docker-compose.yml

# ctx by GottZ — The memory your LLM pretends to have.
# GottZ 4-Way RRF | GottZ Scope Model | GottZ Guard
# https://github.com/GottZ/ctx

services:
  ctx:
    build:
      context: ./go
      dockerfile: Dockerfile
    container_name: ctx
    restart: unless-stopped
    labels:
      - "reversed.host=${CTX_HOSTNAME}"
      - "reversed.port=8080"
      - "reversed.ssl=${CTX_SSL_DOMAIN}"
    environment:
      CONTEXT_DB: ${CONTEXT_DB}
      CONTEXT_DB_USER: ${CONTEXT_DB_USER}
      CONTEXT_DB_PASSWORD: ${CONTEXT_DB_PASSWORD}
      CONTEXT_DB_HOST: db
      CONTEXT_DB_PORT: 5432
      CTX_EMBED_HOST: ${CTX_EMBED_HOST}
      CTX_EMBED_API_KEY: ${CTX_EMBED_API_KEY:-}
      CTX_EMBED_PROTOCOL: ${CTX_EMBED_PROTOCOL:-ollama}
      CTX_EMBED_MODEL: ${CTX_EMBED_MODEL}
      CTX_EMBED_DIMS: ${CTX_EMBED_DIMS:-4096}
      CTX_EMBED_NUM_CTX: ${CTX_EMBED_NUM_CTX:-0}
      CTX_CHAT_HOST: ${CTX_CHAT_HOST}
      CTX_CHAT_API_KEY: ${CTX_CHAT_API_KEY:-}
      CTX_CHAT_PROTOCOL: ${CTX_CHAT_PROTOCOL:-ollama}
      CTX_CHAT_MODEL: ${CTX_CHAT_MODEL}
      CTX_CHAT_THINK: ${CTX_CHAT_THINK:-false}
      CTX_CHAT_NUM_CTX: ${CTX_CHAT_NUM_CTX:-0}
      CTX_DREAM_ENABLED: ${CTX_DREAM_ENABLED:-false}
      CTX_DREAM_HOST: ${CTX_DREAM_HOST:-}
      CTX_DREAM_API_KEY: ${CTX_DREAM_API_KEY:-}
      CTX_DREAM_PROTOCOL: ${CTX_DREAM_PROTOCOL:-ollama}
      CTX_DREAM_MODEL: ${CTX_DREAM_MODEL:-}
      CTX_DREAM_NUM_CTX: ${CTX_DREAM_NUM_CTX:-0}
      CTX_DREAM_THINK: ${CTX_DREAM_THINK:-}
      CTX_DREAM_EMBED_HOST: ${CTX_DREAM_EMBED_HOST:-}
      CTX_DREAM_EMBED_API_KEY: ${CTX_DREAM_EMBED_API_KEY:-}
      CTX_DREAM_EMBED_PROTOCOL: ${CTX_DREAM_EMBED_PROTOCOL:-}
      CTX_DREAM_EMBED_MODEL: ${CTX_DREAM_EMBED_MODEL:-}
      CTX_DREAM_EMBED_NUM_CTX: ${CTX_DREAM_EMBED_NUM_CTX:-0}
      CTX_RATE_LIMIT_WRITE: ${CTX_RATE_LIMIT_WRITE:-100}
      CTX_RATE_LIMIT_READ: ${CTX_RATE_LIMIT_READ:-0}
      CTX_TIMEZONE: ${CTX_TIMEZONE:-}
      CTX_SCORE_THRESHOLD: ${CTX_SCORE_THRESHOLD:-0.001}
      CTX_CONFIDENT_THRESHOLD: ${CTX_CONFIDENT_THRESHOLD:-0.008}
      # Scheduler ReadScopes (comma-separated). Background guard/digest/dream
      # operate on these scopes. Default = v1.x backwards-compat. v2.0.0 M045
      # dropped chk_scope, so any scope name is valid (no schema validation).
      CTX_READ_SCOPES: ${CTX_READ_SCOPES:-private,shared,work}
      LISTEN_ADDR: ":8080"
    networks:
      - n8nintern
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "/ctx", "-health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    security_opt:
      - "no-new-privileges:true"
    cap_drop:
      - ALL
    read_only: true
    deploy:
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 32M
    logging:
      options:
        max-size: "50m"
        max-file: "3"

  # Opt-in CRAG-Bench test instance. Started only via `--profile crag`.
  # Reuses prod n8n-ctx image (no rebuild needed). Test DB must be bootstrapped
  # separately (see .env.crag.example). Loopback-only port 18080 to avoid
  # accidental exposure. CTX_READ_SCOPES defaults to private,shared,work,crag
  # so bench API keys with home_scope=private see crag-scoped blocks too.
  ctx-crag:
    image: n8n-ctx
    container_name: ctx-crag
    profiles:
      - crag
    restart: "no"
    env_file:
      - path: .env.crag
        required: false
    environment:
      CONTEXT_DB_HOST: db
      CONTEXT_DB_PORT: 5432
      CTX_READ_SCOPES: ${CTX_READ_SCOPES:-private,shared,work,crag}
      LISTEN_ADDR: ":8080"
    ports:
      - "127.0.0.1:18080:8080"
    networks:
      - n8nintern
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "/ctx", "-health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    security_opt:
      - "no-new-privileges:true"
    cap_drop:
      - ALL
    read_only: true
    deploy:
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 32M
    logging:
      options:
        max-size: "50m"
        max-file: "3"

  db:
    build: ./db-image
    image: pgvector-timescaledb:pg18
    restart: unless-stopped
    networks:
      - n8nintern
    environment:
      POSTGRES_DB:
      POSTGRES_USER:
      POSTGRES_PASSWORD:
      CONTEXT_DB: ${CONTEXT_DB}
      CONTEXT_DB_USER: ${CONTEXT_DB_USER}
      CONTEXT_DB_PASSWORD: ${CONTEXT_DB_PASSWORD}
    volumes:
      - ./db:/var/lib/postgresql
      - ./init-data.sh:/docker-entrypoint-initdb.d/init-data.sh
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h localhost -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10

  # Optional: llama.cpp CPU-only inference sidecar.
  # Useful for Dream embedding on CPU (frees GPU for query-path).
  # Mount your GGUF models into /models.
  # Example .env: CTX_DREAM_EMBED_HOST=http://llama-embed:8081
  #               CTX_DREAM_EMBED_PROTOCOL=openai
  #
  # llama-embed:
  #   image: ghcr.io/ggml-org/llama.cpp:server
  #   container_name: llama-embed
  #   restart: unless-stopped
  #   volumes:
  #     - /opt/models:/models:ro
  #   command: >
  #     --model /models/Qwen3-Embedding-8B-Q4_K_M.gguf
  #     --embedding
  #     --pooling last
  #     --port 8081
  #     --ctx-size 2048
  #     --n-gpu-layers 0
  #   networks:
  #     - n8nintern
  #   healthcheck:
  #     test: ["CMD", "curl", "-sf", "http://localhost:8081/health"]
  #     interval: 30s
  #     timeout: 5s
  #     retries: 3
  #     start_period: 15s

networks:
  n8nintern:
    name: n8nintern