Files
sim/docker-compose.ollama.yml
T
Waleed 0c25fc4ee1 fix(auth): resolve CORS errors for self-hosted deployments behind reverse proxies (#4369)
* fix(auth): resolve CORS errors for self-hosted deployments behind reverse proxies

- auth client now uses browser origin first, falling back to NEXT_PUBLIC_APP_URL
- socket client falls back to page origin when served from non-localhost (assumes /socket.io is proxied)
- add TRUSTED_ORIGINS env var to extend Better Auth trustedOrigins (apex+www, alias hostnames)
- warn at startup when NEXT_PUBLIC_APP_URL is localhost in production
- preprocess empty NEXT_PUBLIC_SOCKET_URL so docker-compose ${VAR:-} works
- migrate remaining uuid/nanoid/randomUUID usages to @sim/utils generateId/generateShortId
- extend generateShortId with optional alphabet param (rejection sampling)
- document TRUSTED_ORIGINS in .env.example, docker-compose.prod.yml, and helm values.yaml

Fixes simstudioai/sim#1243

* fix(auth): address PR review comments

* chore(env): drop unnecessary NEXT_PUBLIC_SOCKET_URL preprocess (skipValidation is true)

* fix(docker): include @sim/utils in migrations image

Migration scripts now import generateId from @sim/utils/id; without copying packages/utils into the image, bun install fails to resolve the workspace dep at build time and the import fails at runtime.

* fix(helm): remove unused NEXT_PUBLIC_SOCKET_URL from realtime sections

The realtime service never reads NEXT_PUBLIC_SOCKET_URL — its env schema
only includes BETTER_AUTH_URL, NEXT_PUBLIC_APP_URL, ALLOWED_ORIGINS,
BETTER_AUTH_SECRET, INTERNAL_API_SECRET, DATABASE_URL, and REDIS_URL.
Remove the dead config from all helm values files and the values schema.

* fix(helm): allow empty NEXT_PUBLIC_SOCKET_URL in values schema

The default in values.yaml is now "" (empty string), which falls back to
the page origin at runtime. The schema previously required a valid URI,
which would reject the default. Mirror the INTERNAL_API_BASE_URL pattern
using anyOf with const "". Also add TRUSTED_ORIGINS to the schema.

* docs(self-hosting): mark NEXT_PUBLIC_SOCKET_URL as optional

The page-origin fallback in getSocketUrl() means self-hosters no longer
need to set NEXT_PUBLIC_SOCKET_URL when realtime is on the same origin
as the app. Update docs to reflect this:

- Remove NEXT_PUBLIC_SOCKET_URL from .env scaffolding examples in
  docker.mdx, platforms.mdx, environment-variables.mdx
- Mark the variable as Optional in the env vars table with the new
  default behavior described
- Update troubleshooting to point at reverse-proxy /socket.io routing
  rather than the env var
- Flip dev docker-compose defaults (local, ollama, devcontainer) from
  http://localhost:3002 to empty for consistency with prod.yml; the
  in-code localhost fallback handles the dev case identically

Applied across all 6 documentation languages (en/fr/de/ja/es/zh).

* chore: untrack and ignore .claude/scheduled_tasks.lock
2026-04-30 19:26:19 -07:00

182 lines
5.0 KiB
YAML

name: sim-with-ollama
services:
# Main Sim Application
simstudio:
build:
context: .
dockerfile: docker/app.Dockerfile
ports:
- '3000:3000'
deploy:
resources:
limits:
memory: 8G
environment:
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
- BETTER_AUTH_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
- NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
- BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-sim_auth_secret_$(openssl rand -hex 16)}
- ENCRYPTION_KEY=${ENCRYPTION_KEY:-$(openssl rand -hex 32)}
- COPILOT_API_KEY=${COPILOT_API_KEY}
- SIM_AGENT_API_URL=${SIM_AGENT_API_URL}
- OLLAMA_URL=http://ollama:11434
- NEXT_PUBLIC_SOCKET_URL=${NEXT_PUBLIC_SOCKET_URL:-}
depends_on:
db:
condition: service_healthy
migrations:
condition: service_completed_successfully
realtime:
condition: service_healthy
healthcheck:
test: ['CMD', 'wget', '--spider', '--quiet', 'http://127.0.0.1:3000']
interval: 90s
timeout: 5s
retries: 3
start_period: 10s
restart: unless-stopped
# Realtime Socket Server
realtime:
build:
context: .
dockerfile: docker/realtime.Dockerfile
environment:
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
- NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
- BETTER_AUTH_URL=${BETTER_AUTH_URL:-http://localhost:3000}
- BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-sim_auth_secret_$(openssl rand -hex 16)}
depends_on:
db:
condition: service_healthy
restart: unless-stopped
ports:
- '3002:3002'
deploy:
resources:
limits:
memory: 1G
healthcheck:
test: ['CMD', 'wget', '--spider', '--quiet', 'http://127.0.0.1:3002/health']
interval: 90s
timeout: 5s
retries: 3
start_period: 10s
# Database Migrations
migrations:
build:
context: .
dockerfile: docker/db.Dockerfile
environment:
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
depends_on:
db:
condition: service_healthy
command: ['bun', 'run', 'db:migrate']
restart: 'no'
# PostgreSQL Database with Vector Extension
db:
image: pgvector/pgvector:pg17
restart: always
ports:
- '${POSTGRES_PORT:-5432}:5432'
environment:
- POSTGRES_USER=${POSTGRES_USER:-postgres}
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
- POSTGRES_DB=${POSTGRES_DB:-simstudio}
volumes:
- postgres_data:/var/lib/postgresql/data
healthcheck:
test: ['CMD-SHELL', 'pg_isready -U postgres']
interval: 5s
timeout: 5s
retries: 5
# Ollama with GPU support (default)
ollama:
profiles:
- gpu
image: ollama/ollama:latest
pull_policy: always
volumes:
- ollama_data:/root/.ollama
ports:
- '11434:11434'
environment:
- NVIDIA_DRIVER_CAPABILITIES=all
- OLLAMA_LOAD_TIMEOUT=-1
- OLLAMA_KEEP_ALIVE=-1
- OLLAMA_DEBUG=1
- OLLAMA_HOST=0.0.0.0:11434
command: 'serve'
deploy:
resources:
reservations:
devices:
- driver: nvidia
count: all
capabilities: [gpu]
healthcheck:
test: ['CMD', 'ollama', 'list']
interval: 10s
timeout: 5s
retries: 5
start_period: 30s
restart: unless-stopped
# Ollama CPU-only version (use with --profile cpu profile)
ollama-cpu:
profiles:
- cpu
image: ollama/ollama:latest
pull_policy: always
volumes:
- ollama_data:/root/.ollama
ports:
- '11434:11434'
environment:
- OLLAMA_LOAD_TIMEOUT=-1
- OLLAMA_KEEP_ALIVE=-1
- OLLAMA_DEBUG=1
- OLLAMA_HOST=0.0.0.0:11434
command: 'serve'
healthcheck:
test: ['CMD', 'ollama', 'list']
interval: 10s
timeout: 5s
retries: 5
start_period: 30s
restart: unless-stopped
networks:
default:
aliases:
- ollama
# Helper container to pull models automatically
model-setup:
image: ollama/ollama:latest
profiles:
- setup
volumes:
- ollama_data:/root/.ollama
environment:
- OLLAMA_HOST=ollama:11434
entrypoint: ["/bin/sh", "-lc"]
command: >
sh -c "
echo 'Waiting for Ollama to be ready...' &&
until ollama list >/dev/null 2>&1; do echo 'Waiting for Ollama...'; sleep 2; done &&
echo 'Pulling gemma3:4b model (recommended starter model)...' &&
ollama pull gemma3:4b &&
echo 'Model setup complete! You can now use gemma3:4b in Sim.' &&
echo 'To add more models, run: docker compose -f docker-compose.ollama.yml exec ollama ollama pull <model-name>'
"
restart: 'no'
volumes:
postgres_data:
ollama_data: