docker-compose.yaml

services:

  ollama:
    volumes:
      - .sau/ollama:/root/.ollama
    container_name: ollama
    # name: ollama
    pull_policy: always
    tty: true
    restart: unless-stopped
    image: ollama/ollama:${OLLAMA_DOCKER_TAG-latest}
    # ports:
    #   - 11434:11434
    networks:
      - traefik_network
      - ollama
    # network_mode: "host"

  open-webui:
    build:
      context: .
      args:
        OLLAMA_BASE_URL: '/ollama'
      dockerfile: Dockerfile
    image: ghcr.io/open-webui/open-webui:${WEBUI_DOCKER_TAG-main}
    container_name: open-webuia
    volumes:
      - open-webui:/app/backend/data
      # depends_on:
      # - db
      # - keycloak
      # ports:
      #   - ${OPEN_WEBUI_PORT-3000}:8080
    environment:
      ENV: ${ENV}
      DEFAULT_LOCALE: ${DEFAULT_LOCALE}
      WEBUI_NAME: ${WEBUI_NAME}
      WEBUI_URL: ${WEBUI_URL}
      ENABLE_MODEL_FILTER: ${ENABLE_MODEL_FILTER}
      ENABLE_OPENAI_API: ${ENABLE_OPENAI_API}
      OPENAI_API_BASE_URL: ${OPENAI_API_BASE_URL}
      OPENAI_API_KEY: ${OPENAI_API_KEY}
      MODEL_FILTER_LIST: meta-llama/llama-3.2-11b-vision-instruct:free
      DEFAULT_MODELS: meta-llama/llama-3.2-11b-vision-instruct:free
      DATABASE_URL: ${DATABASE_URL}
      RESET_CONFIG_ON_START: ${RESET_CONFIG_ON_START}
      WEBUI_SECRET_KEY: ${WEBUI_SECRET_KEY}

      ENABLE_OAUTH_SIGNUP: ${ENABLE_OAUTH_SIGNUP}
      ENABLE_LOGIN_FORM: ${ENABLE_LOGIN_FORM}
      OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID}
      OAUTH_CLIENT_SECRET: ${OAUTH_CLIENT_SECRET}
      OPENID_PROVIDER_URL: ${OPENID_PROVIDER_URL}
      OAUTH_PROVIDER_NAME: ${OAUTH_PROVIDER_NAME}
      OPENID_REDIRECT_URI: ${OPENID_REDIRECT_URI}
      WEBHOOK_URL: ${WEBHOOK_URL}
      WEBHOOK_TELEGRAM_CHAT_ID: ${WEBHOOK_TELEGRAM_CHAT_ID}
      OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true
      WEBUI_AUTH: true
      PORT: 8081
      USER_AGENT: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
    restart: unless-stopped
    networks:
      - traefik_network
      # - db_network
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_network"
      - "traefik.http.routers.open-webui.rule=Host(`ai.sau.ac.ir`)"
      - "traefik.http.routers.open-webui.entrypoints=web-openwebui"
      - "traefik.http.routers.open-webui.tls.certresolver=sauresolver"
      - "traefik.http.services.open-webui.loadbalancer.server.port=8081"
    depends_on:
      postgres:
        condition: service_healthy
        restart: true
      # keycloak:
      #   condition: service_healthy
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:8081/health" ]
      interval: 10s
      timeout: 10s
      retries: 3
      start_period: 60s

  keycloak:
    image: quay.io/keycloak/keycloak:26.0.6
    container_name: keycloak
    restart: unless-stopped
    # volumes:
    #   - keycloak-volume:/opt/keycloak/data
    # - /conf/server.crt:/opt/keycloak/conf/server.crt
    # - /conf/server.key:/opt/keycloak/conf/server.key
    # - /etc/letsencrypt/live/ai.sau.ac.ir/fullchain.pem:/opt/keycloak/conf/fullchain.pem
    # - /etc/letsencrypt/live/ai.sau.ac.ir/privkey.pem:/opt/keycloak/conf/privkey.pem
    environment:
      # KC_HOSTNAME_STRICT: "false"
      # KC_HOSTNAME_STRICT_HTTPS: "false"
      KC_PROXY_HEADERS: 'xforwarded'
      # PROXY_ADDRESS_FORWARDING: 'true'
      KC_HTTP_ENABLED: "true"
      KC_HOSTNAME: "ai.sau.ac.ir"
      # KC_HOSTNAME_DEBUG: true
      # KC_HEALTH_ENABLED: 'true'
      KC_BOOTSTRAP_ADMIN_USERNAME: "admin"
      KC_BOOTSTRAP_ADMIN_PASSWORD: "admin"
      # KC_HTTPS_CERTIFICATE_FILE: "/opt/keycloak/conf/fullchain.pem"
      # KC_HTTPS_CERTIFICATE_KEY_FILE: "/opt/keycloak/conf/privkey.pem"
      KC_HTTP_PORT: "9575"
      # KC_HTTPS_PORT: "3623"

      KC_DB: postgres
      KC_DB_URL_HOST: postgres
      KC_DB_URL_PORT: 5432
      KC_DB_URL_DATABASE: ${POSTGRES_KEYCLOAK_DB}
      KC_DB_USERNAME: ${POSTGRES_USER}
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
      KC_DB_SCHEMA: public
      KC_HEALTH_ENABLED: true
    command: start
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_network"
      - "traefik.http.routers.keycloak.rule=Host(`ai.sau.ac.ir`)"
      # - "traefik.http.routers.keycloak.service=keycloak"
      - "traefik.http.routers.keycloak.entrypoints=web-keycloak"
      - "traefik.http.routers.keycloak.tls=true"
      - "traefik.http.routers.keycloak.tls.certresolver=sauresolver"
      - "traefik.http.services.keycloak.loadbalancer.server.port=9575"
      - "traefik.http.services.keycloak.loadbalancer.passhostheader=true"
    networks:
      # - keycloak
      - traefik_network
      # - db_network

    healthcheck:
      test:
        - "CMD-SHELL"
        - |
          exec 3<>/dev/tcp/localhost/9000 &&
          echo -e 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 &&
          cat <&3 | tee /tmp/healthcheck.log | grep -q '200 OK'
      interval: 2s
      timeout: 5s
      retries: 3
      start_period: 10s
    depends_on:
      postgres:
        condition: service_healthy
        restart: true
      # pgadmin:
      #   condition: service_healthy
      #   restart: true
      # open-webui:
      #   condition: service_healthy
      #   restart: true




  postgres:
    image: postgres
    container_name: postgres_multi_db
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_MULTIPLE_DATABASES: ${POSTGRES_OPENWEBUI_DB},${POSTGRES_KEYCLOAK_DB}
    volumes:
      - .sau/multi_db/init-multiple-databases.sh:/docker-entrypoint-initdb.d/multiple-databases.sh
      - .sau/postgres/postgres_data:/var/lib/postgresql/data
    # ports:
    #   - 5432:5432
    restart: unless-stopped
    networks:
      # - db_network
      - traefik_network
    healthcheck:
      test: [ "CMD", "pg_isready", "-q", "-d", "${POSTGRES_OPENWEBUI_DB}", "-U", "${POSTGRES_USER}" ]
      # test: [ "CMD", "pg_isready", "-U", "${POSTGRES_USER}" ]
      # test: ["CMD-SHELL", "pg_isready"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 3s

  pgadmin:
    image: dpage/pgadmin4
    container_name: pgadmin4_container
    restart: unless-stopped
    # ports:
    #   - "4201:4200"
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD}
      PGADMIN_LISTEN_PORT: 4200
      PGADMIN_DISABLE_POSTFIX: true
    volumes:
      - pgadmin-data:/var/lib/pgadmin:delegated
      # - .pgadmin_init.json:/pgadmin4/servers.json

      # - pgadmin-data:/var/lib/pgadmin
      - .sau/servers.json:/pgadmin4/servers.json # Mount servers.json
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_network"
      - "traefik.http.routers.pgadmin.rule=Host(`ai.sau.ac.ir`)"
      - "traefik.http.routers.pgadmin.entrypoints=web-pgadmin"
      - "traefik.http.routers.pgadmin.tls.certresolver=sauresolver"
      - "traefik.http.services.pgadmin.loadbalancer.server.port=4200"
    networks:
      - traefik_network
      # healthcheck:
      #   #     test: ["CMD", "curl", "-f", "http://localhost:8081/health"]
      #   test: ["CMD", "curl", "-f", "http://localhost:4200/misc/ping"]
      #   interval: 5s
      #   timeout: 3s
      #   retries: 4
      #   start_period: 100s


  traefik:
    image: docker.io/traefik
    restart: unless-stopped
    command:
      - --api.insecure=false
      - --api.dashboard=true
      - --providers.docker=true
      - "--providers.docker.exposedbydefault=false"
      - --entrypoints.web-openwebui.address=:3001
      - --entrypoints.web-keycloak.address=:3629
      - --entrypoints.web-pgadmin.address=:8888
      - "--entryPoints.web.address=:80"
      # - "--entryPoints.web-whoami.address=:8087"

      - --certificatesresolvers.sauresolver.acme.tlschallenge=true
      - --certificatesresolvers.sauresolver.acme.email=hamedf@gmail.com
      - --certificatesresolvers.sauresolver.acme.storage=/letsencrypt/acme.json
      # - --accesslog=true
      # - --accesslog.filepath=/var/log/traefik/access.log
      # - --accesslog.format=json
    ports:
      # - "127.0.0.1:8080:8080"
      - 2345:80 #traefik dashboard
      - 443:3001 # Open WebUI
      - 3629:3629 # Keycloak
      - 8888:8888 # pgAdmin
      - 8087:8087
    volumes:
      - .sau/letsencrypt:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - .sau/traefik/acme.json:/etc/traefik/acme.json
      # - .traefik_logs:/var/log/traefik
    networks:
      - traefik_network
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.rule=Host(`ai.sau.ac.ir`)
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.middlewares=myauth
      - traefik.http.middlewares.myauth.basicauth.users=hamedf62:$$apr1$$7GpFKPME$F6NhwUPwx7W5YN.6Thrve1
      - "traefik.docker.network=traefik_network"
      - "traefik.http.routers.traefik.entrypoints=web"
      - "traefik.http.routers.traefik.tls.certresolver=sauresolver"
  # whoami:
  #   image: "traefik/whoami"
  #   container_name: "simple-service"
  #   labels:
  #     - "traefik.enable=true"
  #     - "traefik.docker.network=traefik_network"
  #     - "traefik.http.routers.whoami.rule=Host(`ai.sau.ac.ir`)"
  #     - "traefik.http.routers.whoami.entrypoints=web-whoami"
  #     - "traefik.http.routers.whoami.tls.certresolver=sauresolver"
  #     - "traefik.http.services.whoami.loadbalancer.server.port=80"
  #   networks:
  #     - traefik_network

volumes:
  pgadmin-data:
  open-webui: {}
  # local_pgdata: {}
  # pgadmin-data: {}
  # keycloak-volume: {}
  acme.json: {}
  postgres_data: # servers.json: {}

  traefik_logs: {}

networks:
  traefik_network:
  ollama:
    external:
      name: ollama