# =============================================================================
# langfuse-compose.yml  ->  deployed to ~/langfuse-compose.yml on lin001
#
# Deployed early, deliberately (spec Phase 2): from here on, every experiment is
# traced. MIT licensed, self-hosted, no licence cost.
#
# ai-internal is created by ai-compose.yml - bring that up first.
#
#   docker compose -f ~/langfuse-compose.yml up -d
# =============================================================================

services:

  lf-db:
    image: postgres:16-alpine
    container_name: lf-db
    restart: unless-stopped
    networks: [ai-internal]
    env_file:
      - /home/azureuser/ai/langfuse.env   # 0600, not in Git
    environment:
      POSTGRES_DB: langfuse
      POSTGRES_USER: langfuse
      PGDATA: /var/lib/postgresql/data/pgdata
      # POSTGRES_PASSWORD comes from langfuse.env.
    volumes:
      - /datadisk/langfuse/db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U langfuse -d langfuse"]
      interval: 10s
      timeout: 5s
      retries: 5
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }

  langfuse:
    image: langfuse/langfuse:2
    container_name: langfuse
    restart: unless-stopped
    depends_on:
      lf-db:
        condition: service_healthy
    networks: [ai-internal, proxy]
    env_file:
      - /home/azureuser/ai/langfuse.env   # 0600, not in Git
    environment:
      NEXTAUTH_URL: https://lf.yokogawa.tech
      TELEMETRY_ENABLED: "false"
      # Authelia already gates this at the edge - no second sign-up flow wanted.
      AUTH_DISABLE_SIGNUP: "true"
      # DATABASE_URL, NEXTAUTH_SECRET and SALT come from langfuse.env.
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:3000/api/public/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }

networks:
  ai-internal:
    external: true
  proxy:
    external: true