{{ message }}
Repository navigation
Expand file tree
/
Copy pathdocker-compose.dev.yml
More file actions
372 lines (358 loc) · 15 KB
/
Copy pathdocker-compose.dev.yml
File metadata and controls
372 lines (358 loc) · 15 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
# Google credentials for the Hub's Vertex enrichment providers (the google-gemini provider) are read
# from a file *inside* the container, so a host path can never resolve on its own. Bind-mount
# whatever the host points at to one fixed in-container path and set the in-container variable to
# match (see the hub service's environment).
#
# The host knob is HUB_GOOGLE_APPLICATION_CREDENTIALS, deliberately *not* the standard
# GOOGLE_APPLICATION_CREDENTIALS. That name is Google's global Application Default Credentials
# convention and gcloud users commonly export it from a shell profile; compose gives the shell
# environment precedence over .env, so reading it here would let ambient state nobody set for
# Formbricks drive this mount. A stale export (key since moved) would fail hub and hub-worker
# creation under create_host_path: false and take the whole db:up chain down with it, for someone
# who never touched enrichment; a live one would silently bind a personal or production key into
# both containers and activate it. HUB_ also matches the other Hub knobs here (HUB_API_KEY,
# HUB_DATABASE_URL, HUB_IMAGE_TAG); only the in-container name stays standard, which is what the
# Hub actually reads.
#
# The /dev/null default keeps the mount spec valid when the variable is unset — nothing reads the
# file in that case, because the ${VAR:+...} form below leaves the in-container variable empty and
# Application Default Credentials falls through exactly as it did before.
#
# A YAML merge key (<<:) only works on mappings, and volumes is a sequence, so this is a plain
# alias and each service has to reference it explicitly. Both hub and hub-worker need it: the
# worker classifies and the API embeds search queries, so mounting only one leaves the other
# unable to authenticate.
#
# Long syntax on purpose. In the "source:target:ro" short form, compose reads a source that is not
# an absolute or ./-prefixed path as a *named volume* reference, so a relative value here
# (HUB_GOOGLE_APPLICATION_CREDENTIALS=creds.json) fails the whole project with "refers to undefined
# volume" — taking postgres and everything else down with it, for an error that never mentions
# credentials. With an explicit type: bind, a relative value is resolved against the project
# directory instead.
#
# create_host_path: false because Docker's default is to CREATE a missing bind source, as a
# directory. A typo'd or since-moved path would therefore leave a stray "creds.json/" directory on
# the host and mount it as a directory here, so the read fails with "is a directory" and hub-worker
# crash-loops on a path that looks correct. Refusing to start is the better failure: the daemon
# names the exact path it could not find, and only the hub containers fail rather than the whole
# project (unlike the undefined-volume case above, which fails at config parse).
x-hub-volumes: &hub-volumes
- type: bind
source: ${HUB_GOOGLE_APPLICATION_CREDENTIALS:-/dev/null}
target: /secrets/gcp.json
read_only: true
bind:
create_host_path: false
services:
# PostgreSQL must load the vector library so Hub (and Formbricks) can use the pgvector extension.
postgres:
image: pgvector/pgvector:pg18
volumes:
- postgres:/var/lib/postgresql
environment:
- POSTGRES_DB=postgres
- POSTGRES_USER=postgres
- POSTGRES_PASSWORD=postgres
ports:
- 5432:5432
command: >
postgres
-c shared_preload_libraries=vector
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres -d postgres || exit 1"]
interval: 5s
timeout: 3s
retries: 30
start_period: 10s
mailhog:
image: arjenz/mailhog
ports:
- 8025:8025
- 1025:1025
valkey:
image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
command: "valkey-server --maxmemory-policy noeviction"
ports:
- 6379:6379
volumes:
- valkey-data:/data
rustfs-perms:
image: busybox:1.36.1
user: "0:0"
command: ["sh", "-c", "mkdir -p /data && chown -R 10001:10001 /data"]
volumes:
- rustfs-data:/data
rustfs:
image: rustfs/rustfs:1.0.0-rc.2@sha256:7d6d361c49c08d427250fb59aae5d78df83d644c3405d9ccf4b21cda0b0692d0
depends_on:
rustfs-perms:
condition: service_completed_successfully
command: /data
environment:
- RUSTFS_ACCESS_KEY=devrustfs
- RUSTFS_SECRET_KEY=devrustfs123
- RUSTFS_ADDRESS=:9000
- RUSTFS_CONSOLE_ENABLE=true
- RUSTFS_CONSOLE_ADDRESS=:9001
ports:
- "9000:9000" # S3 API direct access
- "9001:9001" # Web console
volumes:
- rustfs-data:/data
rustfs-init:
image: minio/mc@sha256:95b5f3f7969a5c5a9f3a700ba72d5c84172819e13385aaf916e237cf111ab868
depends_on:
- rustfs
environment:
- RUSTFS_ADMIN_USER=devrustfs
- RUSTFS_ADMIN_PASSWORD=devrustfs123
- RUSTFS_BUCKET_NAME=formbricks
- RUSTFS_POLICY_NAME=formbricks-policy
- RUSTFS_SERVICE_USER=devrustfs-service
- RUSTFS_SERVICE_PASSWORD=devrustfs-service123
- RUSTFS_CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000,http://localhost:3001,http://127.0.0.1:3001,http://localhost:3002,http://127.0.0.1:3002
volumes:
- ./docker/rustfs-init.sh:/usr/local/bin/rustfs-init.sh:ro
entrypoint:
- /bin/sh
- /usr/local/bin/rustfs-init.sh
# Create Hub's dedicated dev database before migrations run. Idempotent; runs on every compose up.
hub-db-create:
image: pgvector/pgvector:pg18
restart: "no"
entrypoint: ["sh", "-c"]
command:
[
'if [ "$$(psql "$$POSTGRES_DATABASE_URL" -tAc "SELECT 1 FROM pg_database WHERE datname = ''hub''")" != "1" ]; then psql "$$POSTGRES_DATABASE_URL" -v ON_ERROR_STOP=1 -c "CREATE DATABASE hub"; fi',
]
environment:
POSTGRES_DATABASE_URL: postgresql://postgres:postgres@postgres:5432/postgres?sslmode=disable
depends_on:
postgres:
condition: service_healthy
# Run Hub DB migrations (goose + river) before the API starts. Idempotent; runs on every compose up.
# Hub image pinned via HUB_IMAGE_TAG so docker does not silently reuse a stale :latest cache.
# Keep hub, hub-migrate, and any future hub-worker on the same tag — they share one image and
# drift breaks migrations or job processing.
hub-migrate:
image: ghcr.io/formbricks/hub:${HUB_IMAGE_TAG:-0.8.5}
restart: "no"
entrypoint: ["sh", "-c"]
command:
[
'if [ -x /usr/local/bin/goose ] && [ -x /usr/local/bin/river ]; then /usr/local/bin/goose -dir /app/migrations postgres "$$DATABASE_URL" up && /usr/local/bin/river migrate-up --database-url "$$DATABASE_URL"; else echo ''Migration tools (goose/river) not in image.''; exit 1; fi',
]
environment:
DATABASE_URL: ${HUB_DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/hub?sslmode=disable}
depends_on:
hub-db-create:
condition: service_completed_successfully
# Formbricks Hub API (ghcr.io/formbricks/hub). Uses a dedicated local Hub database by default.
hub:
image: ghcr.io/formbricks/hub:${HUB_IMAGE_TAG:-0.8.5}
depends_on:
hub-migrate:
condition: service_completed_successfully
ports:
- "8080:8080"
volumes: *hub-volumes
environment: &hub-runtime-environment
API_KEY: ${HUB_API_KEY:-dev-api-key}
DATABASE_URL: ${HUB_DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/hub?sslmode=disable}
# Explicit Postgres env so migrations and any libpq fallback use the service host, not localhost
PGHOST: postgres
PGPORT: "5432"
PGUSER: postgres
PGPASSWORD: postgres
PGDATABASE: hub
PGSSLMODE: disable
# Hub embeddings are disabled unless EMBEDDING_PROVIDER and EMBEDDING_MODEL are set.
EMBEDDING_PROVIDER: ${EMBEDDING_PROVIDER:-}
EMBEDDING_MODEL: ${EMBEDDING_MODEL:-}
EMBEDDING_PROVIDER_API_KEY: ${EMBEDDING_PROVIDER_API_KEY:-}
EMBEDDING_BASE_URL: ${EMBEDDING_BASE_URL:-}
EMBEDDING_MAX_CONCURRENT: ${EMBEDDING_MAX_CONCURRENT:-5}
EMBEDDING_MAX_ATTEMPTS: ${EMBEDDING_MAX_ATTEMPTS:-3}
EMBEDDING_NORMALIZE: ${EMBEDDING_NORMALIZE:-false}
EMBEDDING_GOOGLE_CLOUD_PROJECT: ${EMBEDDING_GOOGLE_CLOUD_PROJECT:-}
EMBEDDING_GOOGLE_CLOUD_LOCATION: ${EMBEDDING_GOOGLE_CLOUD_LOCATION:-}
# Point at the in-container mount (see x-hub-volumes) rather than passing the host path
# through, which could never resolve inside the container. The ${VAR:+...} form substitutes
# only when the host variable is set and non-empty, so leaving it unset keeps this empty and
# Application Default Credentials behaves as before.
#
# Only the google-gemini (Vertex) providers need this; the plain `google` provider takes an
# API key instead, which is the simpler option for local dev. Note the mount reaches both
# containers because they share one credential — the API needs it only when embeddings use
# Vertex (it embeds search queries synchronously), the worker whenever it classifies.
GOOGLE_APPLICATION_CREDENTIALS: ${HUB_GOOGLE_APPLICATION_CREDENTIALS:+/secrets/gcp.json}
# Hub sentiment/emotion/translation enrichment (0.7.x) are disabled unless the
# matching *_PROVIDER and *_MODEL pair is set (translation additionally needs a
# target language — TRANSLATION_DEFAULT_LANGUAGE, or a per-tenant setting). The
# anchor feeds both the API (enqueues) and the worker (classifies) — configuring
# only one side leaves jobs unprocessed.
SENTIMENT_PROVIDER: ${SENTIMENT_PROVIDER:-}
SENTIMENT_MODEL: ${SENTIMENT_MODEL:-}
SENTIMENT_PROVIDER_API_KEY: ${SENTIMENT_PROVIDER_API_KEY:-}
SENTIMENT_GOOGLE_CLOUD_PROJECT: ${SENTIMENT_GOOGLE_CLOUD_PROJECT:-}
SENTIMENT_GOOGLE_CLOUD_LOCATION: ${SENTIMENT_GOOGLE_CLOUD_LOCATION:-}
EMOTIONS_PROVIDER: ${EMOTIONS_PROVIDER:-}
EMOTIONS_MODEL: ${EMOTIONS_MODEL:-}
EMOTIONS_PROVIDER_API_KEY: ${EMOTIONS_PROVIDER_API_KEY:-}
EMOTIONS_GOOGLE_CLOUD_PROJECT: ${EMOTIONS_GOOGLE_CLOUD_PROJECT:-}
EMOTIONS_GOOGLE_CLOUD_LOCATION: ${EMOTIONS_GOOGLE_CLOUD_LOCATION:-}
TRANSLATION_PROVIDER: ${TRANSLATION_PROVIDER:-}
TRANSLATION_MODEL: ${TRANSLATION_MODEL:-}
TRANSLATION_PROVIDER_API_KEY: ${TRANSLATION_PROVIDER_API_KEY:-}
TRANSLATION_DEFAULT_LANGUAGE: ${TRANSLATION_DEFAULT_LANGUAGE:-}
TRANSLATION_GOOGLE_CLOUD_PROJECT: ${TRANSLATION_GOOGLE_CLOUD_PROJECT:-}
TRANSLATION_GOOGLE_CLOUD_LOCATION: ${TRANSLATION_GOOGLE_CLOUD_LOCATION:-}
TAXONOMY_SERVICE_URL: ${TAXONOMY_SERVICE_URL:-}
TAXONOMY_SERVICE_TOKEN: ${TAXONOMY_SERVICE_TOKEN:-}
HUB_INTERNAL_API_TOKEN: ${HUB_INTERNAL_API_TOKEN:-}
# Hub worker processes async jobs enqueued by the API, including embeddings.
hub-worker:
image: ghcr.io/formbricks/hub:${HUB_IMAGE_TAG:-0.8.5}
depends_on:
hub-migrate:
condition: service_completed_successfully
postgres:
condition: service_healthy
entrypoint: ["/app/hub-worker"]
healthcheck:
disable: true
volumes: *hub-volumes
environment:
<<: *hub-runtime-environment
# Optional AI taxonomy beta service. Enable with COMPOSE_PROFILES=taxonomy.
taxonomy:
image: ghcr.io/formbricks/taxonomy${TAXONOMY_IMAGE_REF:-:latest}
profiles: ["taxonomy"]
depends_on:
hub:
condition: service_started
environment:
APP_ENV: production
TAXONOMY_SERVICE_TOKEN: ${TAXONOMY_SERVICE_TOKEN:-}
HUB_INTERNAL_API_URL: http://hub:8080
HUB_INTERNAL_API_TOKEN: ${HUB_INTERNAL_API_TOKEN:-}
TAXONOMY_LLM_PROVIDER: ${TAXONOMY_LLM_PROVIDER:-openai-compatible}
TAXONOMY_LLM_MODEL: ${TAXONOMY_LLM_MODEL:-}
TAXONOMY_LLM_BASE_URL: ${TAXONOMY_LLM_BASE_URL:-}
TAXONOMY_LLM_API_KEY: ${TAXONOMY_LLM_API_KEY:-}
TAXONOMY_VERTEX_PROJECT: ${TAXONOMY_VERTEX_PROJECT:-}
TAXONOMY_VERTEX_LOCATION: ${TAXONOMY_VERTEX_LOCATION:-}
TAXONOMY_GOOGLE_CLOUD_CREDENTIALS_JSON: ${TAXONOMY_GOOGLE_CLOUD_CREDENTIALS_JSON:-}
AWS_REGION: ${AWS_REGION:-}
AWS_BEARER_TOKEN_BEDROCK: ${AWS_BEARER_TOKEN_BEDROCK:-}
healthcheck:
test:
[
"CMD",
"python",
"-c",
"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=5).read()",
]
interval: 10s
timeout: 5s
retries: 12
start_period: 30s
# Optional bundled Qwen/vLLM OpenAI-compatible runtime. Enable with COMPOSE_PROFILES=qwen.
vllm:
image: ${QWEN_VLLM_IMAGE:-vllm/vllm-openai:v0.14.0}
profiles: ["qwen"]
deploy:
resources:
reservations:
devices:
- driver: nvidia
count: all
capabilities: [gpu]
command:
- vllm
- serve
- ${QWEN_MODEL_ID:-Qwen/Qwen3-14B-AWQ}
- --host
- 0.0.0.0
- --port
- "8000"
- --no-enable-prefix-caching
- --max-model-len
- ${QWEN_MAX_MODEL_LEN:-8192}
- --dtype
- ${QWEN_DTYPE:-float16}
- --tensor-parallel-size
- ${QWEN_TENSOR_PARALLEL_SIZE:-1}
- --max-num-seqs
- ${QWEN_MAX_NUM_SEQS:-8}
- --gpu_memory_utilization
- ${QWEN_GPU_MEMORY_UTILIZATION:-0.9}
- --served-model-name
- ${QWEN_SERVED_MODEL_NAME:-qwen3-14b-awq}
- --default-chat-template-kwargs
- '{"enable_thinking": false}'
environment:
HF_HOME: /data
volumes:
- qwen-model-cache:/data
ports:
- "${QWEN_VLLM_HOST:-127.0.0.1}:${QWEN_VLLM_PORT:-8000}:8000"
healthcheck:
test:
[
"CMD",
"python3",
"-c",
"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=5).read()",
]
interval: 30s
timeout: 10s
retries: 40
start_period: 10m
cube:
image: cubejs/cube:v1.6.6
env_file:
- apps/web/.env
command:
- sh
- -c
- |
if [ -z "$$CUBEJS_API_SECRET" ]; then
echo "CUBEJS_API_SECRET is required for Cube JWT authentication" >&2
exit 1
fi
exec cubejs server
depends_on:
postgres:
condition: service_healthy
hub-migrate:
condition: service_completed_successfully
ports:
- 4000:4000
- 4001:4001 # Cube Playground UI (dev only)
environment:
CUBEJS_DB_TYPE: postgres
CUBEJS_DB_HOST: ${CUBEJS_DB_HOST:-postgres}
CUBEJS_DB_NAME: ${CUBEJS_DB_NAME:-postgres}
CUBEJS_DB_USER: ${CUBEJS_DB_USER:-postgres}
CUBEJS_DB_PASS: ${CUBEJS_DB_PASS:-postgres}
CUBEJS_DB_PORT: ${CUBEJS_DB_PORT:-5432}
CUBEJS_DEV_MODE: "true"
CUBEJS_API_SECRET: ${CUBEJS_API_SECRET:-}
CUBEJS_JWT_ISSUER: ${CUBEJS_JWT_ISSUER:-formbricks-web}
CUBEJS_JWT_AUDIENCE: ${CUBEJS_JWT_AUDIENCE:-formbricks-cube}
CUBEJS_DEFAULT_API_SCOPES: meta,data
CUBEJS_CACHE_AND_QUEUE_DRIVER: memory
volumes:
- ./docker/cube/cube.js:/cube/conf/cube.js:ro
- ./docker/cube/schema:/cube/conf/model:ro
restart: on-failure
volumes:
postgres:
driver: local
valkey-data:
driver: local
rustfs-data:
driver: local
qwen-model-cache:
driver: local
You can’t perform that action at this time.