refactor(coolify): externalize postgres, qdrant, S3; remove jitsi/synapse

- Remove PostgreSQL, Qdrant, MinIO services (managed separately in Coolify)
- Remove Jitsi stack (web, xmpp, jicofo, jvb) and Synapse/synapse-db
- Add POSTGRES_HOST, QDRANT_URL, S3_ENDPOINT/S3_ACCESS_KEY/S3_SECRET_KEY env vars
- Remove Traefik labels from internal-only services
- Health aggregator no longer checks external services
- Core now has 10 services: valkey + 9 application services

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.coolify.example

@@ -5,7 +5,9 @@
 # for the breakpilot-core Docker Compose resource.
 # =========================================================
 
-# --- Database ---
+# --- External PostgreSQL (Coolify-managed) ---
+POSTGRES_HOST=<coolify-postgres-hostname>
+POSTGRES_PORT=5432
 POSTGRES_USER=breakpilot
 POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD
 POSTGRES_DB=breakpilot_db
@@ -15,12 +17,17 @@ JWT_SECRET=CHANGE_ME_RANDOM_64_CHARS
 JWT_REFRESH_SECRET=CHANGE_ME_ANOTHER_RANDOM_64_CHARS
 INTERNAL_API_KEY=CHANGE_ME_INTERNAL_KEY
 
-# --- MinIO (S3 Object Storage) ---
+# --- External S3 Storage ---
-MINIO_ROOT_USER=breakpilot
+S3_ENDPOINT=<s3-endpoint-host:port>
-MINIO_ROOT_PASSWORD=CHANGE_ME_MINIO_PASSWORD
+S3_ACCESS_KEY=CHANGE_ME_S3_ACCESS_KEY
-MINIO_BUCKET=breakpilot-rag
+S3_SECRET_KEY=CHANGE_ME_S3_SECRET_KEY
+S3_BUCKET=breakpilot-rag
+S3_SECURE=true
 
-# --- SMTP (Real mail server, not Mailpit) ---
+# --- External Qdrant (Coolify-managed) ---
+QDRANT_URL=http://<coolify-qdrant-hostname>:6333
+
+# --- SMTP (Real mail server) ---
 SMTP_HOST=smtp.example.com
 SMTP_PORT=587
 SMTP_USERNAME=noreply@breakpilot.ai
@@ -52,20 +59,7 @@ OPENAI_API_KEY=
 COHERE_API_KEY=
 LOG_LEVEL=INFO
 
-# --- Ollama (optional, if running on same server) ---
+# --- Ollama (optional) ---
 OLLAMA_BASE_URL=
 OLLAMA_URL=
 OLLAMA_VOICE_MODEL=
-
-# --- Matrix/Synapse ---
-SYNAPSE_DB_PASSWORD=CHANGE_ME_SYNAPSE_DB_PASSWORD
-SYNAPSE_SERVER_NAME=chat.breakpilot.ai
-SYNAPSE_ENABLE_REGISTRATION=false
-SYNAPSE_LOG_LEVEL=WARNING
-
-# --- Jitsi ---
-JICOFO_AUTH_PASSWORD=CHANGE_ME_JICOFO_PASSWORD
-JVB_AUTH_PASSWORD=CHANGE_ME_JVB_PASSWORD
-JITSI_ENABLE_AUTH=false
-JVB_STUN_SERVERS=stun.l.google.com:19302
-TZ=Europe/Berlin

docker-compose.coolify.yml

@@ -2,6 +2,8 @@
 # BreakPilot Core — Shared Infrastructure (Coolify)
 # =========================================================
 # Deployed via Coolify. SSL termination handled by Traefik.
+# External services (managed separately in Coolify):
+#   - PostgreSQL (PostGIS), Qdrant, S3-compatible storage
 # Network: breakpilot-network (shared across all 3 repos)
 # =========================================================
 
@@ -11,46 +13,15 @@ networks:
     driver: bridge
 
 volumes:
-  breakpilot_db_data:
   valkey_data:
-  qdrant_data:
-  minio_data:
-  synapse_data:
-  synapse_db_data:
-  jitsi_web_config:
-  jitsi_web_crontabs:
-  jitsi_transcripts:
-  jitsi_prosody_config:
-  jitsi_prosody_plugins:
-  jitsi_jicofo_config:
-  jitsi_jvb_config:
   voice_session_data:
   embedding_models:
 
 services:
 
   # =========================================================
-  # DATABASES
+  # CACHE
   # =========================================================
-  postgres:
-    image: postgis/postgis:16-3.4-alpine
-    container_name: bp-core-postgres
-    volumes:
-      - breakpilot_db_data:/var/lib/postgresql/data
-      - ./scripts/init-schemas.sql:/docker-entrypoint-initdb.d/20-init-schemas.sql:ro
-    environment:
-      POSTGRES_USER: ${POSTGRES_USER}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: ${POSTGRES_DB}
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-breakpilot} -d ${POSTGRES_DB:-breakpilot_db}"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
   valkey:
     image: valkey/valkey:8-alpine
     container_name: bp-core-valkey
@@ -66,50 +37,6 @@ services:
     networks:
       - breakpilot-network
 
-  # =========================================================
-  # VECTOR DB & OBJECT STORAGE
-  # =========================================================
-  qdrant:
-    image: qdrant/qdrant:v1.12.1
-    container_name: bp-core-qdrant
-    volumes:
-      - qdrant_data:/qdrant/storage
-    environment:
-      QDRANT__SERVICE__GRPC_PORT: 6334
-    healthcheck:
-      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/127.0.0.1/6333'"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
-  minio:
-    image: minio/minio:latest
-    container_name: bp-core-minio
-    volumes:
-      - minio_data:/data
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
-    command: server /data --console-address ":9001"
-    healthcheck:
-      test: ["CMD", "mc", "ready", "local"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.minio-console.rule=Host(`minio.breakpilot.ai`)"
-      - "traefik.http.routers.minio-console.entrypoints=https"
-      - "traefik.http.routers.minio-console.tls=true"
-      - "traefik.http.routers.minio-console.tls.certresolver=letsencrypt"
-      - "traefik.http.services.minio-console.loadbalancer.server.port=9001"
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
   # =========================================================
   # SHARED SERVICES
   # =========================================================
@@ -121,7 +48,7 @@ services:
     expose:
       - "8000"
     environment:
-      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?options=-csearch_path%3Dcore,public
+      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}?options=-csearch_path%3Dcore,public
       JWT_SECRET: ${JWT_SECRET}
       ENVIRONMENT: production
       VALKEY_URL: redis://valkey:6379/0
@@ -134,8 +61,6 @@ services:
       SMTP_FROM_NAME: ${SMTP_FROM_NAME:-BreakPilot}
       SMTP_FROM_ADDR: ${SMTP_FROM_ADDR:-noreply@breakpilot.ai}
     depends_on:
-      postgres:
-        condition: service_healthy
       valkey:
         condition: service_healthy
       consent-service:
@@ -159,7 +84,7 @@ services:
     expose:
       - "8081"
     environment:
-      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
       JWT_SECRET: ${JWT_SECRET}
       JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET}
       PORT: 8081
@@ -175,8 +100,6 @@ services:
       SMTP_FROM_ADDR: ${SMTP_FROM_ADDR:-noreply@breakpilot.ai}
       FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
     depends_on:
-      postgres:
-        condition: service_healthy
       valkey:
         condition: service_healthy
     restart: unless-stopped
@@ -191,7 +114,7 @@ services:
     expose:
       - "8083"
     environment:
-      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
       JWT_SECRET: ${JWT_SECRET}
       PORT: 8083
       ENVIRONMENT: production
@@ -204,9 +127,6 @@ services:
       FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
       TRIAL_PERIOD_DAYS: ${TRIAL_PERIOD_DAYS:-14}
       INTERNAL_API_KEY: ${INTERNAL_API_KEY}
-    depends_on:
-      postgres:
-        condition: service_healthy
     restart: unless-stopped
     networks:
       - breakpilot-network
@@ -223,20 +143,16 @@ services:
       - "8097"
     environment:
       PORT: 8097
-      QDRANT_URL: http://qdrant:6333
+      QDRANT_URL: ${QDRANT_URL}
-      MINIO_ENDPOINT: minio:9000
+      MINIO_ENDPOINT: ${S3_ENDPOINT}
-      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
+      MINIO_ACCESS_KEY: ${S3_ACCESS_KEY}
-      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
+      MINIO_SECRET_KEY: ${S3_SECRET_KEY}
-      MINIO_BUCKET: ${MINIO_BUCKET:-breakpilot-rag}
+      MINIO_BUCKET: ${S3_BUCKET:-breakpilot-rag}
-      MINIO_SECURE: "false"
+      MINIO_SECURE: ${S3_SECURE:-true}
       EMBEDDING_SERVICE_URL: http://embedding-service:8087
       JWT_SECRET: ${JWT_SECRET}
       ENVIRONMENT: production
     depends_on:
-      qdrant:
-        condition: service_healthy
-      minio:
-        condition: service_healthy
       embedding-service:
         condition: service_healthy
     healthcheck:
@@ -290,10 +206,7 @@ services:
       - "8099"
     environment:
       PORT: 8099
-      CHECK_SERVICES: "postgres:5432,valkey:6379,qdrant:6333,minio:9000,backend-core:8000,rag-service:8097,embedding-service:8087,voice-service:8091"
+      CHECK_SERVICES: "valkey:6379,backend-core:8000,rag-service:8097,embedding-service:8087,voice-service:8091"
-    depends_on:
-      postgres:
-        condition: service_healthy
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:8099/health"]
       interval: 30s
@@ -324,7 +237,7 @@ services:
       - voice_session_data:/app/data/sessions
     environment:
       PORT: 8091
-      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
       VALKEY_URL: redis://valkey:6379/0
       KLAUSUR_SERVICE_URL: http://bp-lehrer-klausur-service:8086
       OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
@@ -332,8 +245,6 @@ services:
       ENVIRONMENT: production
       JWT_SECRET: ${JWT_SECRET}
     depends_on:
-      postgres:
-        condition: service_healthy
       valkey:
         condition: service_started
     healthcheck:
@@ -369,7 +280,7 @@ services:
     environment:
       COMPOSE_PROJECT_NAME: breakpilot-core
       CONTAINER_PATTERN: "bp-*"
-      EXCLUDED_CONTAINERS: "bp-core-night-scheduler,bp-core-postgres,bp-core-valkey"
+      EXCLUDED_CONTAINERS: "bp-core-night-scheduler,bp-core-valkey"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:8096/health"]
       interval: 30s
@@ -406,180 +317,3 @@ services:
     restart: unless-stopped
     networks:
       - breakpilot-network
-
-  # =========================================================
-  # COMMUNICATION — Matrix/Synapse
-  # =========================================================
-  synapse-db:
-    image: postgres:16-alpine
-    container_name: bp-core-synapse-db
-    environment:
-      POSTGRES_USER: synapse
-      POSTGRES_PASSWORD: ${SYNAPSE_DB_PASSWORD}
-      POSTGRES_DB: synapse
-      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
-    volumes:
-      - synapse_db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U synapse"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
-  synapse:
-    image: matrixdotorg/synapse:latest
-    container_name: bp-core-synapse
-    volumes:
-      - synapse_data:/data
-    environment:
-      SYNAPSE_SERVER_NAME: ${SYNAPSE_SERVER_NAME:-chat.breakpilot.ai}
-      SYNAPSE_REPORT_STATS: "no"
-      SYNAPSE_NO_TLS: "true"
-      SYNAPSE_ENABLE_REGISTRATION: ${SYNAPSE_ENABLE_REGISTRATION:-false}
-      SYNAPSE_LOG_LEVEL: ${SYNAPSE_LOG_LEVEL:-WARNING}
-      UID: "1000"
-      GID: "1000"
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://127.0.0.1:8008/health"]
-      interval: 30s
-      timeout: 10s
-      start_period: 30s
-      retries: 3
-    depends_on:
-      synapse-db:
-        condition: service_healthy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.synapse.rule=Host(`chat.breakpilot.ai`)"
-      - "traefik.http.routers.synapse.entrypoints=https"
-      - "traefik.http.routers.synapse.tls=true"
-      - "traefik.http.routers.synapse.tls.certresolver=letsencrypt"
-      - "traefik.http.services.synapse.loadbalancer.server.port=8008"
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
-  # =========================================================
-  # COMMUNICATION — Jitsi Meet
-  # =========================================================
-  jitsi-web:
-    image: jitsi/web:stable-9823
-    container_name: bp-core-jitsi-web
-    expose:
-      - "80"
-    volumes:
-      - jitsi_web_config:/config
-      - jitsi_web_crontabs:/var/spool/cron/crontabs
-      - jitsi_transcripts:/usr/share/jitsi-meet/transcripts
-    environment:
-      ENABLE_XMPP_WEBSOCKET: "true"
-      ENABLE_COLIBRI_WEBSOCKET: "true"
-      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
-      XMPP_BOSH_URL_BASE: http://jitsi-xmpp:5280
-      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
-      XMPP_GUEST_DOMAIN: ${XMPP_GUEST_DOMAIN:-guest.meet.jitsi}
-      TZ: ${TZ:-Europe/Berlin}
-      PUBLIC_URL: https://meet.breakpilot.ai
-      JICOFO_AUTH_USER: focus
-      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
-      ENABLE_GUESTS: "true"
-      ENABLE_RECORDING: "false"
-      ENABLE_LIVESTREAMING: "false"
-      DISABLE_HTTPS: "true"
-      APP_NAME: "BreakPilot Meet"
-      NATIVE_APP_NAME: "BreakPilot Meet"
-      PROVIDER_NAME: "BreakPilot"
-    depends_on:
-      - jitsi-xmpp
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.jitsi.rule=Host(`meet.breakpilot.ai`)"
-      - "traefik.http.routers.jitsi.entrypoints=https"
-      - "traefik.http.routers.jitsi.tls=true"
-      - "traefik.http.routers.jitsi.tls.certresolver=letsencrypt"
-      - "traefik.http.services.jitsi.loadbalancer.server.port=80"
-    networks:
-      breakpilot-network:
-        aliases:
-          - meet.jitsi
-
-  jitsi-xmpp:
-    image: jitsi/prosody:stable-9823
-    container_name: bp-core-jitsi-xmpp
-    volumes:
-      - jitsi_prosody_config:/config
-      - jitsi_prosody_plugins:/prosody-plugins-custom
-    environment:
-      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
-      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
-      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
-      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
-      XMPP_GUEST_DOMAIN: ${XMPP_GUEST_DOMAIN:-guest.meet.jitsi}
-      XMPP_RECORDER_DOMAIN: ${XMPP_RECORDER_DOMAIN:-recorder.meet.jitsi}
-      XMPP_CROSS_DOMAIN: "true"
-      TZ: ${TZ:-Europe/Berlin}
-      JICOFO_AUTH_USER: focus
-      JICOFO_AUTH_PASSWORD: ${JICOFO_AUTH_PASSWORD}
-      JVB_AUTH_USER: jvb
-      JVB_AUTH_PASSWORD: ${JVB_AUTH_PASSWORD}
-      LOG_LEVEL: ${XMPP_LOG_LEVEL:-warn}
-      PUBLIC_URL: https://meet.breakpilot.ai
-      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
-      ENABLE_GUESTS: "true"
-    restart: unless-stopped
-    networks:
-      breakpilot-network:
-        aliases:
-          - xmpp.meet.jitsi
-
-  jitsi-jicofo:
-    image: jitsi/jicofo:stable-9823
-    container_name: bp-core-jitsi-jicofo
-    volumes:
-      - jitsi_jicofo_config:/config
-    environment:
-      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
-      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
-      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
-      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
-      XMPP_SERVER: jitsi-xmpp
-      JICOFO_AUTH_USER: focus
-      JICOFO_AUTH_PASSWORD: ${JICOFO_AUTH_PASSWORD}
-      TZ: ${TZ:-Europe/Berlin}
-      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
-      AUTH_TYPE: internal
-      ENABLE_AUTO_OWNER: "true"
-    depends_on:
-      - jitsi-xmpp
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
-  jitsi-jvb:
-    image: jitsi/jvb:stable-9823
-    container_name: bp-core-jitsi-jvb
-    ports:
-      - "10000:10000/udp"
-    volumes:
-      - jitsi_jvb_config:/config
-    environment:
-      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
-      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
-      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
-      XMPP_SERVER: jitsi-xmpp
-      JVB_AUTH_USER: jvb
-      JVB_AUTH_PASSWORD: ${JVB_AUTH_PASSWORD}
-      JVB_PORT: 10000
-      JVB_STUN_SERVERS: ${JVB_STUN_SERVERS:-stun.l.google.com:19302}
-      TZ: ${TZ:-Europe/Berlin}
-      PUBLIC_URL: https://meet.breakpilot.ai
-      COLIBRI_REST_ENABLED: "true"
-      ENABLE_COLIBRI_WEBSOCKET: "true"
-    depends_on:
-      - jitsi-xmpp
-    restart: unless-stopped
-    networks:
-      - breakpilot-network