45 lines
1.9 KiB
YAML
45 lines
1.9 KiB
YAML
# Quickstart: single-container Paperclip with embedded database.
|
|
# Copy this file and set the required env vars before running.
|
|
#
|
|
# cd docker
|
|
# export BETTER_AUTH_SECRET="$(openssl rand -hex 32)"
|
|
# export ANTHROPIC_API_KEY="sk-ant-..."
|
|
# docker compose -f docker-compose.quickstart.yml up --build
|
|
#
|
|
services:
|
|
paperclip:
|
|
build:
|
|
context: ..
|
|
dockerfile: Dockerfile
|
|
# Ceiling on processes. The image makes tini PID 1 so orphaned agent
|
|
# descendants are reaped instead of piling up as zombies; this is the
|
|
# backstop if something leaks anyway — the container hits its own limit and
|
|
# dies visibly rather than starving the host of pids.
|
|
pids_limit: 2048
|
|
ports:
|
|
- "${PAPERCLIP_PORT:-3100}:3100"
|
|
environment:
|
|
HOST: "0.0.0.0"
|
|
PAPERCLIP_HOME: "/paperclip"
|
|
|
|
# ── LLM provider keys (at least one is needed for agents to work) ──
|
|
OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
|
|
ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
|
|
|
|
# ── Deployment settings ──
|
|
# "authenticated" requires login, "local_trusted" skips auth
|
|
PAPERCLIP_DEPLOYMENT_MODE: "authenticated"
|
|
# "private" = LAN only, "public" = internet-facing (use with TLS)
|
|
PAPERCLIP_DEPLOYMENT_EXPOSURE: "private"
|
|
# Base URL users will access the UI at
|
|
PAPERCLIP_PUBLIC_URL: "${PAPERCLIP_PUBLIC_URL:-http://localhost:3100}"
|
|
# Extra hostnames the instance accepts beyond the public URL host
|
|
# (LAN or Tailscale aliases), comma-separated; empty means none
|
|
PAPERCLIP_ALLOWED_HOSTNAMES: "${PAPERCLIP_ALLOWED_HOSTNAMES:-}"
|
|
|
|
# ── Required secret for session signing (generate with: openssl rand -hex 32) ──
|
|
BETTER_AUTH_SECRET: "${BETTER_AUTH_SECRET:?BETTER_AUTH_SECRET must be set}"
|
|
volumes:
|
|
# Persistent data directory (database, agent workspaces, uploads)
|
|
- "${PAPERCLIP_DATA_DIR:-../data/docker-paperclip}:/paperclip"
|