ciso-assistant-community/docker-compose-build.yml at main · intuitem/ciso-assistant-community · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
services:
  backend:
    container_name: backend
    build:
      context: ./backend
      dockerfile: Dockerfile
      args:
        PYTHON_IMAGE: ${PYTHON_IMAGE:-ghcr.io/intuitem/ciso-assistant-community/mirror/dhi-python:3.14-dev}
    restart: always
    environment:
      - ALLOWED_HOSTS=backend,localhost
      - CISO_ASSISTANT_URL=https://localhost:8443
      - DJANGO_DEBUG=True
      - HOME=/tmp
      - XDG_CACHE_HOME=/tmp/.cache
      - XDG_CONFIG_HOME=/tmp/.config
      - XDG_DATA_HOME=/tmp/.local/share
      - QDRANT_URL=http://qdrant:6333

    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev
    volumes:
      - ./db:/code/db
    user: "1001:1001"

  huey:
    container_name: huey
    build:
      context: ./backend
      dockerfile: Dockerfile
      args:
        PYTHON_IMAGE: ${PYTHON_IMAGE:-ghcr.io/intuitem/ciso-assistant-community/mirror/dhi-python:3.14-dev}
    depends_on:
      - backend
    restart: always
    environment:
      - ALLOWED_HOSTS=backend,localhost
      - CISO_ASSISTANT_URL=https://localhost:8443
      - DJANGO_DEBUG=False
      - HOME=/tmp
      - XDG_CACHE_HOME=/tmp/.cache
      - XDG_CONFIG_HOME=/tmp/.config
      - XDG_DATA_HOME=/tmp/.local/share
      - QDRANT_URL=http://qdrant:6333

    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev
    volumes:
      - ./db:/code/db
    entrypoint:
      - /bin/sh
      - -c
      - |
        python manage.py run_huey -w 2 --scheduler-interval 60
    user: "1001:1001"

  frontend:
    container_name: frontend
    environment:
      - PUBLIC_BACKEND_API_URL=http://backend:8000/api
      - PUBLIC_BACKEND_API_EXPOSED_URL=https://localhost:8443/api
      - PROTOCOL_HEADER=x-forwarded-proto
      - HOST_HEADER=x-forwarded-host
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev
    build:
      context: ./frontend
      dockerfile: Dockerfile
      # DHI via the GHCR mirror; see frontend/Dockerfile for why not dhi.io
      args:
        NODE_BUILD_IMAGE: ${NODE_BUILD_IMAGE:-ghcr.io/intuitem/ciso-assistant-community/mirror/dhi-node:24-dev}
        NODE_RUNTIME_IMAGE: ${NODE_RUNTIME_IMAGE:-ghcr.io/intuitem/ciso-assistant-community/mirror/dhi-node:24}
    depends_on:
      - backend
    restart: always

  qdrant:
    container_name: qdrant
    image: ${QDRANT_IMAGE:-qdrant/qdrant:v1.19.1}
    restart: unless-stopped
    volumes:
      - qdrant_data:/qdrant/storage
    ports:
      - 127.0.0.1:6333:6333

  # see docker-compose.yml for the profile / no-ports / read-only rationale
  mcp:
    container_name: mcp
    build:
      context: ./cli
      dockerfile: Dockerfile
      # DHI via the GHCR mirror; see cli/Dockerfile for why not dhi.io
      args:
        PYTHON_BUILD_IMAGE: ${PYTHON_BUILD_IMAGE:-ghcr.io/intuitem/ciso-assistant-community/mirror/dhi-python:3.14-dev}
        PYTHON_RUNTIME_IMAGE: ${PYTHON_RUNTIME_IMAGE:-ghcr.io/intuitem/ciso-assistant-community/mirror/dhi-python:3.14}
    profiles:
      - mcp
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped
    environment:
      - API_URL=http://backend:8000/api
      - CA_MCP_TRANSPORT=streamable-http
      - CA_MCP_HOST=0.0.0.0
      - CA_MCP_PORT=8001
      - CA_MCP_READ_ONLY=true
      - CA_MCP_ALLOWED_HOSTS=localhost:8443
      - CA_MCP_ALLOW_ENV_TOKEN=false
      - HOME=/tmp
      - XDG_CACHE_HOME=/tmp/.cache
      - XDG_CONFIG_HOME=/tmp/.config
      - XDG_DATA_HOME=/tmp/.local/share
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev
    user: "1001:1001"

  caddy:
    container_name: caddy
    image: ${CADDY_IMAGE:-caddy:2.11.4}
    environment:
      - CISO_ASSISTANT_URL=https://localhost:8443
    restart: unless-stopped
    ports:
      - 127.0.0.1:8443:8443
    volumes:
      - ./db/caddy:/data/caddy
    command: |
      sh -c 'echo $$CISO_ASSISTANT_URL "{
      reverse_proxy /api/* backend:8000
      reverse_proxy /mcp* mcp:8001
      reverse_proxy /* frontend:3000
      }" > Caddyfile && caddy run'

volumes:
  qdrant_data: