# Lokaler LLM-Server: llama-swap (llama.cpp/ROCm) hinter Caddy (IP-Filter + API-Key)
# Start:  docker compose up -d      Logs: docker compose logs -f llama-swap
name: localai

services:
  llama-swap:
    image: ghcr.io/mostlygeek/llama-swap:${LLAMA_SWAP_TAG:-v265-rocm-b11610}
    restart: unless-stopped
    # nur lokal erreichbar – von außen ausschließlich über Caddy
    ports:
      - "127.0.0.1:${BACKEND_PORT:-8080}:8080"
    user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
    group_add:
      - "${RENDER_GID}"
      - "${VIDEO_GID}"
    devices:
      - /dev/kfd
      - /dev/dri
    security_opt:
      - seccomp=unconfined
    ipc: host
    environment:
      HOME: /tmp
      LLAMA_CACHE: /models
      HIP_VISIBLE_DEVICES: "${HIP_VISIBLE_DEVICES:-0}"
      HF_TOKEN: "${HF_TOKEN:-}"
    volumes:
      - ./models:/models
      - ./llama-swap/config.yaml:/app/config.yaml:ro
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  caddy:
    image: caddy:${CADDY_TAG:-2.10.2-alpine}
    restart: unless-stopped
    # Host-Netz: Quell-IP bleibt erhalten und ufw greift (Docker-Port-Publishing umgeht ufw)
    network_mode: host
    environment:
      LLM_API_KEY: "${LLM_API_KEY:?LLM_API_KEY in .env setzen}"
      ALLOWED_NETS: "${ALLOWED_NETS:-127.0.0.0/8 ::1}"
      LISTEN_PORT: "${LISTEN_PORT:-8800}"
      BACKEND_PORT: "${BACKEND_PORT:-8080}"
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
    depends_on:
      - llama-swap