# Lokaler LLM-Server: llama-swap (llama.cpp/ROCm + whisper/sd-server) hinter Caddy (IP-Filter + API-Key)
# Start:  docker compose up -d --build      Logs: docker compose logs -f llama-swap
name: localai

services:
  llama-swap:
    # ROCm-Image + whisper-server/sd-server aus dem unified-Image, siehe llama-swap/Dockerfile
    build:
      context: ./llama-swap
      args:
        LLAMA_SWAP_TAG: ${LLAMA_SWAP_TAG:-v265-rocm-b11610}
        UNIFIED_TAG: ${UNIFIED_TAG:-unified-vulkan-265}
    image: localai/llama-swap:${LLAMA_SWAP_TAG:-v265-rocm-b11610}-mm
    restart: unless-stopped
    # nur lokal erreichbar – von außen ausschließlich über Caddy
    ports:
      - "127.0.0.1:${BACKEND_PORT:-8080}:8080"
    user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
    group_add:
      - "${RENDER_GID}"
      - "${VIDEO_GID}"
    devices:
      - /dev/kfd
      - /dev/dri
    security_opt:
      - seccomp=unconfined
    ipc: host
    environment:
      HOME: /tmp
      LLAMA_CACHE: /models
      HIP_VISIBLE_DEVICES: "${HIP_VISIBLE_DEVICES:-0}"
      # Vulkan (sd-server) zählt die iGPU mit – hier ist die RX 6950 XT Gerät 1
      GGML_VK_VISIBLE_DEVICES: "${VK_VISIBLE_DEVICES:-1}"
      HF_TOKEN: "${HF_TOKEN:-}"
    volumes:
      - ./models:/models
      - ./llama-swap/config.yaml:/app/config.yaml:ro
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  caddy:
    image: caddy:${CADDY_TAG:-2.10.2-alpine}
    restart: unless-stopped
    # Host-Netz: Quell-IP bleibt erhalten und ufw greift (Docker-Port-Publishing umgeht ufw)
    network_mode: host
    environment:
      LLM_API_KEY: "${LLM_API_KEY:?LLM_API_KEY in .env setzen}"
      ALLOWED_NETS: "${ALLOWED_NETS:-127.0.0.0/8 ::1}"
      LISTEN_PORT: "${LISTEN_PORT:-8800}"
      BACKEND_PORT: "${BACKEND_PORT:-8080}"
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
    depends_on:
      - llama-swap