sozsoft-platform/configs/deployment/docker-compose-devops.yml

# DevOps Platform (Forgejo + Rocket)
name: sozsoft-devops

networks:
  forgejo:
    external: false
  rocket:
    external: false
  n8n:
    external: false
  ollama:
    external: false
  db:
    external: true
    name: sozsoft-platform-data_db

volumes:
  rocket_mongodb_data:
    driver: local
  n8n_data:
  ollama_data:
  open_webui_data:
  # netdataconfig:
  # netdatalib:
  # netdatacache:

services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:9
    container_name: forgejo
    restart: always
    environment:
      - USER_UID=1000
      - USER_GID=1000
    ports:
      - 222:22
      - 3000:3000
    volumes:
      - ~/forgejo/data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - /etc/letsencrypt/archive/sozsoft.com:/etc/ssl:ro
    networks:
      - forgejo

  rocket_chat:
    image: registry.rocket.chat/rocketchat/rocket.chat:latest
    container_name: rocketchat
    restart: always
    environment:
      MONGO_URL: "mongodb://bot:JT74Sb2Tb3@rocket_mongodb:27017/rocketchat?authSource=admin&replicaSet=rs0"
      MONGO_OPLOG_URL: "mongodb://bot:JT74Sb2Tb3@rocket_mongodb:27017/local?authSource=admin&replicaSet=rs0"
      ROOT_URL: https://chat.sozsoft.com
      PORT: 3001
      DEPLOY_METHOD: docker
    ports:
      - 3001:3001
    depends_on:
      - rocket_mongodb
    networks:
      - rocket

  rocket_mongodb:
    image: docker.io/bitnami/mongodb:latest
    container_name: rocket-mongo
    restart: always
    environment:
      MONGODB_REPLICA_SET_MODE: primary
      MONGODB_REPLICA_SET_NAME: rs0
      MONGODB_REPLICA_SET_KEY: 123456789
      MONGODB_PORT_NUMBER: 27017
      MONGODB_INITIAL_PRIMARY_HOST: rocket_mongodb
      MONGODB_INITIAL_PRIMARY_PORT_NUMBER: 27017
      MONGODB_ADVERTISED_HOSTNAME: rocket_mongodb
      MONGODB_ROOT_USER: bot
      MONGODB_ROOT_PASSWORD: JT74Sb2Tb3
    ports:
      - 27017:27017
    volumes:
      - rocket_mongodb_data:/bitnami/mongodb
    networks:
      - rocket

  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    user: "1000:1000"
    restart: always
    ports:
      - 5678:5678
    environment:
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=K1r1Ut7Z2o@@
      - N8N_HOST=ai.sozsoft.com
      - N8N_PORT=5678
      - NODE_ENV=production
      - GENERIC_TIMEZONE=Europe/Istanbul
      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
      - N8N_RUNNERS_ENABLED=true
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - n8n
      - db

  ollama:
    image: ollama/ollama:latest
    container_name: ollama
    restart: always
    ports:
      - "11434:11434"
    volumes:
      - ollama_data:/root/.ollama
    environment:
      - OLLAMA_HOST=0.0.0.0
      # 8 GB RAM, GPU yok: ikinci bir model bellege alinirsa kutu takasa duser.
      - OLLAMA_MAX_LOADED_MODELS=1
      - OLLAMA_NUM_PARALLEL=1
      - OLLAMA_KEEP_ALIVE=5m
    networks:
      - ollama
      - n8n

  # ollama.sozsoft.com sohbet arayuzu. Ters vekilde basic auth ARKASINDA DEGILDIR
  # (WebSocket'i kirar, bkz. nginx.conf); guvenlik siniri uygulamanin kendi girisidir.
  # Gomme/erisim hatti kapali: varsayilan RAG sentence-transformers indirir, bu kutuda
  # ne disk ne bellek butcesi var.
  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: open-webui
    restart: always
    ports:
      - 127.0.0.1:3003:8080
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
      - WEBUI_URL=https://ollama.sozsoft.com
      - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
      # Ilk kaydolan kullanici admin olur; sonrakiler onaya duser ve onaylanana kadar hicbir
      # sey yapamaz. Ilk hesap olusturuldugunda Settings -> Admin -> General uzerinden yeni
      # kayit alimi da kapatilir. Bu iki deger PersistentConfig'tir: yalnizca ILK acilista
      # env'den okunur, sonrasinda veritabanindaki deger gecerlidir.
      - DEFAULT_USER_ROLE=pending
      - BYPASS_EMBEDDING_AND_RETRIEVAL=true
      - ENABLE_IMAGE_GENERATION=false
      - WHISPER_MODEL_AUTO_UPDATE=false
      - HF_HUB_OFFLINE=1
      - GENERIC_TIMEZONE=Europe/Istanbul
    volumes:
      - open_webui_data:/app/backend/data
    mem_limit: 2g
    depends_on:
      - ollama
    networks:
      - ollama
      
  coturn:
    image: coturn/coturn:latest # ✅ Güncel resmi image
    container_name: coturn
    restart: unless-stopped
    ports:
      - "3478:3478" # STUN/TURN TCP
      - "3478:3478/udp" # STUN/TURN UDP
      - "5349:5349" # TLS TCP
      - "5349:5349/udp" # DTLS UDP
      - "49160-49200:49160-49200/udp" # Relay port aralığı
    volumes:
      - ./configs/turnserver.conf:/etc/coturn/turnserver.conf:ro
      - /etc/ssl/sozsoft.com:/etc/ssl/sozsoft.com:ro # Sertifikaları mount ettik
      - ./logs/coturn:/var/log # Logları dışarı al (opsiyonel)
    command: ["turnserver", "-c", "/etc/coturn/turnserver.conf"]

  # dashboard:
  #   image: netdata/netdata:stable
  #   container_name: dashboard
  #   hostname: kursserver
  #   restart: unless-stopped
  #   pid: host
  #   network_mode: host
  #   cap_add:
  #     - SYS_PTRACE
  #     - SYS_ADMIN
  #   security_opt:
  #     - apparmor:unconfined
  #   volumes:
  #     - netdataconfig:/etc/netdata
  #     - netdatalib:/var/lib/netdata
  #     - netdatacache:/var/cache/netdata
  #     - /:/host/root:ro,rslave
  #     - /etc/passwd:/host/etc/passwd:ro
  #     - /etc/group:/host/etc/group:ro
  #     - /etc/localtime:/etc/localtime:ro
  #     - /proc:/host/proc:ro
  #     - /sys:/host/sys:ro
  #     - /etc/os-release:/host/etc/os-release:ro
  #     - /var/log:/host/var/log:ro
  #     - /var/run/docker.sock:/var/run/docker.sock:ro
  #     - /run/dbus:/run/dbus:ro