docker-compose.yml

services:
  genome:
    build: .
    image: genome:1.0.0
    ports:
      - "8080:8080"
    environment:
      GENOME_STORAGE: "postgresql://genome:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD before starting -- do not ship the default weak credential}@postgres:5432/memory"
      GENOME_EMBED_MODEL: "sentence-transformers/all-MiniLM-L6-v2"
      GENOME_CACHE_SIZE: "2048"
      # Bind all interfaces inside the container so the published port is reachable.
      GENOME_HOST: "0.0.0.0"
      # REQUIRED. The API is destructive (delete/reset) and must be authenticated.
      # `docker-compose up` fails fast if GENOME_API_KEY is unset (set it in a .env
      # file or the shell): export GENOME_API_KEY=$(openssl rand -hex 32)
      GENOME_API_KEY: "${GENOME_API_KEY:?Set GENOME_API_KEY before starting -- the memory API is destructive and must not run unauthenticated}"
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped

  postgres:
    image: pgvector/pgvector:pg16
    environment:
      POSTGRES_USER: genome
      # REQUIRED. A published database with a hardcoded credential is a direct
      # bypass of the API auth gate. `docker-compose up` fails fast if unset.
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD before starting -- do not ship the default weak credential}"
      POSTGRES_DB: memory
    # Publish only to the host loopback, never to the LAN. The genome service
    # reaches Postgres over the internal docker network (host "postgres") and does
    # not need this published port; it exists only for local psql/debugging.
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U genome -d memory"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped

volumes:
  pgdata: