docker-compose.yml

services:
  caddy:
    image: caddy:2.8.4-alpine
    container_name: caddy
    restart: unless-stopped
    networks:
      - core
    ports:
      - 80:80
    environment:
      - BASE_DOMAIN=${BASE_DOMAIN}
      - ADDRESS=${ADDRESS}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile

  api:
    image: ghcr.io/tracecathq/tracecat:${TRACECAT__IMAGE_TAG:-0.18.2}
    container_name: api
    restart: unless-stopped
    networks:
      - core
      - core-db
      - temporal
    environment:
      # App
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__API_URL: ${TRACECAT__API_URL}
      TRACECAT__API_ROOT_PATH: ${TRACECAT__API_ROOT_PATH}
      TRACECAT__APP_ENV: ${TRACECAT__APP_ENV}
      TRACECAT__DB_ENCRYPTION_KEY: ${TRACECAT__DB_ENCRYPTION_KEY} # Sensitive
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI} # Sensitive
      TRACECAT__PUBLIC_API_URL: ${TRACECAT__PUBLIC_API_URL}
      TRACECAT__PUBLIC_APP_URL: ${TRACECAT__PUBLIC_APP_URL}
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY} # Sensitive
      TRACECAT__SIGNING_SECRET: ${TRACECAT__SIGNING_SECRET} # Sensitive
      TRACECAT__ALLOW_ORIGINS: ${TRACECAT__ALLOW_ORIGINS}
      TRACECAT__AUTH_TYPES: ${TRACECAT__AUTH_TYPES}
      TRACECAT__AUTH_ALLOWED_DOMAINS: ${TRACECAT__AUTH_ALLOWED_DOMAINS}
      TRACECAT__AUTH_MIN_PASSWORD_LENGTH: ${TRACECAT__AUTH_MIN_PASSWORD_LENGTH}
      TRACECAT__EXECUTOR_URL: ${INTERNAL_EXECUTOR_URL}
      OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID}
      OAUTH_CLIENT_SECRET: ${OAUTH_CLIENT_SECRET}
      USER_AUTH_SECRET: ${USER_AUTH_SECRET}
      RUN_MIGRATIONS: "true"
      # SAML SSO
      SAML_IDP_CERTIFICATE: ${SAML_IDP_CERTIFICATE}
      SAML_IDP_METADATA_URL: ${SAML_IDP_METADATA_URL}
      SAML_SP_ACS_URL: ${SAML_SP_ACS_URL}
      # Temporal
      TEMPORAL__CLUSTER_URL: ${TEMPORAL__CLUSTER_URL}
      TEMPORAL__CLUSTER_QUEUE: ${TEMPORAL__CLUSTER_QUEUE}
      TEMPORAL__TASK_TIMEOUT: ${TEMPORAL__TASK_TIMEOUT}
      # Remote registry
      TRACECAT__REMOTE_REPOSITORY_PACKAGE_NAME: ${TRACECAT__REMOTE_REPOSITORY_PACKAGE_NAME}
      TRACECAT__REMOTE_REPOSITORY_URL: ${TRACECAT__REMOTE_REPOSITORY_URL}
      # AI
      TRACECAT__PRELOAD_OSS_MODELS: ${TRACECAT__PRELOAD_OSS_MODELS}
      OLLAMA__API_URL: ${OLLAMA__API_URL}

  worker:
    image: ghcr.io/tracecathq/tracecat:${TRACECAT__IMAGE_TAG:-0.18.2}
    restart: unless-stopped
    networks:
      - core
      - core-db
      - temporal
    environment:
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__API_ROOT_PATH: ${TRACECAT__API_ROOT_PATH}
      TRACECAT__API_URL: ${TRACECAT__API_URL}
      TRACECAT__APP_ENV: ${TRACECAT__APP_ENV}
      TRACECAT__DB_ENCRYPTION_KEY: ${TRACECAT__DB_ENCRYPTION_KEY} # Sensitive
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI} # Sensitive
      TRACECAT__PUBLIC_API_URL: ${TRACECAT__PUBLIC_API_URL}
      TRACECAT__EXECUTOR_URL: ${INTERNAL_EXECUTOR_URL}
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY} # Sensitive
      TRACECAT__SIGNING_SECRET: ${TRACECAT__SIGNING_SECRET} # Sensitive
      # Temporal
      TEMPORAL__CLUSTER_URL: ${TEMPORAL__CLUSTER_URL}
      TEMPORAL__CLUSTER_QUEUE: ${TEMPORAL__CLUSTER_QUEUE}
    command: ["python", "tracecat/dsl/worker.py"]

  executor:
    image: ghcr.io/tracecathq/tracecat:${TRACECAT__IMAGE_TAG:-0.18.2}
    restart: unless-stopped
    networks:
      - core
      - core-db
    environment:
      # Common
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__APP_ENV: ${TRACECAT__APP_ENV}
      TRACECAT__DB_ENCRYPTION_KEY: ${TRACECAT__DB_ENCRYPTION_KEY} # Sensitive
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI} # Sensitive
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY} # Sensitive
      # Remote registry
      TRACECAT__REMOTE_REPOSITORY_PACKAGE_NAME: ${TRACECAT__REMOTE_REPOSITORY_PACKAGE_NAME}
      TRACECAT__REMOTE_REPOSITORY_URL: ${TRACECAT__REMOTE_REPOSITORY_URL}
      # AI
      TRACECAT__PRELOAD_OSS_MODELS: ${TRACECAT__PRELOAD_OSS_MODELS}
      OLLAMA__API_URL: ${OLLAMA__API_URL}
    command:
      [
        "python",
        "-m",
        "uvicorn",
        "tracecat.api.executor:app",
        "--host",
        "0.0.0.0",
        "--port",
        "8000",
      ]

  ui:
    image: ghcr.io/tracecathq/tracecat-ui:${TRACECAT__IMAGE_TAG:-0.18.2}
    container_name: ui
    restart: unless-stopped
    networks:
      - core
    environment:
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
      NEXT_PUBLIC_APP_ENV: ${NEXT_PUBLIC_APP_ENV}
      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL}
      NEXT_PUBLIC_AUTH_TYPES: ${TRACECAT__AUTH_TYPES}
      NEXT_SERVER_API_URL: ${NEXT_SERVER_API_URL}
      NODE_ENV: ${NODE_ENV}
    depends_on:
      - api

  postgres_db:
    image: postgres:16
    container_name: postgres_db
    restart: always
    networks:
      - core-db
    shm_size: 128mb
    environment:
      POSTGRES_USER: ${TRACECAT__POSTGRES_USER}
      POSTGRES_PASSWORD: ${TRACECAT__POSTGRES_PASSWORD}
    volumes:
      - core-db:/var/lib/postgresql/data

  temporal_postgres_db:
    image: postgres:13
    container_name: temporal_postgres_db
    restart: always
    networks:
      - temporal-db
    environment:
      POSTGRES_USER: ${TEMPORAL__POSTGRES_USER}
      POSTGRES_PASSWORD: ${TEMPORAL__POSTGRES_PASSWORD} # Sensitive
    volumes:
      - temporal-db:/var/lib/postgresql/data

  temporal:
    image: temporalio/auto-setup:${TEMPORAL__VERSION}
    container_name: temporal
    restart: always
    networks:
      - temporal
      - temporal-db
    environment:
      - DB=postgres12
      - DB_PORT=5432
      - POSTGRES_USER=${TEMPORAL__POSTGRES_USER}
      - POSTGRES_PWD=${TEMPORAL__POSTGRES_PASSWORD} # Sensitive
      - POSTGRES_SEEDS=temporal_postgres_db
      - LOG_LEVEL=warn
    depends_on:
      - temporal_postgres_db

  ollama:
    container_name: ollama
    tty: true
    restart: unless-stopped
    networks:
      - core
    image: ollama/ollama:${OLLAMA__VERSION}
    ports:
      - 11434:11434
    volumes:
      - ollama:/root/.ollama
volumes:
  core-db:
  temporal-db:
  ollama:

networks:
  core:
  core-db:
    internal: true
  temporal:
  temporal-db:
    internal: true