AnyBot/deploy/ci/server-compose.yml

# The server from a release package (prebuilt binaries in ../../bin). Made from deploy/server/docker-compose.yml.
# Everything on one small server: the account server (relay), HTTPS (Caddy), and AnyBot itself.
#   Easiest: ./setup.sh (asks for the domain, account and keys, writes .env and Caddyfile, starts
#   everything and checks it). By hand:
#   1. Point your domain at the server; copy ../../relay/Caddyfile here and put the domain in it.
#   2. Put your account name and password in .env (see .env.example).
#   3. docker compose up -d
#   4. On the phone open https://your-domain, create the account (first time), and use it.
# AI keys: set them in .env, or set ANYBOT_RESTORE_FROM_ACCOUNT=1 to start from the newest backup
# your Mac made (bots, chats, routines and the keys you set there).
#
# 大腦: this AnyBot is the brain of the account. It keeps the bots, chats, memory and routines,
# and works even while your computers sleep. On each of your computers: 設定 › 手機與帳號 ›
# 大腦 › 「改用它當大腦」. Those computers then show these bots, and the bots can use them as hands
# (screen, files, browser), asking you first as usual. A Linux computer without a screen can be
# hands too: run `anybot setup` there and pick this brain.
services:
  relay:
    build:
      context: ../..
      dockerfile: deploy/server/Dockerfile.server-relay
    restart: unless-stopped
    environment:
      # Your public address (for the links of sites the bots publish), e.g. https://anybot.example.com
      ANYBOT_RELAY_PUBLIC_URL: "${ANYBOT_RELAY_PUBLIC_URL:-}"
      ANYBOT_RELAY_INVITE: "${ANYBOT_RELAY_INVITE:-}"
      # Caddy (or `tailscale serve`) is in front: the caller's address is the one it reports.
      # Without this every login attempt counts as coming from the proxy, and a few wrong
      # passwords from anyone lock that account for everyone.
      RELAY_TRUST_PROXY: "1"
    volumes:
      - relay-data:/data
  caddy:
    image: caddy:2
    restart: unless-stopped
    ports: ["80:80", "443:443"]
    volumes:
      # Written by setup.sh (your domain); ../../relay/Caddyfile is the template.
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
    depends_on: [relay]
  anybot:
    build:
      context: ../..
      dockerfile: deploy/server/Dockerfile.server-anybot
    restart: unless-stopped
    depends_on: [relay]
    environment:
      ANYBOT_ACCOUNT: "http://relay:8080|${ANYBOT_USER}"
      ANYBOT_ACCOUNT_PASSWORD: "${ANYBOT_PASSWORD}"
      ANYBOT_HOST_NAME: "${ANYBOT_HOST_NAME:-雲端 AnyBot}"
      # First start on a new server: make the account (the first one needs no invite).
      ANYBOT_ACCOUNT_CREATE: "1"
      ANYBOT_RELAY_INVITE: "${ANYBOT_RELAY_INVITE:-}"
      XAI_API_KEY: "${XAI_API_KEY:-}"
      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
      GEMINI_API_KEY: "${GEMINI_API_KEY:-}"
      ANYBOT_RESTORE_FROM_ACCOUNT: "${ANYBOT_RESTORE_FROM_ACCOUNT:-}"
      # Same as deploy/server/docker-compose.yml: the socket goes through the filtered proxy,
      # never mounted into the brain.
      DOCKER_HOST: "tcp://docker-socket-proxy:2375"
    volumes:
      - anybot-data:/data
  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy:0.3.0
    restart: unless-stopped
    environment:
      CONTAINERS: "1"
      EXEC: "1"
      IMAGES: "1"
      BUILD: "1"
      VOLUMES: "1"
      NETWORKS: "1"
      POST: "1"
      GET: "1"
    volumes:
      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
volumes:
  relay-data:
  caddy-data:
  anybot-data: