK_SECRET}
    restart: unless-stopped

  web:
    image: data-terminal-cloud-web:${PLATFORM_BUILD_VERSION}
    pull_policy: never
    ports: !reset []
    environment:
      WEB_OIDC_AUTHORITY: ${PUBLIC_ORIGIN}/realms/voice-local
      WEB_OIDC_CLIENT_ID: voice-platform-web
    restart: unless-stopped

  gateway:
    image: nginx:1.30-alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./deploy/server/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
      - /var/www/acme:/var/www/acme:ro
    depends_on:
      - api
      - callbacks
      - keycloak
      - minio
      - web
    restart: unless-stopped

volumes:
  keycloak-data: