ragbench/docker-compose.aws.yml at main · gittycat/ragbench · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
# AWS single-instance demo overlay (EC2, arm64, behind an ALB that
# terminates TLS).
# Usage: docker compose -f docker-compose.yml -f docker-compose.aws.yml up -d
#
# Pulls prebuilt images from ECR (built/pushed via `just ecr-push`) instead
# of building locally, runs a local TEI (embedding inference) alongside the
# app, and locks down which services are network-reachable: only webapp is
# published (the ALB routes to its 8000:3000 mapping). rag-server and evals
# stay unpublished — evals in particular has no authentication of its own and
# must never be reachable from outside the instance.
#
# Resource limits below are budgeted for a 16 GB / 4 vCPU host:
# postgres 3G/1.0, rag-server 4G/1.5, task-worker 3G/1.0, tei 3G/2.0,
# webapp 512M/0.5, evals 1G/0.5 (memory sums to 14.5G of 16G headroom for the
# host + Docker; cpus are ceilings, not reservations, so they may oversubscribe
# the 4 vCPUs without starving the host). tei's cpu ceiling is raised to 2.0
# (up from the previous local-inference container's 1.0) — query embedding is
# now on the synchronous request path and needs the headroom.
#
# Prerequisites:
# 1. Images pushed to ECR (`just ecr-push`) — set REGISTRY to the ECR repo
#    root, e.g. 123456789012.dkr.ecr.ap-southeast-2.amazonaws.com/ragbench
# 2. secrets/RAG_SERVER_AUTH_TOKEN populated (see docker-compose.server.yml)
# 3. EC2 user data exports WEBAPP_ORIGIN to the ALB's public HTTPS URL
#    before this overlay is applied
# 4. tei is a compose service on the private network in every environment, so
#    config.yml's embedding `base_url` is always http://tei:80 — no bake-time
#    `sed` rewrite of the embedding base_url is needed at all any more (the
#    previous host-based local-inference setup needed one; that rewrite has
#    been removed from infra/assets/bake.sh).

services:
  webapp:
    image: ${REGISTRY}/webapp:${VERSION:-latest}
    build: !reset null
    secrets:
      - RAG_SERVER_AUTH_TOKEN
    environment:
      # adapter-node's CSRF check rejects POSTs unless ORIGIN matches the
      # public URL; base compose hardcodes localhost. Real value is exported
      # by EC2 user data — this default is only a fallback.
      - ORIGIN=${WEBAPP_ORIGIN:-https://demo.example.com}
      # adapter-node defaults to 512 KB; must cover MAX_UPLOAD_SIZE=80 (80 MB).
      - BODY_SIZE_LIMIT=83886080
      - RAG_SERVER_AUTH_TOKEN_FILE=/run/secrets/RAG_SERVER_AUTH_TOKEN
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"

  rag-server:
    image: ${REGISTRY}/rag-server:${VERSION:-latest}
    build: !reset null
    # Dockerfile's CMD is shell-form, so /bin/sh is PID 1 and never forwards
    # SIGTERM — without init, every stop waits the full 10s for SIGKILL.
    init: true
    ports: !reset []
    secrets:
      - OPENAI_API_KEY
      - ANTHROPIC_API_KEY
      - RAG_SERVER_DB_USER
      - RAG_SERVER_DB_PASSWORD
      - RAG_SERVER_AUTH_TOKEN
    environment:
      - RAG_SERVER_AUTH_TOKEN_FILE=/run/secrets/RAG_SERVER_AUTH_TOKEN
    extra_hosts: !reset []
    deploy:
      resources:
        limits:
          memory: 4G
          cpus: "1.5"

  task-worker:
    image: ${REGISTRY}/rag-server:${VERSION:-latest}
    build: !reset null
    init: true
    extra_hosts: !reset []
    deploy:
      resources:
        limits:
          memory: 3G
          cpus: "1.0"

  postgres:
    image: ${REGISTRY}/postgres:${VERSION:-latest}
    build: !reset null
    deploy:
      resources:
        limits:
          memory: 3G
          cpus: "1.0"

  evals:
    image: ${REGISTRY}/evals:${VERSION:-latest}
    build: !reset null
    ports: !reset []
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "0.5"

  # Local TEI for demo — reachable from rag-server/task-worker on the
  # private network; also on the public network so a bake-time image pull
  # / weight warm can reach the internet. No ports published.
  tei:
    # No versioned arm64 CPU tag is published upstream — pinned by digest.
    # See docker-compose.yml's tei service for the full rationale.
    image: ghcr.io/huggingface/text-embeddings-inference:cpu-arm64-latest@sha256:35c50d7494de22deecdb783b8f5b7e1d05765709bd90071b03469b9440d28656
    restart: unless-stopped
    # --max-batch-tokens 2048: see docker-compose.yml's tei service for why —
    # the TEI default (16384) never finishes CPU warmup on this model.
    command: ["--model-id", "Qwen/Qwen3-Embedding-0.6B", "--port", "80", "--max-client-batch-size", "32", "--max-batch-tokens", "2048"]
    volumes:
      - tei_data:/data
    networks:
      - public
      - private
    deploy:
      resources:
        limits:
          memory: 3G
          cpus: "2.0"

volumes:
  tei_data:
    driver: local

secrets:
  RAG_SERVER_AUTH_TOKEN:
    file: secrets/RAG_SERVER_AUTH_TOKEN