cesnimda
df04568b06
Semantic-search slice 1 (infra). Adds the pgvector plumbing the backfill worker and hybrid search will use: - swap the Postgres image to pgvector/pgvector:pg16 (drop-in for pg16 data) - Pgvector + Pgvector.EntityFrameworkCore (0.2.0, EF8-compatible); UseVector() on the runtime + design-time contexts - Email.Embedding vector(768) column (nomic-embed-text dims), nullable, with an HNSW cosine index; ignored under the InMemory test provider - migration: CREATE EXTENSION vector + column + HNSW index Verified against a real pgvector container: extension, HNSW, and cosine search work, and the full EF round-trip (store a Pgvector.Vector, CosineDistance operator, nearest-first ordering) applies all migrations and passes. No vulnerable packages. Build + all 41 tests pass. Column stays null until Ollama generates embeddings (search falls back to lexical). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
77 lines
2.6 KiB
YAML
77 lines
2.6 KiB
YAML
services:
|
|
postgres:
|
|
# pgvector-enabled Postgres 16 (semantic search). Drop-in for postgres:16 data;
|
|
# the 'vector' extension is created by the AddEmbeddingColumn migration.
|
|
image: pgvector/pgvector:pg16
|
|
environment:
|
|
POSTGRES_DB: inboxintel
|
|
POSTGRES_USER: inboxintel
|
|
# V-03: require an explicit strong password (fail fast if POSTGRES_PASSWORD is unset)
|
|
# rather than silently defaulting to a guessable one.
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in deploy/.env}
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
# V-03: bind to loopback only so the database is reachable from the host for local
|
|
# tooling but NOT from other machines on the network. The api container reaches it
|
|
# over the internal compose network regardless of this published port.
|
|
ports:
|
|
- "127.0.0.1:5432:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U inboxintel"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: src/InboxIntel.Api/Dockerfile
|
|
environment:
|
|
ASPNETCORE_ENVIRONMENT: Production
|
|
ASPNETCORE_URLS: http://+:8080
|
|
ConnectionStrings__Postgres: "Host=postgres;Port=5432;Database=inboxintel;Username=inboxintel;Password=${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in deploy/.env}"
|
|
DataProtection__KeyPath: /keys
|
|
GoogleOAuth__ClientId: ${GOOGLE_CLIENT_ID:-}
|
|
GoogleOAuth__ClientSecret: ${GOOGLE_CLIENT_SECRET:-}
|
|
Ai__Mode: ${AI_MODE:-Disabled}
|
|
# Dev mode shows the dev banner and caps the initial sync. Set DEV_MODE=true
|
|
# and MAX_MESSAGES=1000 in deploy/.env to exercise it in this Docker setup.
|
|
App__DevMode: ${DEV_MODE:-false}
|
|
GmailSync__MaxMessages: ${MAX_MESSAGES:-0}
|
|
Cors__Origins__0: ${FRONTEND_ORIGIN:-http://localhost:8081}
|
|
volumes:
|
|
- keys:/keys
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
# V-08: bind to loopback so the API is not directly reachable from the network
|
|
# (only via the frontend/nginx proxy over the internal compose network). This
|
|
# prevents external clients from bypassing the proxy to spoof X-Forwarded-* headers.
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|
|
|
|
frontend:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: Dockerfile
|
|
depends_on:
|
|
- api
|
|
ports:
|
|
- "8081:80"
|
|
|
|
# Optional reverse proxy. Enable with: docker compose --profile proxy up
|
|
nginx:
|
|
image: nginx:alpine
|
|
profiles: ["proxy"]
|
|
volumes:
|
|
- ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
|
|
depends_on:
|
|
- api
|
|
- frontend
|
|
ports:
|
|
- "80:80"
|
|
|
|
volumes:
|
|
pgdata:
|
|
keys:
|