services: provider-proxy-host: image: node:24-alpine container_name: xiteng-provider-proxy-host restart: unless-stopped network_mode: host command: ["node", "/app/proxy-bridge.mjs"] environment: BRIDGE_MODE: host volumes: - ./proxy-bridge.mjs:/app/proxy-bridge.mjs:ro - ./run:/run/provider-proxy security_opt: - no-new-privileges:true healthcheck: test: ["CMD", "node", "-e", "const s=require('net').connect(7897,'127.0.0.1',()=>{s.end();process.exit(0)});s.setTimeout(2000,()=>process.exit(1));s.on('error',()=>process.exit(1))"] interval: 15s timeout: 3s retries: 3 start_period: 5s provider-proxy-bridge: image: node:24-alpine container_name: xiteng-provider-proxy-bridge restart: unless-stopped command: ["node", "/app/proxy-bridge.mjs"] environment: BRIDGE_MODE: network volumes: - ./proxy-bridge.mjs:/app/proxy-bridge.mjs:ro - ./run:/run/provider-proxy security_opt: - no-new-privileges:true healthcheck: test: ["CMD", "node", "-e", "const s=require('net').connect(17897,'127.0.0.1',()=>{s.end();process.exit(0)});s.setTimeout(2000,()=>process.exit(1));s.on('error',()=>process.exit(1))"] interval: 15s timeout: 3s retries: 3 start_period: 5s networks: - homelab_net ollama-host-bridge: image: node:24-alpine container_name: xiteng-ollama-host-bridge restart: unless-stopped network_mode: host command: ["node", "/app/proxy-bridge.mjs"] environment: BRIDGE_MODE: host BRIDGE_SOCKET: /run/provider-proxy/ollama.sock UPSTREAM_HOST: 127.0.0.1 UPSTREAM_PORT: "11434" volumes: - ./proxy-bridge.mjs:/app/proxy-bridge.mjs:ro - ./run:/run/provider-proxy security_opt: - no-new-privileges:true ollama-provider-bridge: image: node:24-alpine container_name: xiteng-ollama-provider-bridge restart: unless-stopped command: ["node", "/app/proxy-bridge.mjs"] environment: BRIDGE_MODE: network BRIDGE_SOCKET: /run/provider-proxy/ollama.sock LISTEN_PORT: "11434" UPSTREAM_HTTP_HOST: localhost:11434 volumes: - ./proxy-bridge.mjs:/app/proxy-bridge.mjs:ro - ./run:/run/provider-proxy depends_on: - ollama-host-bridge security_opt: - no-new-privileges:true healthcheck: test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:11434/api/tags').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"] interval: 15s timeout: 5s retries: 3 start_period: 5s networks: - homelab_net chat: build: context: ./app args: BASE_PATH: /chat HOME_URL: / image: turnfold:local container_name: xiteng-chat restart: unless-stopped environment: AUTH_MODE: forward-auth AUTH_ISSUER: https://auth.xiteng.site BASE_PATH: /chat KEY_VAULT_URL: http://ai-gateway:8093 KEY_VAULT_TOKEN_FILE: /run/secrets/portal_gateway_hmac CHAT_DATABASE_PATH: /data/chat.db PORTAL_URL: http://xiteng-site:8080 ACCOUNT_URL: https://xiteng.site/account PUBLIC_PROVIDER_CATALOG_FILE: /app/providers.json volumes: - ../ai-gateway/secrets/portal_gateway_hmac:/run/secrets/portal_gateway_hmac:ro - ../ai-gateway/providers.json:/app/providers.json:ro - ./data:/data security_opt: - no-new-privileges:true healthcheck: test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/chat/api/health"] interval: 15s timeout: 5s retries: 3 start_period: 10s networks: - homelab_net labels: - "traefik.enable=true" - "traefik.http.services.xiteng-chat.loadbalancer.server.port=3000" - "traefik.http.middlewares.xiteng-chat-scheme.headers.customrequestheaders.X-Forwarded-Proto=https" - "traefik.http.middlewares.xiteng-chat-auth.forwardauth.address=http://authentik-outpost:9000/outpost.goauthentik.io/auth/traefik" - "traefik.http.middlewares.xiteng-chat-auth.forwardauth.trustForwardHeader=true" - "traefik.http.middlewares.xiteng-chat-auth.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-email,X-authentik-name,X-authentik-uid" - "traefik.http.routers.xiteng-chat.rule=Host(`xiteng.site`) && (Path(`/chat`) || PathPrefix(`/chat/`))" - "traefik.http.routers.xiteng-chat.entrypoints=websecure" - "traefik.http.routers.xiteng-chat.tls=true" - "traefik.http.routers.xiteng-chat.tls.certresolver=cfresolver" - "traefik.http.routers.xiteng-chat.service=xiteng-chat" - "traefik.http.routers.xiteng-chat.middlewares=xiteng-chat-scheme" - "traefik.http.routers.xiteng-chat.priority=300" - "traefik.http.routers.xiteng-chat-api.rule=Host(`xiteng.site`) && PathPrefix(`/chat/api/`)" - "traefik.http.routers.xiteng-chat-api.entrypoints=websecure" - "traefik.http.routers.xiteng-chat-api.tls=true" - "traefik.http.routers.xiteng-chat-api.tls.certresolver=cfresolver" - "traefik.http.routers.xiteng-chat-api.service=xiteng-chat" - "traefik.http.routers.xiteng-chat-api.middlewares=xiteng-chat-scheme,xiteng-chat-auth" - "traefik.http.routers.xiteng-chat-api.priority=320" - "traefik.http.routers.xiteng-chat-public-api.rule=Host(`xiteng.site`) && Path(`/chat/api/public-config`)" - "traefik.http.routers.xiteng-chat-public-api.entrypoints=websecure" - "traefik.http.routers.xiteng-chat-public-api.tls=true" - "traefik.http.routers.xiteng-chat-public-api.tls.certresolver=cfresolver" - "traefik.http.routers.xiteng-chat-public-api.service=xiteng-chat" - "traefik.http.routers.xiteng-chat-public-api.middlewares=xiteng-chat-scheme" - "traefik.http.routers.xiteng-chat-public-api.priority=330" - "traefik.http.routers.xiteng-chat-http.rule=Host(`xiteng.site`) && (Path(`/chat`) || PathPrefix(`/chat/`))" - "traefik.http.routers.xiteng-chat-http.entrypoints=web" - "traefik.http.routers.xiteng-chat-http.service=xiteng-chat" - "traefik.http.routers.xiteng-chat-http.middlewares=xiteng-chat-scheme" - "traefik.http.routers.xiteng-chat-http.priority=300" - "traefik.http.routers.xiteng-chat-api-http.rule=Host(`xiteng.site`) && PathPrefix(`/chat/api/`)" - "traefik.http.routers.xiteng-chat-api-http.entrypoints=web" - "traefik.http.routers.xiteng-chat-api-http.service=xiteng-chat" - "traefik.http.routers.xiteng-chat-api-http.middlewares=xiteng-chat-scheme,xiteng-chat-auth" - "traefik.http.routers.xiteng-chat-api-http.priority=320" - "traefik.http.routers.xiteng-chat-public-api-http.rule=Host(`xiteng.site`) && Path(`/chat/api/public-config`)" - "traefik.http.routers.xiteng-chat-public-api-http.entrypoints=web" - "traefik.http.routers.xiteng-chat-public-api-http.service=xiteng-chat" - "traefik.http.routers.xiteng-chat-public-api-http.middlewares=xiteng-chat-scheme" - "traefik.http.routers.xiteng-chat-public-api-http.priority=330" - "xiteng.site.cache.chat.enabled=true" - "xiteng.site.cache.chat.routers=xiteng-chat,xiteng-chat-http" - "xiteng.site.cache.chat.paths=/chat/assets/,/chat/icons/" - "xiteng.site.cache.chat.edge-ttl=604800" - "xiteng.site.cache.chat.stale-while-revalidate=86400" - "xiteng.site.component.chat.enabled=true" - "xiteng.site.component.chat.name=Turnfold" - "xiteng.site.component.chat.description=本地优先、支持分支式历史的 AI 对话仓库；无需登录即可使用浏览器 Provider，登录后启用个人同步与 Key Vault。" - "xiteng.site.component.chat.section=services" - "xiteng.site.component.chat.category=AI" - "xiteng.site.component.chat.url=https://xiteng.site/chat/" - "xiteng.site.component.chat.access=public" - "xiteng.site.component.chat.access-label=可以登录" - "xiteng.site.component.chat.icon=AI" - "xiteng.site.component.chat.icon-url=https://xiteng.site/icons/services/chat.svg" - "xiteng.site.component.chat.accent=blue" - "xiteng.site.component.chat.order=190" - "xiteng.site.component.chat.navigation=same-tab" - "xiteng.site.component.chat.portal-link=embedded" - "xiteng.site.component.chat.monitor.enabled=true" - "xiteng.site.component.chat.monitor.url=http://xiteng-chat:3000/chat/api/health" networks: homelab_net: external: true