services:
  supermemory-fetch:
    image: curlimages/curl:8.16.0@sha256:463eaf6072688fe96ac64fa623fe73e1dbe25d8ad6c34404a669ad3ce1f104b6
    container_name: supermemory-poc-fetch
    user: "0:0"
    restart: "no"
    environment:
      SUPERMEMORY_BINARY_URL: https://github.com/supermemoryai/supermemory/releases/download/server-v0.0.8/supermemory-server-linux-x64
      SUPERMEMORY_BINARY_SHA256: 87f32433d0179be80bb9d8a1bafbac65af4128324342a27ecb8bd1a77b5506f3
    entrypoint:
      - /bin/sh
      - -ec
    command:
      - |
        target=/opt/supermemory/bin/supermemory-server
        ca_target=/opt/supermemory/bin/ca-certificates.crt
        checksum="$${SUPERMEMORY_BINARY_SHA256}  $${target}"
        mkdir -p /opt/supermemory/bin
        if [ -f /cacert.pem ]; then
          cp /cacert.pem "$${ca_target}"
        elif [ -f /etc/ssl/certs/ca-certificates.crt ]; then
          cp /etc/ssl/certs/ca-certificates.crt "$${ca_target}"
        else
          echo "curl image CA bundle not found" >&2
          exit 1
        fi
        chmod 0644 "$${ca_target}"
        if [ -f "$${target}" ] && echo "$${checksum}" | sha256sum -c - >/dev/null 2>&1; then
          exit 0
        fi
        tmp="$${target}.download"
        rm -f "$${tmp}"
        curl --fail --location --retry 3 --output "$${tmp}" "$${SUPERMEMORY_BINARY_URL}"
        echo "$${SUPERMEMORY_BINARY_SHA256}  $${tmp}" | sha256sum -c -
        chmod 0755 "$${tmp}"
        mv "$${tmp}" "$${target}"
    volumes:
      - /mnt/user/appdata/supermemory-poc/bin:/opt/supermemory/bin
    networks:
      - fetch
    security_opt:
      - no-new-privileges:true

  supermemory:
    image: debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171
    platform: linux/amd64
    container_name: supermemory-poc
    restart: unless-stopped
    depends_on:
      supermemory-fetch:
        condition: service_completed_successfully
    environment:
      PORT: "6767"
      SUPERMEMORY_DATA_DIR: /var/lib/supermemory
      SUPERMEMORY_DISABLE_TELEMETRY: "1"
      SUPERMEMORY_EMBEDDING_PROVIDER: local
      SUPERMEMORY_EMBEDDING_MODEL: Xenova/bge-m3
      SUPERMEMORY_EMBEDDING_DIMENSIONS: "1024"
      SUPERMEMORY_LOCAL_EMBEDDING_POOL_SIZE: "1"
      SUPERMEMORY_LOCAL_EMBEDDING_WASM_THREADS: "1"
      SUPERMEMORY_LOCAL_EMBEDDING_BATCH_SIZE: "4"
      SUPERMEMORY_EMBEDDING_RAM_LIMIT: 2gb
      SUPERMEMORY_INGEST_CONCURRENCY: "1"
      SSL_CERT_FILE: /opt/supermemory/bin/ca-certificates.crt
      SSL_CERT_DIR: /etc/ssl/certs
      NODE_EXTRA_CA_CERTS: /opt/supermemory/bin/ca-certificates.crt
      OPENAI_API_KEY: ${OPENAI_API_KEY:?set OPENAI_API_KEY in Arcane environment}
      OPENAI_BASE_URL: ${OPENAI_BASE_URL:-}
      OPENAI_MODEL: ${OPENAI_MODEL:-gpt-5.1}
    entrypoint:
      - /bin/bash
      - -ec
    command:
      - |
        umask 077
        exec /opt/supermemory/bin/supermemory-server
    healthcheck:
      test: ["CMD-SHELL", "bash -ec ': >/dev/tcp/127.0.0.1/6767'"]
      interval: 15s
      timeout: 3s
      retries: 20
      start_period: 120s
    stop_grace_period: 60s
    mem_limit: 8g
    cpus: 4
    volumes:
      - /mnt/user/appdata/supermemory-poc/bin:/opt/supermemory/bin:ro
      - /mnt/user/appdata/supermemory-poc/bin/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
      - /mnt/user/appdata/supermemory-poc/data:/var/lib/supermemory
    networks:
      br0:
        ipv4_address: ${SUPERMEMORY_IPV4_ADDRESS:?set an unused LAN address in Arcane environment}
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

networks:
  fetch:
    internal: false
  br0:
    external: true
    name: br0