version: '3.9'

# Genesis LiteLLM Proxy Stack
# Deploy on Elestio via Custom Docker Compose
# This provides the AI Gateway / Privacy Layer for OpenClaw

services:
  # ============================================
  # LiteLLM Proxy - AI Gateway
  # Routes all model calls through single endpoint
  # ============================================
  litellm:
    image: ghcr.io/berriai/litellm:main-latest
    container_name: genesis-litellm
    ports:
      - "4000:4000"
    volumes:
      - ./litellm_config.yaml:/app/config.yaml
    environment:
      # Master key for LiteLLM admin access
      - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY}

      # API Keys (injected from .env)
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - GEMINI_API_KEY=${GEMINI_API_KEY}
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}

      # Database for usage tracking (use existing Postgres)
      - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}

      # Redis for caching (use existing Redis)
      - REDIS_HOST=${REDIS_HOST}
      - REDIS_PORT=${REDIS_PORT}
      - REDIS_PASSWORD=${REDIS_PASSWORD}
    command: ["--config", "/app/config.yaml", "--port", "4000", "--detailed_debug"]
    restart: always
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:4000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - genesis-net

  # ============================================
  # Presidio Analyzer - PII Detection
  # Identifies sensitive data in prompts
  # ============================================
  presidio-analyzer:
    image: mcr.microsoft.com/presidio-analyzer:latest
    container_name: genesis-presidio-analyzer
    ports:
      - "5001:5001"
    environment:
      - WEB_CONCURRENCY=2
    restart: always
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - genesis-net

  # ============================================
  # Presidio Anonymizer - PII Masking
  # Redacts/masks detected PII before sending to models
  # ============================================
  presidio-anonymizer:
    image: mcr.microsoft.com/presidio-anonymizer:latest
    container_name: genesis-presidio-anonymizer
    ports:
      - "5002:5002"
    restart: always
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5002/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - genesis-net

networks:
  genesis-net:
    driver: bridge
