# ByteLyst private Open Notebook pilot
# Public exposure is intentionally disabled: UI/API bind to 127.0.0.1 only;
# SurrealDB and Ollama have no published host ports.
# Secrets live outside git in /etc/bytelyst/open-notebook-pilot.env.

name: bytelyst-open-notebook-pilot

services:
  surrealdb:
    image: surrealdb/surrealdb:v2
    command: >-
      start --log info
      --user ${SURREAL_USER:?set in /etc/bytelyst/open-notebook-pilot.env}
      --pass ${SURREAL_PASSWORD:?set in /etc/bytelyst/open-notebook-pilot.env}
      rocksdb:/mydata/mydatabase.db
    user: root
    env_file:
      - /etc/bytelyst/open-notebook-pilot.env
    environment:
      SURREAL_EXPERIMENTAL_GRAPHQL: "true"
    volumes:
      - /opt/bytelyst/open-notebook-pilot/surreal_data:/mydata
    restart: unless-stopped
    pull_policy: always
    networks:
      - open-notebook-private

  ollama:
    image: ollama/ollama:latest
    volumes:
      - /opt/bytelyst/open-notebook-pilot/ollama:/root/.ollama
    restart: unless-stopped
    pull_policy: always
    networks:
      - open-notebook-private

  open_notebook:
    image: lfnovo/open_notebook:v1-latest
    depends_on:
      - surrealdb
      - ollama
    env_file:
      - /etc/bytelyst/open-notebook-pilot.env
    environment:
      SURREAL_URL: ws://surrealdb:8000/rpc
      SURREAL_USER: ${SURREAL_USER:?set in /etc/bytelyst/open-notebook-pilot.env}
      SURREAL_PASSWORD: ${SURREAL_PASSWORD:?set in /etc/bytelyst/open-notebook-pilot.env}
      SURREAL_NAMESPACE: ${SURREAL_NAMESPACE:-open_notebook}
      SURREAL_DATABASE: ${SURREAL_DATABASE:-open_notebook}
      OPEN_NOTEBOOK_ENCRYPTION_KEY: ${OPEN_NOTEBOOK_ENCRYPTION_KEY:?set in /etc/bytelyst/open-notebook-pilot.env}
      OPEN_NOTEBOOK_PASSWORD: ${OPEN_NOTEBOOK_PASSWORD:?set in /etc/bytelyst/open-notebook-pilot.env}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://127.0.0.1:8502,http://localhost:8502}
      OLLAMA_BASE_URL: http://ollama:11434
    ports:
      - "127.0.0.1:8502:8502" # Web UI; use SSH tunnel, do not publish publicly
      - "127.0.0.1:5055:5055" # REST API; bearer password required
    volumes:
      - /opt/bytelyst/open-notebook-pilot/notebook_data:/app/data
    restart: unless-stopped
    pull_policy: always
    networks:
      - open-notebook-private

networks:
  open-notebook-private:
    internal: false