From 84002f5719ee9e52c8d0b094a2af791bb6e66903 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Wed, 25 Feb 2026 10:43:02 +0100
Subject: [PATCH 01/12] feat: add Coolify deployment configuration

Add docker-compose.coolify.yml (17 services), .env.coolify.example,
and Gitea Action workflow for Coolify API deployment. Removes nginx,
vault, gitea, woodpecker, mailpit, and dev-only services. Adds Traefik
labels for *.breakpilot.ai domain routing with Let's Encrypt SSL.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .env.coolify.example                |  71 ++++
 .gitea/workflows/deploy-coolify.yml |  27 ++
 docker-compose.coolify.yml          | 585 ++++++++++++++++++++++++++++
 3 files changed, 683 insertions(+)
 create mode 100644 .env.coolify.example
 create mode 100644 .gitea/workflows/deploy-coolify.yml
 create mode 100644 docker-compose.coolify.yml

diff --git a/.env.coolify.example b/.env.coolify.example
new file mode 100644
index 0000000..5c206fd
--- /dev/null
+++ b/.env.coolify.example
@@ -0,0 +1,71 @@
+# =========================================================
+# BreakPilot Core — Coolify Environment Variables
+# =========================================================
+# Copy these into Coolify's environment variable UI
+# for the breakpilot-core Docker Compose resource.
+# =========================================================
+
+# --- Database ---
+POSTGRES_USER=breakpilot
+POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD
+POSTGRES_DB=breakpilot_db
+
+# --- Security ---
+JWT_SECRET=CHANGE_ME_RANDOM_64_CHARS
+JWT_REFRESH_SECRET=CHANGE_ME_ANOTHER_RANDOM_64_CHARS
+INTERNAL_API_KEY=CHANGE_ME_INTERNAL_KEY
+
+# --- MinIO (S3 Object Storage) ---
+MINIO_ROOT_USER=breakpilot
+MINIO_ROOT_PASSWORD=CHANGE_ME_MINIO_PASSWORD
+MINIO_BUCKET=breakpilot-rag
+
+# --- SMTP (Real mail server, not Mailpit) ---
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_USERNAME=noreply@breakpilot.ai
+SMTP_PASSWORD=CHANGE_ME_SMTP_PASSWORD
+SMTP_FROM_NAME=BreakPilot
+SMTP_FROM_ADDR=noreply@breakpilot.ai
+
+# --- Session ---
+SESSION_TTL_HOURS=24
+
+# --- Frontend URLs (build args) ---
+NEXT_PUBLIC_CORE_API_URL=https://api-core.breakpilot.ai
+FRONTEND_URL=https://www.breakpilot.ai
+
+# --- Stripe (Billing) ---
+STRIPE_SECRET_KEY=
+STRIPE_WEBHOOK_SECRET=
+STRIPE_PUBLISHABLE_KEY=
+BILLING_SUCCESS_URL=https://www.breakpilot.ai/billing/success
+BILLING_CANCEL_URL=https://www.breakpilot.ai/billing/cancel
+TRIAL_PERIOD_DAYS=14
+
+# --- Embedding Service ---
+EMBEDDING_BACKEND=local
+LOCAL_EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
+LOCAL_RERANKER_MODEL=cross-encoder/ms-marco-MiniLM-L-6-v2
+PDF_EXTRACTION_BACKEND=pymupdf
+OPENAI_API_KEY=
+COHERE_API_KEY=
+LOG_LEVEL=INFO
+
+# --- Ollama (optional, if running on same server) ---
+OLLAMA_BASE_URL=
+OLLAMA_URL=
+OLLAMA_VOICE_MODEL=
+
+# --- Matrix/Synapse ---
+SYNAPSE_DB_PASSWORD=CHANGE_ME_SYNAPSE_DB_PASSWORD
+SYNAPSE_SERVER_NAME=chat.breakpilot.ai
+SYNAPSE_ENABLE_REGISTRATION=false
+SYNAPSE_LOG_LEVEL=WARNING
+
+# --- Jitsi ---
+JICOFO_AUTH_PASSWORD=CHANGE_ME_JICOFO_PASSWORD
+JVB_AUTH_PASSWORD=CHANGE_ME_JVB_PASSWORD
+JITSI_ENABLE_AUTH=false
+JVB_STUN_SERVERS=stun.l.google.com:19302
+TZ=Europe/Berlin
diff --git a/.gitea/workflows/deploy-coolify.yml b/.gitea/workflows/deploy-coolify.yml
new file mode 100644
index 0000000..b65f762
--- /dev/null
+++ b/.gitea/workflows/deploy-coolify.yml
@@ -0,0 +1,27 @@
+name: Deploy to Coolify
+
+on:
+  push:
+    branches:
+      - coolify
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy via Coolify API
+        run: |
+          echo "Deploying breakpilot-core to Coolify..."
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            -X POST \
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_API_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d '{"uuid": "${{ secrets.COOLIFY_RESOURCE_UUID }}", "force_rebuild": true}' \
+            "${{ secrets.COOLIFY_BASE_URL }}/api/v1/deploy")
+
+          echo "HTTP Status: $HTTP_STATUS"
+          if [ "$HTTP_STATUS" -ne 200 ] && [ "$HTTP_STATUS" -ne 201 ]; then
+            echo "Deployment failed with status $HTTP_STATUS"
+            exit 1
+          fi
+          echo "Deployment triggered successfully!"
diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
new file mode 100644
index 0000000..0eb2bd5
--- /dev/null
+++ b/docker-compose.coolify.yml
@@ -0,0 +1,585 @@
+# =========================================================
+# BreakPilot Core — Shared Infrastructure (Coolify)
+# =========================================================
+# Deployed via Coolify. SSL termination handled by Traefik.
+# Network: breakpilot-network (shared across all 3 repos)
+# =========================================================
+
+networks:
+  breakpilot-network:
+    name: breakpilot-network
+    driver: bridge
+
+volumes:
+  breakpilot_db_data:
+  valkey_data:
+  qdrant_data:
+  minio_data:
+  synapse_data:
+  synapse_db_data:
+  jitsi_web_config:
+  jitsi_web_crontabs:
+  jitsi_transcripts:
+  jitsi_prosody_config:
+  jitsi_prosody_plugins:
+  jitsi_jicofo_config:
+  jitsi_jvb_config:
+  voice_session_data:
+  embedding_models:
+
+services:
+
+  # =========================================================
+  # DATABASES
+  # =========================================================
+  postgres:
+    image: postgis/postgis:16-3.4-alpine
+    container_name: bp-core-postgres
+    volumes:
+      - breakpilot_db_data:/var/lib/postgresql/data
+      - ./scripts/init-schemas.sql:/docker-entrypoint-initdb.d/20-init-schemas.sql:ro
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-breakpilot} -d ${POSTGRES_DB:-breakpilot_db}"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  valkey:
+    image: valkey/valkey:8-alpine
+    container_name: bp-core-valkey
+    volumes:
+      - valkey_data:/data
+    command: valkey-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  # =========================================================
+  # VECTOR DB & OBJECT STORAGE
+  # =========================================================
+  qdrant:
+    image: qdrant/qdrant:v1.12.1
+    container_name: bp-core-qdrant
+    volumes:
+      - qdrant_data:/qdrant/storage
+    environment:
+      QDRANT__SERVICE__GRPC_PORT: 6334
+    healthcheck:
+      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/127.0.0.1/6333'"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  minio:
+    image: minio/minio:latest
+    container_name: bp-core-minio
+    volumes:
+      - minio_data:/data
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+    command: server /data --console-address ":9001"
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.minio-console.rule=Host(`minio.breakpilot.ai`)"
+      - "traefik.http.routers.minio-console.entrypoints=https"
+      - "traefik.http.routers.minio-console.tls=true"
+      - "traefik.http.routers.minio-console.tls.certresolver=letsencrypt"
+      - "traefik.http.services.minio-console.loadbalancer.server.port=9001"
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  # =========================================================
+  # SHARED SERVICES
+  # =========================================================
+  backend-core:
+    build:
+      context: ./backend-core
+      dockerfile: Dockerfile
+    container_name: bp-core-backend
+    expose:
+      - "8000"
+    environment:
+      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?options=-csearch_path%3Dcore,public
+      JWT_SECRET: ${JWT_SECRET}
+      ENVIRONMENT: production
+      VALKEY_URL: redis://valkey:6379/0
+      SESSION_TTL_HOURS: ${SESSION_TTL_HOURS:-24}
+      CONSENT_SERVICE_URL: http://consent-service:8081
+      SMTP_HOST: ${SMTP_HOST}
+      SMTP_PORT: ${SMTP_PORT:-587}
+      SMTP_USERNAME: ${SMTP_USERNAME}
+      SMTP_PASSWORD: ${SMTP_PASSWORD}
+      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-BreakPilot}
+      SMTP_FROM_ADDR: ${SMTP_FROM_ADDR:-noreply@breakpilot.ai}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      valkey:
+        condition: service_healthy
+      consent-service:
+        condition: service_started
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.backend-core.rule=Host(`api-core.breakpilot.ai`)"
+      - "traefik.http.routers.backend-core.entrypoints=https"
+      - "traefik.http.routers.backend-core.tls=true"
+      - "traefik.http.routers.backend-core.tls.certresolver=letsencrypt"
+      - "traefik.http.services.backend-core.loadbalancer.server.port=8000"
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  consent-service:
+    build:
+      context: ./consent-service
+      dockerfile: Dockerfile
+    container_name: bp-core-consent-service
+    expose:
+      - "8081"
+    environment:
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      JWT_SECRET: ${JWT_SECRET}
+      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET}
+      PORT: 8081
+      ENVIRONMENT: production
+      ALLOWED_ORIGINS: "*"
+      VALKEY_URL: redis://valkey:6379/0
+      SESSION_TTL_HOURS: ${SESSION_TTL_HOURS:-24}
+      SMTP_HOST: ${SMTP_HOST}
+      SMTP_PORT: ${SMTP_PORT:-587}
+      SMTP_USERNAME: ${SMTP_USERNAME}
+      SMTP_PASSWORD: ${SMTP_PASSWORD}
+      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-BreakPilot}
+      SMTP_FROM_ADDR: ${SMTP_FROM_ADDR:-noreply@breakpilot.ai}
+      FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      valkey:
+        condition: service_healthy
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  billing-service:
+    build:
+      context: ./billing-service
+      dockerfile: Dockerfile
+    container_name: bp-core-billing-service
+    expose:
+      - "8083"
+    environment:
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      JWT_SECRET: ${JWT_SECRET}
+      PORT: 8083
+      ENVIRONMENT: production
+      ALLOWED_ORIGINS: "*"
+      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY}
+      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}
+      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY}
+      BILLING_SUCCESS_URL: ${BILLING_SUCCESS_URL:-https://www.breakpilot.ai/billing/success}
+      BILLING_CANCEL_URL: ${BILLING_CANCEL_URL:-https://www.breakpilot.ai/billing/cancel}
+      FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
+      TRIAL_PERIOD_DAYS: ${TRIAL_PERIOD_DAYS:-14}
+      INTERNAL_API_KEY: ${INTERNAL_API_KEY}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  # =========================================================
+  # RAG & EMBEDDING SERVICES
+  # =========================================================
+  rag-service:
+    build:
+      context: ./rag-service
+      dockerfile: Dockerfile
+    container_name: bp-core-rag-service
+    expose:
+      - "8097"
+    environment:
+      PORT: 8097
+      QDRANT_URL: http://qdrant:6333
+      MINIO_ENDPOINT: minio:9000
+      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
+      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
+      MINIO_BUCKET: ${MINIO_BUCKET:-breakpilot-rag}
+      MINIO_SECURE: "false"
+      EMBEDDING_SERVICE_URL: http://embedding-service:8087
+      JWT_SECRET: ${JWT_SECRET}
+      ENVIRONMENT: production
+    depends_on:
+      qdrant:
+        condition: service_healthy
+      minio:
+        condition: service_healthy
+      embedding-service:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:8097/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  embedding-service:
+    build:
+      context: ./embedding-service
+      dockerfile: Dockerfile
+    container_name: bp-core-embedding-service
+    volumes:
+      - embedding_models:/root/.cache/huggingface
+    environment:
+      EMBEDDING_BACKEND: ${EMBEDDING_BACKEND:-local}
+      LOCAL_EMBEDDING_MODEL: ${LOCAL_EMBEDDING_MODEL:-sentence-transformers/all-MiniLM-L6-v2}
+      LOCAL_RERANKER_MODEL: ${LOCAL_RERANKER_MODEL:-cross-encoder/ms-marco-MiniLM-L-6-v2}
+      PDF_EXTRACTION_BACKEND: ${PDF_EXTRACTION_BACKEND:-pymupdf}
+      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
+      COHERE_API_KEY: ${COHERE_API_KEY:-}
+      LOG_LEVEL: ${LOG_LEVEL:-INFO}
+    deploy:
+      resources:
+        limits:
+          memory: 4G
+    healthcheck:
+      test: ["CMD", "python", "-c", "import httpx; r=httpx.get('http://127.0.0.1:8087/health'); r.raise_for_status()"]
+      interval: 30s
+      timeout: 10s
+      start_period: 120s
+      retries: 3
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  # =========================================================
+  # HEALTH AGGREGATOR
+  # =========================================================
+  health-aggregator:
+    build:
+      context: ./scripts
+      dockerfile: Dockerfile.health
+    container_name: bp-core-health
+    expose:
+      - "8099"
+    environment:
+      PORT: 8099
+      CHECK_SERVICES: "postgres:5432,valkey:6379,qdrant:6333,minio:9000,backend-core:8000,rag-service:8097,embedding-service:8087,voice-service:8091"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:8099/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.health.rule=Host(`health.breakpilot.ai`)"
+      - "traefik.http.routers.health.entrypoints=https"
+      - "traefik.http.routers.health.tls=true"
+      - "traefik.http.routers.health.tls.certresolver=letsencrypt"
+      - "traefik.http.services.health.loadbalancer.server.port=8099"
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  # =========================================================
+  # VOICE SERVICE
+  # =========================================================
+  voice-service:
+    build:
+      context: ./voice-service
+      dockerfile: Dockerfile
+    container_name: bp-core-voice-service
+    expose:
+      - "8091"
+    volumes:
+      - voice_session_data:/app/data/sessions
+    environment:
+      PORT: 8091
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      VALKEY_URL: redis://valkey:6379/0
+      KLAUSUR_SERVICE_URL: http://bp-lehrer-klausur-service:8086
+      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
+      OLLAMA_VOICE_MODEL: ${OLLAMA_VOICE_MODEL:-}
+      ENVIRONMENT: production
+      JWT_SECRET: ${JWT_SECRET}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      valkey:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:8091/health"]
+      interval: 30s
+      timeout: 10s
+      start_period: 60s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.voice.rule=Host(`voice.breakpilot.ai`)"
+      - "traefik.http.routers.voice.entrypoints=https"
+      - "traefik.http.routers.voice.tls=true"
+      - "traefik.http.routers.voice.tls.certresolver=letsencrypt"
+      - "traefik.http.services.voice.loadbalancer.server.port=8091"
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  # =========================================================
+  # NIGHT SCHEDULER
+  # =========================================================
+  night-scheduler:
+    build:
+      context: ./night-scheduler
+      dockerfile: Dockerfile
+    container_name: bp-core-night-scheduler
+    expose:
+      - "8096"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./night-scheduler/config:/config
+    environment:
+      COMPOSE_PROJECT_NAME: breakpilot-core
+      CONTAINER_PATTERN: "bp-*"
+      EXCLUDED_CONTAINERS: "bp-core-night-scheduler,bp-core-postgres,bp-core-valkey"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:8096/health"]
+      interval: 30s
+      timeout: 10s
+      start_period: 10s
+      retries: 3
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  # =========================================================
+  # ADMIN CORE
+  # =========================================================
+  admin-core:
+    build:
+      context: ./admin-core
+      dockerfile: Dockerfile
+      args:
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_CORE_API_URL:-https://api-core.breakpilot.ai}
+    container_name: bp-core-admin
+    expose:
+      - "3000"
+    environment:
+      NODE_ENV: production
+      BACKEND_URL: http://backend-core:8000
+      OLLAMA_URL: ${OLLAMA_URL:-}
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.admin-core.rule=Host(`admin-core.breakpilot.ai`)"
+      - "traefik.http.routers.admin-core.entrypoints=https"
+      - "traefik.http.routers.admin-core.tls=true"
+      - "traefik.http.routers.admin-core.tls.certresolver=letsencrypt"
+      - "traefik.http.services.admin-core.loadbalancer.server.port=3000"
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  # =========================================================
+  # COMMUNICATION — Matrix/Synapse
+  # =========================================================
+  synapse-db:
+    image: postgres:16-alpine
+    container_name: bp-core-synapse-db
+    environment:
+      POSTGRES_USER: synapse
+      POSTGRES_PASSWORD: ${SYNAPSE_DB_PASSWORD}
+      POSTGRES_DB: synapse
+      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
+    volumes:
+      - synapse_db_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U synapse"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  synapse:
+    image: matrixdotorg/synapse:latest
+    container_name: bp-core-synapse
+    volumes:
+      - synapse_data:/data
+    environment:
+      SYNAPSE_SERVER_NAME: ${SYNAPSE_SERVER_NAME:-chat.breakpilot.ai}
+      SYNAPSE_REPORT_STATS: "no"
+      SYNAPSE_NO_TLS: "true"
+      SYNAPSE_ENABLE_REGISTRATION: ${SYNAPSE_ENABLE_REGISTRATION:-false}
+      SYNAPSE_LOG_LEVEL: ${SYNAPSE_LOG_LEVEL:-WARNING}
+      UID: "1000"
+      GID: "1000"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:8008/health"]
+      interval: 30s
+      timeout: 10s
+      start_period: 30s
+      retries: 3
+    depends_on:
+      synapse-db:
+        condition: service_healthy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.synapse.rule=Host(`chat.breakpilot.ai`)"
+      - "traefik.http.routers.synapse.entrypoints=https"
+      - "traefik.http.routers.synapse.tls=true"
+      - "traefik.http.routers.synapse.tls.certresolver=letsencrypt"
+      - "traefik.http.services.synapse.loadbalancer.server.port=8008"
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  # =========================================================
+  # COMMUNICATION — Jitsi Meet
+  # =========================================================
+  jitsi-web:
+    image: jitsi/web:stable-9823
+    container_name: bp-core-jitsi-web
+    expose:
+      - "80"
+    volumes:
+      - jitsi_web_config:/config
+      - jitsi_web_crontabs:/var/spool/cron/crontabs
+      - jitsi_transcripts:/usr/share/jitsi-meet/transcripts
+    environment:
+      ENABLE_XMPP_WEBSOCKET: "true"
+      ENABLE_COLIBRI_WEBSOCKET: "true"
+      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
+      XMPP_BOSH_URL_BASE: http://jitsi-xmpp:5280
+      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
+      XMPP_GUEST_DOMAIN: ${XMPP_GUEST_DOMAIN:-guest.meet.jitsi}
+      TZ: ${TZ:-Europe/Berlin}
+      PUBLIC_URL: https://meet.breakpilot.ai
+      JICOFO_AUTH_USER: focus
+      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
+      ENABLE_GUESTS: "true"
+      ENABLE_RECORDING: "false"
+      ENABLE_LIVESTREAMING: "false"
+      DISABLE_HTTPS: "true"
+      APP_NAME: "BreakPilot Meet"
+      NATIVE_APP_NAME: "BreakPilot Meet"
+      PROVIDER_NAME: "BreakPilot"
+    depends_on:
+      - jitsi-xmpp
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.jitsi.rule=Host(`meet.breakpilot.ai`)"
+      - "traefik.http.routers.jitsi.entrypoints=https"
+      - "traefik.http.routers.jitsi.tls=true"
+      - "traefik.http.routers.jitsi.tls.certresolver=letsencrypt"
+      - "traefik.http.services.jitsi.loadbalancer.server.port=80"
+    networks:
+      breakpilot-network:
+        aliases:
+          - meet.jitsi
+
+  jitsi-xmpp:
+    image: jitsi/prosody:stable-9823
+    container_name: bp-core-jitsi-xmpp
+    volumes:
+      - jitsi_prosody_config:/config
+      - jitsi_prosody_plugins:/prosody-plugins-custom
+    environment:
+      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
+      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
+      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
+      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
+      XMPP_GUEST_DOMAIN: ${XMPP_GUEST_DOMAIN:-guest.meet.jitsi}
+      XMPP_RECORDER_DOMAIN: ${XMPP_RECORDER_DOMAIN:-recorder.meet.jitsi}
+      XMPP_CROSS_DOMAIN: "true"
+      TZ: ${TZ:-Europe/Berlin}
+      JICOFO_AUTH_USER: focus
+      JICOFO_AUTH_PASSWORD: ${JICOFO_AUTH_PASSWORD}
+      JVB_AUTH_USER: jvb
+      JVB_AUTH_PASSWORD: ${JVB_AUTH_PASSWORD}
+      LOG_LEVEL: ${XMPP_LOG_LEVEL:-warn}
+      PUBLIC_URL: https://meet.breakpilot.ai
+      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
+      ENABLE_GUESTS: "true"
+    restart: unless-stopped
+    networks:
+      breakpilot-network:
+        aliases:
+          - xmpp.meet.jitsi
+
+  jitsi-jicofo:
+    image: jitsi/jicofo:stable-9823
+    container_name: bp-core-jitsi-jicofo
+    volumes:
+      - jitsi_jicofo_config:/config
+    environment:
+      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
+      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
+      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
+      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
+      XMPP_SERVER: jitsi-xmpp
+      JICOFO_AUTH_USER: focus
+      JICOFO_AUTH_PASSWORD: ${JICOFO_AUTH_PASSWORD}
+      TZ: ${TZ:-Europe/Berlin}
+      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
+      AUTH_TYPE: internal
+      ENABLE_AUTO_OWNER: "true"
+    depends_on:
+      - jitsi-xmpp
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
+
+  jitsi-jvb:
+    image: jitsi/jvb:stable-9823
+    container_name: bp-core-jitsi-jvb
+    ports:
+      - "10000:10000/udp"
+    volumes:
+      - jitsi_jvb_config:/config
+    environment:
+      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
+      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
+      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
+      XMPP_SERVER: jitsi-xmpp
+      JVB_AUTH_USER: jvb
+      JVB_AUTH_PASSWORD: ${JVB_AUTH_PASSWORD}
+      JVB_PORT: 10000
+      JVB_STUN_SERVERS: ${JVB_STUN_SERVERS:-stun.l.google.com:19302}
+      TZ: ${TZ:-Europe/Berlin}
+      PUBLIC_URL: https://meet.breakpilot.ai
+      COLIBRI_REST_ENABLED: "true"
+      ENABLE_COLIBRI_WEBSOCKET: "true"
+    depends_on:
+      - jitsi-xmpp
+    restart: unless-stopped
+    networks:
+      - breakpilot-network
-- 
2.49.1


From 8fa5d9061ac2482e5b01cf87f99c27232ac747a7 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Tue, 3 Mar 2026 09:23:20 +0100
Subject: [PATCH 02/12] refactor(coolify): externalize postgres, qdrant, S3;
 remove jitsi/synapse

- Remove PostgreSQL, Qdrant, MinIO services (managed separately in Coolify)
- Remove Jitsi stack (web, xmpp, jicofo, jvb) and Synapse/synapse-db
- Add POSTGRES_HOST, QDRANT_URL, S3_ENDPOINT/S3_ACCESS_KEY/S3_SECRET_KEY env vars
- Remove Traefik labels from internal-only services
- Health aggregator no longer checks external services
- Core now has 10 services: valkey + 9 application services

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .env.coolify.example       |  34 ++---
 docker-compose.coolify.yml | 296 ++-----------------------------------
 2 files changed, 29 insertions(+), 301 deletions(-)

diff --git a/.env.coolify.example b/.env.coolify.example
index 5c206fd..3d9d742 100644
--- a/.env.coolify.example
+++ b/.env.coolify.example
@@ -5,7 +5,9 @@
 # for the breakpilot-core Docker Compose resource.
 # =========================================================
 
-# --- Database ---
+# --- External PostgreSQL (Coolify-managed) ---
+POSTGRES_HOST=<coolify-postgres-hostname>
+POSTGRES_PORT=5432
 POSTGRES_USER=breakpilot
 POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD
 POSTGRES_DB=breakpilot_db
@@ -15,12 +17,17 @@ JWT_SECRET=CHANGE_ME_RANDOM_64_CHARS
 JWT_REFRESH_SECRET=CHANGE_ME_ANOTHER_RANDOM_64_CHARS
 INTERNAL_API_KEY=CHANGE_ME_INTERNAL_KEY
 
-# --- MinIO (S3 Object Storage) ---
-MINIO_ROOT_USER=breakpilot
-MINIO_ROOT_PASSWORD=CHANGE_ME_MINIO_PASSWORD
-MINIO_BUCKET=breakpilot-rag
+# --- External S3 Storage ---
+S3_ENDPOINT=<s3-endpoint-host:port>
+S3_ACCESS_KEY=CHANGE_ME_S3_ACCESS_KEY
+S3_SECRET_KEY=CHANGE_ME_S3_SECRET_KEY
+S3_BUCKET=breakpilot-rag
+S3_SECURE=true
 
-# --- SMTP (Real mail server, not Mailpit) ---
+# --- External Qdrant (Coolify-managed) ---
+QDRANT_URL=http://<coolify-qdrant-hostname>:6333
+
+# --- SMTP (Real mail server) ---
 SMTP_HOST=smtp.example.com
 SMTP_PORT=587
 SMTP_USERNAME=noreply@breakpilot.ai
@@ -52,20 +59,7 @@ OPENAI_API_KEY=
 COHERE_API_KEY=
 LOG_LEVEL=INFO
 
-# --- Ollama (optional, if running on same server) ---
+# --- Ollama (optional) ---
 OLLAMA_BASE_URL=
 OLLAMA_URL=
 OLLAMA_VOICE_MODEL=
-
-# --- Matrix/Synapse ---
-SYNAPSE_DB_PASSWORD=CHANGE_ME_SYNAPSE_DB_PASSWORD
-SYNAPSE_SERVER_NAME=chat.breakpilot.ai
-SYNAPSE_ENABLE_REGISTRATION=false
-SYNAPSE_LOG_LEVEL=WARNING
-
-# --- Jitsi ---
-JICOFO_AUTH_PASSWORD=CHANGE_ME_JICOFO_PASSWORD
-JVB_AUTH_PASSWORD=CHANGE_ME_JVB_PASSWORD
-JITSI_ENABLE_AUTH=false
-JVB_STUN_SERVERS=stun.l.google.com:19302
-TZ=Europe/Berlin
diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index 0eb2bd5..7e9a553 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -2,6 +2,8 @@
 # BreakPilot Core — Shared Infrastructure (Coolify)
 # =========================================================
 # Deployed via Coolify. SSL termination handled by Traefik.
+# External services (managed separately in Coolify):
+#   - PostgreSQL (PostGIS), Qdrant, S3-compatible storage
 # Network: breakpilot-network (shared across all 3 repos)
 # =========================================================
 
@@ -11,46 +13,15 @@ networks:
     driver: bridge
 
 volumes:
-  breakpilot_db_data:
   valkey_data:
-  qdrant_data:
-  minio_data:
-  synapse_data:
-  synapse_db_data:
-  jitsi_web_config:
-  jitsi_web_crontabs:
-  jitsi_transcripts:
-  jitsi_prosody_config:
-  jitsi_prosody_plugins:
-  jitsi_jicofo_config:
-  jitsi_jvb_config:
   voice_session_data:
   embedding_models:
 
 services:
 
   # =========================================================
-  # DATABASES
+  # CACHE
   # =========================================================
-  postgres:
-    image: postgis/postgis:16-3.4-alpine
-    container_name: bp-core-postgres
-    volumes:
-      - breakpilot_db_data:/var/lib/postgresql/data
-      - ./scripts/init-schemas.sql:/docker-entrypoint-initdb.d/20-init-schemas.sql:ro
-    environment:
-      POSTGRES_USER: ${POSTGRES_USER}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: ${POSTGRES_DB}
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-breakpilot} -d ${POSTGRES_DB:-breakpilot_db}"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
   valkey:
     image: valkey/valkey:8-alpine
     container_name: bp-core-valkey
@@ -66,50 +37,6 @@ services:
     networks:
       - breakpilot-network
 
-  # =========================================================
-  # VECTOR DB & OBJECT STORAGE
-  # =========================================================
-  qdrant:
-    image: qdrant/qdrant:v1.12.1
-    container_name: bp-core-qdrant
-    volumes:
-      - qdrant_data:/qdrant/storage
-    environment:
-      QDRANT__SERVICE__GRPC_PORT: 6334
-    healthcheck:
-      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/127.0.0.1/6333'"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
-  minio:
-    image: minio/minio:latest
-    container_name: bp-core-minio
-    volumes:
-      - minio_data:/data
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
-    command: server /data --console-address ":9001"
-    healthcheck:
-      test: ["CMD", "mc", "ready", "local"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.minio-console.rule=Host(`minio.breakpilot.ai`)"
-      - "traefik.http.routers.minio-console.entrypoints=https"
-      - "traefik.http.routers.minio-console.tls=true"
-      - "traefik.http.routers.minio-console.tls.certresolver=letsencrypt"
-      - "traefik.http.services.minio-console.loadbalancer.server.port=9001"
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
   # =========================================================
   # SHARED SERVICES
   # =========================================================
@@ -121,7 +48,7 @@ services:
     expose:
       - "8000"
     environment:
-      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?options=-csearch_path%3Dcore,public
+      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}?options=-csearch_path%3Dcore,public
       JWT_SECRET: ${JWT_SECRET}
       ENVIRONMENT: production
       VALKEY_URL: redis://valkey:6379/0
@@ -134,8 +61,6 @@ services:
       SMTP_FROM_NAME: ${SMTP_FROM_NAME:-BreakPilot}
       SMTP_FROM_ADDR: ${SMTP_FROM_ADDR:-noreply@breakpilot.ai}
     depends_on:
-      postgres:
-        condition: service_healthy
       valkey:
         condition: service_healthy
       consent-service:
@@ -159,7 +84,7 @@ services:
     expose:
       - "8081"
     environment:
-      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
       JWT_SECRET: ${JWT_SECRET}
       JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET}
       PORT: 8081
@@ -175,8 +100,6 @@ services:
       SMTP_FROM_ADDR: ${SMTP_FROM_ADDR:-noreply@breakpilot.ai}
       FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
     depends_on:
-      postgres:
-        condition: service_healthy
       valkey:
         condition: service_healthy
     restart: unless-stopped
@@ -191,7 +114,7 @@ services:
     expose:
       - "8083"
     environment:
-      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
       JWT_SECRET: ${JWT_SECRET}
       PORT: 8083
       ENVIRONMENT: production
@@ -204,9 +127,6 @@ services:
       FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
       TRIAL_PERIOD_DAYS: ${TRIAL_PERIOD_DAYS:-14}
       INTERNAL_API_KEY: ${INTERNAL_API_KEY}
-    depends_on:
-      postgres:
-        condition: service_healthy
     restart: unless-stopped
     networks:
       - breakpilot-network
@@ -223,20 +143,16 @@ services:
       - "8097"
     environment:
       PORT: 8097
-      QDRANT_URL: http://qdrant:6333
-      MINIO_ENDPOINT: minio:9000
-      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
-      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
-      MINIO_BUCKET: ${MINIO_BUCKET:-breakpilot-rag}
-      MINIO_SECURE: "false"
+      QDRANT_URL: ${QDRANT_URL}
+      MINIO_ENDPOINT: ${S3_ENDPOINT}
+      MINIO_ACCESS_KEY: ${S3_ACCESS_KEY}
+      MINIO_SECRET_KEY: ${S3_SECRET_KEY}
+      MINIO_BUCKET: ${S3_BUCKET:-breakpilot-rag}
+      MINIO_SECURE: ${S3_SECURE:-true}
       EMBEDDING_SERVICE_URL: http://embedding-service:8087
       JWT_SECRET: ${JWT_SECRET}
       ENVIRONMENT: production
     depends_on:
-      qdrant:
-        condition: service_healthy
-      minio:
-        condition: service_healthy
       embedding-service:
         condition: service_healthy
     healthcheck:
@@ -290,10 +206,7 @@ services:
       - "8099"
     environment:
       PORT: 8099
-      CHECK_SERVICES: "postgres:5432,valkey:6379,qdrant:6333,minio:9000,backend-core:8000,rag-service:8097,embedding-service:8087,voice-service:8091"
-    depends_on:
-      postgres:
-        condition: service_healthy
+      CHECK_SERVICES: "valkey:6379,backend-core:8000,rag-service:8097,embedding-service:8087,voice-service:8091"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:8099/health"]
       interval: 30s
@@ -324,7 +237,7 @@ services:
       - voice_session_data:/app/data/sessions
     environment:
       PORT: 8091
-      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
       VALKEY_URL: redis://valkey:6379/0
       KLAUSUR_SERVICE_URL: http://bp-lehrer-klausur-service:8086
       OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
@@ -332,8 +245,6 @@ services:
       ENVIRONMENT: production
       JWT_SECRET: ${JWT_SECRET}
     depends_on:
-      postgres:
-        condition: service_healthy
       valkey:
         condition: service_started
     healthcheck:
@@ -369,7 +280,7 @@ services:
     environment:
       COMPOSE_PROJECT_NAME: breakpilot-core
       CONTAINER_PATTERN: "bp-*"
-      EXCLUDED_CONTAINERS: "bp-core-night-scheduler,bp-core-postgres,bp-core-valkey"
+      EXCLUDED_CONTAINERS: "bp-core-night-scheduler,bp-core-valkey"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:8096/health"]
       interval: 30s
@@ -406,180 +317,3 @@ services:
     restart: unless-stopped
     networks:
       - breakpilot-network
-
-  # =========================================================
-  # COMMUNICATION — Matrix/Synapse
-  # =========================================================
-  synapse-db:
-    image: postgres:16-alpine
-    container_name: bp-core-synapse-db
-    environment:
-      POSTGRES_USER: synapse
-      POSTGRES_PASSWORD: ${SYNAPSE_DB_PASSWORD}
-      POSTGRES_DB: synapse
-      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
-    volumes:
-      - synapse_db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U synapse"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
-  synapse:
-    image: matrixdotorg/synapse:latest
-    container_name: bp-core-synapse
-    volumes:
-      - synapse_data:/data
-    environment:
-      SYNAPSE_SERVER_NAME: ${SYNAPSE_SERVER_NAME:-chat.breakpilot.ai}
-      SYNAPSE_REPORT_STATS: "no"
-      SYNAPSE_NO_TLS: "true"
-      SYNAPSE_ENABLE_REGISTRATION: ${SYNAPSE_ENABLE_REGISTRATION:-false}
-      SYNAPSE_LOG_LEVEL: ${SYNAPSE_LOG_LEVEL:-WARNING}
-      UID: "1000"
-      GID: "1000"
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://127.0.0.1:8008/health"]
-      interval: 30s
-      timeout: 10s
-      start_period: 30s
-      retries: 3
-    depends_on:
-      synapse-db:
-        condition: service_healthy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.synapse.rule=Host(`chat.breakpilot.ai`)"
-      - "traefik.http.routers.synapse.entrypoints=https"
-      - "traefik.http.routers.synapse.tls=true"
-      - "traefik.http.routers.synapse.tls.certresolver=letsencrypt"
-      - "traefik.http.services.synapse.loadbalancer.server.port=8008"
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
-  # =========================================================
-  # COMMUNICATION — Jitsi Meet
-  # =========================================================
-  jitsi-web:
-    image: jitsi/web:stable-9823
-    container_name: bp-core-jitsi-web
-    expose:
-      - "80"
-    volumes:
-      - jitsi_web_config:/config
-      - jitsi_web_crontabs:/var/spool/cron/crontabs
-      - jitsi_transcripts:/usr/share/jitsi-meet/transcripts
-    environment:
-      ENABLE_XMPP_WEBSOCKET: "true"
-      ENABLE_COLIBRI_WEBSOCKET: "true"
-      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
-      XMPP_BOSH_URL_BASE: http://jitsi-xmpp:5280
-      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
-      XMPP_GUEST_DOMAIN: ${XMPP_GUEST_DOMAIN:-guest.meet.jitsi}
-      TZ: ${TZ:-Europe/Berlin}
-      PUBLIC_URL: https://meet.breakpilot.ai
-      JICOFO_AUTH_USER: focus
-      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
-      ENABLE_GUESTS: "true"
-      ENABLE_RECORDING: "false"
-      ENABLE_LIVESTREAMING: "false"
-      DISABLE_HTTPS: "true"
-      APP_NAME: "BreakPilot Meet"
-      NATIVE_APP_NAME: "BreakPilot Meet"
-      PROVIDER_NAME: "BreakPilot"
-    depends_on:
-      - jitsi-xmpp
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.jitsi.rule=Host(`meet.breakpilot.ai`)"
-      - "traefik.http.routers.jitsi.entrypoints=https"
-      - "traefik.http.routers.jitsi.tls=true"
-      - "traefik.http.routers.jitsi.tls.certresolver=letsencrypt"
-      - "traefik.http.services.jitsi.loadbalancer.server.port=80"
-    networks:
-      breakpilot-network:
-        aliases:
-          - meet.jitsi
-
-  jitsi-xmpp:
-    image: jitsi/prosody:stable-9823
-    container_name: bp-core-jitsi-xmpp
-    volumes:
-      - jitsi_prosody_config:/config
-      - jitsi_prosody_plugins:/prosody-plugins-custom
-    environment:
-      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
-      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
-      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
-      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
-      XMPP_GUEST_DOMAIN: ${XMPP_GUEST_DOMAIN:-guest.meet.jitsi}
-      XMPP_RECORDER_DOMAIN: ${XMPP_RECORDER_DOMAIN:-recorder.meet.jitsi}
-      XMPP_CROSS_DOMAIN: "true"
-      TZ: ${TZ:-Europe/Berlin}
-      JICOFO_AUTH_USER: focus
-      JICOFO_AUTH_PASSWORD: ${JICOFO_AUTH_PASSWORD}
-      JVB_AUTH_USER: jvb
-      JVB_AUTH_PASSWORD: ${JVB_AUTH_PASSWORD}
-      LOG_LEVEL: ${XMPP_LOG_LEVEL:-warn}
-      PUBLIC_URL: https://meet.breakpilot.ai
-      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
-      ENABLE_GUESTS: "true"
-    restart: unless-stopped
-    networks:
-      breakpilot-network:
-        aliases:
-          - xmpp.meet.jitsi
-
-  jitsi-jicofo:
-    image: jitsi/jicofo:stable-9823
-    container_name: bp-core-jitsi-jicofo
-    volumes:
-      - jitsi_jicofo_config:/config
-    environment:
-      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
-      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
-      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
-      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
-      XMPP_SERVER: jitsi-xmpp
-      JICOFO_AUTH_USER: focus
-      JICOFO_AUTH_PASSWORD: ${JICOFO_AUTH_PASSWORD}
-      TZ: ${TZ:-Europe/Berlin}
-      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
-      AUTH_TYPE: internal
-      ENABLE_AUTO_OWNER: "true"
-    depends_on:
-      - jitsi-xmpp
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
-  jitsi-jvb:
-    image: jitsi/jvb:stable-9823
-    container_name: bp-core-jitsi-jvb
-    ports:
-      - "10000:10000/udp"
-    volumes:
-      - jitsi_jvb_config:/config
-    environment:
-      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
-      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
-      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
-      XMPP_SERVER: jitsi-xmpp
-      JVB_AUTH_USER: jvb
-      JVB_AUTH_PASSWORD: ${JVB_AUTH_PASSWORD}
-      JVB_PORT: 10000
-      JVB_STUN_SERVERS: ${JVB_STUN_SERVERS:-stun.l.google.com:19302}
-      TZ: ${TZ:-Europe/Berlin}
-      PUBLIC_URL: https://meet.breakpilot.ai
-      COLIBRI_REST_ENABLED: "true"
-      ENABLE_COLIBRI_WEBSOCKET: "true"
-    depends_on:
-      - jitsi-xmpp
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-- 
2.49.1


From 92186644006d9065ad4f7865260d96e7f52d8b23 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Fri, 6 Mar 2026 22:38:31 +0100
Subject: [PATCH 03/12] fix: use Alpine-compatible addgroup/adduser flags in
 Dockerfiles

Replace --system/--gid/--uid (Debian syntax) with -S/-g/-u (BusyBox/Alpine).
Coolify ARG injection causes exit code 255 with Debian-style flags.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 admin-core/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/admin-core/Dockerfile b/admin-core/Dockerfile
index 08ee6c8..66ac6c4 100644
--- a/admin-core/Dockerfile
+++ b/admin-core/Dockerfile
@@ -30,8 +30,8 @@ WORKDIR /app
 ENV NODE_ENV=production
 
 # Create non-root user
-RUN addgroup --system --gid 1001 nodejs
-RUN adduser --system --uid 1001 nextjs
+RUN addgroup -S -g 1001 nodejs
+RUN adduser -S -u 1001 -G nodejs nextjs
 
 # Copy built assets
 COPY --from=builder /app/public ./public
-- 
2.49.1


From 86624d72dd98bf02283400d5ed8fc9d612022843 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Sat, 7 Mar 2026 23:23:52 +0100
Subject: [PATCH 04/12] Sync coolify compose with main: remove voice-service,
 update rag/embedding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove voice-service (removed in main branch)
- Remove voice_session_data volume
- Add OLLAMA_URL and OLLAMA_EMBED_MODEL to rag-service
- Update embedding-service default model to BAAI/bge-m3, memory 4G→8G
- Update health-aggregator CHECK_SERVICES (remove voice-service)
- Update .env.coolify.example accordingly

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .env.coolify.example       |  7 +++---
 docker-compose.coolify.yml | 50 ++++----------------------------------
 2 files changed, 8 insertions(+), 49 deletions(-)

diff --git a/.env.coolify.example b/.env.coolify.example
index 3d9d742..2dad7a8 100644
--- a/.env.coolify.example
+++ b/.env.coolify.example
@@ -52,14 +52,13 @@ TRIAL_PERIOD_DAYS=14
 
 # --- Embedding Service ---
 EMBEDDING_BACKEND=local
-LOCAL_EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
+LOCAL_EMBEDDING_MODEL=BAAI/bge-m3
 LOCAL_RERANKER_MODEL=cross-encoder/ms-marco-MiniLM-L-6-v2
 PDF_EXTRACTION_BACKEND=pymupdf
 OPENAI_API_KEY=
 COHERE_API_KEY=
 LOG_LEVEL=INFO
 
-# --- Ollama (optional) ---
-OLLAMA_BASE_URL=
+# --- Ollama (optional, for RAG embeddings) ---
 OLLAMA_URL=
-OLLAMA_VOICE_MODEL=
+OLLAMA_EMBED_MODEL=bge-m3
diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index 7e9a553..c0654cd 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -14,7 +14,6 @@ networks:
 
 volumes:
   valkey_data:
-  voice_session_data:
   embedding_models:
 
 services:
@@ -150,6 +149,8 @@ services:
       MINIO_BUCKET: ${S3_BUCKET:-breakpilot-rag}
       MINIO_SECURE: ${S3_SECURE:-true}
       EMBEDDING_SERVICE_URL: http://embedding-service:8087
+      OLLAMA_URL: ${OLLAMA_URL:-}
+      OLLAMA_EMBED_MODEL: ${OLLAMA_EMBED_MODEL:-bge-m3}
       JWT_SECRET: ${JWT_SECRET}
       ENVIRONMENT: production
     depends_on:
@@ -174,7 +175,7 @@ services:
       - embedding_models:/root/.cache/huggingface
     environment:
       EMBEDDING_BACKEND: ${EMBEDDING_BACKEND:-local}
-      LOCAL_EMBEDDING_MODEL: ${LOCAL_EMBEDDING_MODEL:-sentence-transformers/all-MiniLM-L6-v2}
+      LOCAL_EMBEDDING_MODEL: ${LOCAL_EMBEDDING_MODEL:-BAAI/bge-m3}
       LOCAL_RERANKER_MODEL: ${LOCAL_RERANKER_MODEL:-cross-encoder/ms-marco-MiniLM-L-6-v2}
       PDF_EXTRACTION_BACKEND: ${PDF_EXTRACTION_BACKEND:-pymupdf}
       OPENAI_API_KEY: ${OPENAI_API_KEY:-}
@@ -183,7 +184,7 @@ services:
     deploy:
       resources:
         limits:
-          memory: 4G
+          memory: 8G
     healthcheck:
       test: ["CMD", "python", "-c", "import httpx; r=httpx.get('http://127.0.0.1:8087/health'); r.raise_for_status()"]
       interval: 30s
@@ -206,7 +207,7 @@ services:
       - "8099"
     environment:
       PORT: 8099
-      CHECK_SERVICES: "valkey:6379,backend-core:8000,rag-service:8097,embedding-service:8087,voice-service:8091"
+      CHECK_SERVICES: "valkey:6379,backend-core:8000,rag-service:8097,embedding-service:8087"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:8099/health"]
       interval: 30s
@@ -223,47 +224,6 @@ services:
     networks:
       - breakpilot-network
 
-  # =========================================================
-  # VOICE SERVICE
-  # =========================================================
-  voice-service:
-    build:
-      context: ./voice-service
-      dockerfile: Dockerfile
-    container_name: bp-core-voice-service
-    expose:
-      - "8091"
-    volumes:
-      - voice_session_data:/app/data/sessions
-    environment:
-      PORT: 8091
-      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
-      VALKEY_URL: redis://valkey:6379/0
-      KLAUSUR_SERVICE_URL: http://bp-lehrer-klausur-service:8086
-      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
-      OLLAMA_VOICE_MODEL: ${OLLAMA_VOICE_MODEL:-}
-      ENVIRONMENT: production
-      JWT_SECRET: ${JWT_SECRET}
-    depends_on:
-      valkey:
-        condition: service_started
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://127.0.0.1:8091/health"]
-      interval: 30s
-      timeout: 10s
-      start_period: 60s
-      retries: 3
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.voice.rule=Host(`voice.breakpilot.ai`)"
-      - "traefik.http.routers.voice.entrypoints=https"
-      - "traefik.http.routers.voice.tls=true"
-      - "traefik.http.routers.voice.tls.certresolver=letsencrypt"
-      - "traefik.http.services.voice.loadbalancer.server.port=8091"
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
   # =========================================================
   # NIGHT SCHEDULER
   # =========================================================
-- 
2.49.1


From 82c28a2b6e9aec899e0b26aa7f5f80abc49c05f0 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Sat, 7 Mar 2026 23:35:11 +0100
Subject: [PATCH 05/12] Add QDRANT_API_KEY support to rag-service

- Add QDRANT_API_KEY to config.py (empty string = no auth)
- Pass api_key to QdrantClient constructor (None when empty)
- Add QDRANT_API_KEY to coolify compose and env example

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .env.coolify.example                 | 1 +
 docker-compose.coolify.yml           | 1 +
 rag-service/config.py                | 1 +
 rag-service/qdrant_client_wrapper.py | 6 +++++-
 4 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.env.coolify.example b/.env.coolify.example
index 2dad7a8..6e4c910 100644
--- a/.env.coolify.example
+++ b/.env.coolify.example
@@ -26,6 +26,7 @@ S3_SECURE=true
 
 # --- External Qdrant (Coolify-managed) ---
 QDRANT_URL=http://<coolify-qdrant-hostname>:6333
+QDRANT_API_KEY=
 
 # --- SMTP (Real mail server) ---
 SMTP_HOST=smtp.example.com
diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index c0654cd..9ac398a 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -143,6 +143,7 @@ services:
     environment:
       PORT: 8097
       QDRANT_URL: ${QDRANT_URL}
+      QDRANT_API_KEY: ${QDRANT_API_KEY:-}
       MINIO_ENDPOINT: ${S3_ENDPOINT}
       MINIO_ACCESS_KEY: ${S3_ACCESS_KEY}
       MINIO_SECRET_KEY: ${S3_SECRET_KEY}
diff --git a/rag-service/config.py b/rag-service/config.py
index 951c04f..483308b 100644
--- a/rag-service/config.py
+++ b/rag-service/config.py
@@ -6,6 +6,7 @@ class Settings:
 
     # Qdrant
     QDRANT_URL: str = os.getenv("QDRANT_URL", "http://localhost:6333")
+    QDRANT_API_KEY: str = os.getenv("QDRANT_API_KEY", "")
 
     # MinIO
     MINIO_ENDPOINT: str = os.getenv("MINIO_ENDPOINT", "localhost:9000")
diff --git a/rag-service/qdrant_client_wrapper.py b/rag-service/qdrant_client_wrapper.py
index c4b27e4..daeafda 100644
--- a/rag-service/qdrant_client_wrapper.py
+++ b/rag-service/qdrant_client_wrapper.py
@@ -48,7 +48,11 @@ class QdrantClientWrapper:
     @property
     def client(self) -> QdrantClient:
         if self._client is None:
-            self._client = QdrantClient(url=settings.QDRANT_URL, timeout=30)
+            self._client = QdrantClient(
+                url=settings.QDRANT_URL,
+                api_key=settings.QDRANT_API_KEY or None,
+                timeout=30,
+            )
             logger.info("Connected to Qdrant at %s", settings.QDRANT_URL)
         return self._client
 
-- 
2.49.1


From 30807d1ce144042bc79baefd7c81ba42816c01bb Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Sat, 7 Mar 2026 23:37:59 +0100
Subject: [PATCH 06/12] Fix backend-core TARGETARCH: auto-detect instead of
 hardcoded arm64

The Dockerfile hardcoded TARGETARCH=arm64 for Mac Mini. Coolify server
is x86_64, causing exit code 126 (wrong binary arch). Now uses Docker
BuildKit's auto-detected TARGETARCH with dpkg fallback.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 backend-core/Dockerfile | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/backend-core/Dockerfile b/backend-core/Dockerfile
index b638317..fa33d3f 100644
--- a/backend-core/Dockerfile
+++ b/backend-core/Dockerfile
@@ -43,11 +43,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # Install DevSecOps tools (gitleaks, trivy, grype, syft)
-ARG TARGETARCH=arm64
+ARG TARGETARCH
 RUN set -eux; \
+    ARCH="${TARGETARCH:-$(dpkg --print-architecture)}"; \
     # Gitleaks
     GITLEAKS_VERSION=8.21.2; \
-    if [ "$TARGETARCH" = "arm64" ]; then GITLEAKS_ARCH=arm64; else GITLEAKS_ARCH=x64; fi; \
+    if [ "$ARCH" = "arm64" ]; then GITLEAKS_ARCH=arm64; else GITLEAKS_ARCH=x64; fi; \
     curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_${GITLEAKS_ARCH}.tar.gz" \
       | tar xz -C /usr/local/bin gitleaks; \
     # Trivy
-- 
2.49.1


From 6c3911ca47201777d2b7f2058bdc6d964ad832d7 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Sat, 7 Mar 2026 23:44:30 +0100
Subject: [PATCH 07/12] Fix admin-core build: ensure public directory exists
 before build

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 admin-core/Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/admin-core/Dockerfile b/admin-core/Dockerfile
index 66ac6c4..ef77a22 100644
--- a/admin-core/Dockerfile
+++ b/admin-core/Dockerfile
@@ -18,6 +18,9 @@ ARG NEXT_PUBLIC_API_URL
 # Set environment variables for build
 ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
 
+# Ensure public directory exists
+RUN mkdir -p public
+
 # Build the application
 RUN npm run build
 
-- 
2.49.1


From d9687725e56a8a8ddb65430855fd3649a6448fc0 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Sun, 8 Mar 2026 00:05:26 +0100
Subject: [PATCH 08/12] =?UTF-8?q?Remove=20Traefik=20labels=20from=20coolif?=
 =?UTF-8?q?y=20compose=20=E2=80=94=20Coolify=20handles=20routing?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 docker-compose.coolify.yml | 21 ---------------------
 1 file changed, 21 deletions(-)

diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index 9ac398a..0ee3257 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -64,13 +64,6 @@ services:
         condition: service_healthy
       consent-service:
         condition: service_started
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.backend-core.rule=Host(`api-core.breakpilot.ai`)"
-      - "traefik.http.routers.backend-core.entrypoints=https"
-      - "traefik.http.routers.backend-core.tls=true"
-      - "traefik.http.routers.backend-core.tls.certresolver=letsencrypt"
-      - "traefik.http.services.backend-core.loadbalancer.server.port=8000"
     restart: unless-stopped
     networks:
       - breakpilot-network
@@ -214,13 +207,6 @@ services:
       interval: 30s
       timeout: 10s
       retries: 3
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.health.rule=Host(`health.breakpilot.ai`)"
-      - "traefik.http.routers.health.entrypoints=https"
-      - "traefik.http.routers.health.tls=true"
-      - "traefik.http.routers.health.tls.certresolver=letsencrypt"
-      - "traefik.http.services.health.loadbalancer.server.port=8099"
     restart: unless-stopped
     networks:
       - breakpilot-network
@@ -268,13 +254,6 @@ services:
       NODE_ENV: production
       BACKEND_URL: http://backend-core:8000
       OLLAMA_URL: ${OLLAMA_URL:-}
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.admin-core.rule=Host(`admin-core.breakpilot.ai`)"
-      - "traefik.http.routers.admin-core.entrypoints=https"
-      - "traefik.http.routers.admin-core.tls=true"
-      - "traefik.http.routers.admin-core.tls.certresolver=letsencrypt"
-      - "traefik.http.services.admin-core.loadbalancer.server.port=3000"
     restart: unless-stopped
     networks:
       - breakpilot-network
-- 
2.49.1


From 8ee02bd2e40aa06a3457fa9585dd759d7fb23a6f Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Sun, 8 Mar 2026 00:57:43 +0100
Subject: [PATCH 09/12] Add healthchecks to backend-core, consent-service,
 billing-service, admin-core

Coolify/Traefik requires healthchecks to route traffic to containers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 docker-compose.coolify.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index 0ee3257..6f2b80d 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -64,6 +64,12 @@ services:
         condition: service_healthy
       consent-service:
         condition: service_started
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:8000/health"]
+      interval: 30s
+      timeout: 10s
+      start_period: 15s
+      retries: 3
     restart: unless-stopped
     networks:
       - breakpilot-network
@@ -94,6 +100,12 @@ services:
     depends_on:
       valkey:
         condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8081/health"]
+      interval: 30s
+      timeout: 10s
+      start_period: 15s
+      retries: 3
     restart: unless-stopped
     networks:
       - breakpilot-network
@@ -119,6 +131,12 @@ services:
       FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
       TRIAL_PERIOD_DAYS: ${TRIAL_PERIOD_DAYS:-14}
       INTERNAL_API_KEY: ${INTERNAL_API_KEY}
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8083/health"]
+      interval: 30s
+      timeout: 10s
+      start_period: 15s
+      retries: 3
     restart: unless-stopped
     networks:
       - breakpilot-network
@@ -254,6 +272,12 @@ services:
       NODE_ENV: production
       BACKEND_URL: http://backend-core:8000
       OLLAMA_URL: ${OLLAMA_URL:-}
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/"]
+      interval: 30s
+      timeout: 10s
+      start_period: 30s
+      retries: 3
     restart: unless-stopped
     networks:
       - breakpilot-network
-- 
2.49.1


From cf2cabd098e9f2d28e3c52edce855fc319915291 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Tue, 10 Mar 2026 13:29:23 +0100
Subject: [PATCH 10/12] Remove services not needed by SDK from Coolify
 deployment

Remove backend-core, billing-service, night-scheduler, and admin-core
as they are not used by any compliance/SDK service. Update
health-aggregator CHECK_SERVICES to reference consent-service instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 docker-compose.coolify.yml | 120 +------------------------------------
 1 file changed, 1 insertion(+), 119 deletions(-)

diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index 6f2b80d..32cc969 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -39,41 +39,6 @@ services:
   # =========================================================
   # SHARED SERVICES
   # =========================================================
-  backend-core:
-    build:
-      context: ./backend-core
-      dockerfile: Dockerfile
-    container_name: bp-core-backend
-    expose:
-      - "8000"
-    environment:
-      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}?options=-csearch_path%3Dcore,public
-      JWT_SECRET: ${JWT_SECRET}
-      ENVIRONMENT: production
-      VALKEY_URL: redis://valkey:6379/0
-      SESSION_TTL_HOURS: ${SESSION_TTL_HOURS:-24}
-      CONSENT_SERVICE_URL: http://consent-service:8081
-      SMTP_HOST: ${SMTP_HOST}
-      SMTP_PORT: ${SMTP_PORT:-587}
-      SMTP_USERNAME: ${SMTP_USERNAME}
-      SMTP_PASSWORD: ${SMTP_PASSWORD}
-      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-BreakPilot}
-      SMTP_FROM_ADDR: ${SMTP_FROM_ADDR:-noreply@breakpilot.ai}
-    depends_on:
-      valkey:
-        condition: service_healthy
-      consent-service:
-        condition: service_started
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://127.0.0.1:8000/health"]
-      interval: 30s
-      timeout: 10s
-      start_period: 15s
-      retries: 3
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
   consent-service:
     build:
       context: ./consent-service
@@ -110,37 +75,6 @@ services:
     networks:
       - breakpilot-network
 
-  billing-service:
-    build:
-      context: ./billing-service
-      dockerfile: Dockerfile
-    container_name: bp-core-billing-service
-    expose:
-      - "8083"
-    environment:
-      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
-      JWT_SECRET: ${JWT_SECRET}
-      PORT: 8083
-      ENVIRONMENT: production
-      ALLOWED_ORIGINS: "*"
-      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY}
-      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}
-      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY}
-      BILLING_SUCCESS_URL: ${BILLING_SUCCESS_URL:-https://www.breakpilot.ai/billing/success}
-      BILLING_CANCEL_URL: ${BILLING_CANCEL_URL:-https://www.breakpilot.ai/billing/cancel}
-      FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
-      TRIAL_PERIOD_DAYS: ${TRIAL_PERIOD_DAYS:-14}
-      INTERNAL_API_KEY: ${INTERNAL_API_KEY}
-    healthcheck:
-      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8083/health"]
-      interval: 30s
-      timeout: 10s
-      start_period: 15s
-      retries: 3
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
   # =========================================================
   # RAG & EMBEDDING SERVICES
   # =========================================================
@@ -219,7 +153,7 @@ services:
       - "8099"
     environment:
       PORT: 8099
-      CHECK_SERVICES: "valkey:6379,backend-core:8000,rag-service:8097,embedding-service:8087"
+      CHECK_SERVICES: "valkey:6379,consent-service:8081,rag-service:8097,embedding-service:8087"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:8099/health"]
       interval: 30s
@@ -229,55 +163,3 @@ services:
     networks:
       - breakpilot-network
 
-  # =========================================================
-  # NIGHT SCHEDULER
-  # =========================================================
-  night-scheduler:
-    build:
-      context: ./night-scheduler
-      dockerfile: Dockerfile
-    container_name: bp-core-night-scheduler
-    expose:
-      - "8096"
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./night-scheduler/config:/config
-    environment:
-      COMPOSE_PROJECT_NAME: breakpilot-core
-      CONTAINER_PATTERN: "bp-*"
-      EXCLUDED_CONTAINERS: "bp-core-night-scheduler,bp-core-valkey"
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://127.0.0.1:8096/health"]
-      interval: 30s
-      timeout: 10s
-      start_period: 10s
-      retries: 3
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-
-  # =========================================================
-  # ADMIN CORE
-  # =========================================================
-  admin-core:
-    build:
-      context: ./admin-core
-      dockerfile: Dockerfile
-      args:
-        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_CORE_API_URL:-https://api-core.breakpilot.ai}
-    container_name: bp-core-admin
-    expose:
-      - "3000"
-    environment:
-      NODE_ENV: production
-      BACKEND_URL: http://backend-core:8000
-      OLLAMA_URL: ${OLLAMA_URL:-}
-    healthcheck:
-      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/"]
-      interval: 30s
-      timeout: 10s
-      start_period: 30s
-      retries: 3
-    restart: unless-stopped
-    networks:
-      - breakpilot-network
-- 
2.49.1


From 0fb4a7e359c5e481ffc7ee0400dabd9f65a280ea Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Fri, 13 Mar 2026 11:26:34 +0100
Subject: [PATCH 11/12] =?UTF-8?q?Remove=20standalone=20deploy-coolify.yml?=
 =?UTF-8?q?=20=E2=80=94=20deploy=20is=20handled=20in=20ci.yaml?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .gitea/workflows/deploy-coolify.yml | 27 ---------------------------
 1 file changed, 27 deletions(-)
 delete mode 100644 .gitea/workflows/deploy-coolify.yml

diff --git a/.gitea/workflows/deploy-coolify.yml b/.gitea/workflows/deploy-coolify.yml
deleted file mode 100644
index b65f762..0000000
--- a/.gitea/workflows/deploy-coolify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: Deploy to Coolify
-
-on:
-  push:
-    branches:
-      - coolify
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Deploy via Coolify API
-        run: |
-          echo "Deploying breakpilot-core to Coolify..."
-          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
-            -X POST \
-            -H "Authorization: Bearer ${{ secrets.COOLIFY_API_TOKEN }}" \
-            -H "Content-Type: application/json" \
-            -d '{"uuid": "${{ secrets.COOLIFY_RESOURCE_UUID }}", "force_rebuild": true}' \
-            "${{ secrets.COOLIFY_BASE_URL }}/api/v1/deploy")
-
-          echo "HTTP Status: $HTTP_STATUS"
-          if [ "$HTTP_STATUS" -ne 200 ] && [ "$HTTP_STATUS" -ne 201 ]; then
-            echo "Deployment failed with status $HTTP_STATUS"
-            exit 1
-          fi
-          echo "Deployment triggered successfully!"
-- 
2.49.1


From e9487a31c6f8cf7adc7bebc609da5915a57f112d Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <parnerkarsharang@gmail.com>
Date: Fri, 13 Mar 2026 11:42:41 +0100
Subject: [PATCH 12/12] Replace deploy-hetzner with Coolify webhook deploy in
 ci.yaml

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yaml | 115 +++------------------------------------
 1 file changed, 9 insertions(+), 106 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 1af63e5..f7c69e7 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -140,117 +140,20 @@ jobs:
           python -m pytest tests/bqas/ -v --tb=short || true
 
   # ========================================
-  # Build & Deploy auf Hetzner (nur main, kein PR)
+  # Deploy via Coolify (nur main, kein PR)
   # ========================================
 
-  deploy-hetzner:
+  deploy-coolify:
+    name: Deploy
     runs-on: docker
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs:
       - test-go-consent
-    container: docker:27-cli
+    container:
+      image: alpine:latest
     steps:
-      - name: Deploy
+      - name: Trigger Coolify deploy
         run: |
-          set -euo pipefail
-          DEPLOY_DIR="/opt/breakpilot-core"
-          COMPOSE_FILES="-f docker-compose.yml -f docker-compose.hetzner.yml"
-          COMMIT_SHA="${GITHUB_SHA:-unknown}"
-          SHORT_SHA="${COMMIT_SHA:0:8}"
-          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-
-          # Services die deployed werden
-          SERVICES="postgres valkey qdrant minio ollama mailpit embedding-service rag-service backend-core consent-service health-aggregator"
-
-          echo "=== BreakPilot Core Deploy ==="
-          echo "Commit: ${SHORT_SHA}"
-          echo "Deploy Dir: ${DEPLOY_DIR}"
-          echo "Services: ${SERVICES}"
-          echo ""
-
-          # 1. Repo auf dem Host erstellen/aktualisieren via Helper-Container
-          echo "=== Updating code on host ==="
-          docker run --rm \
-            -v "${DEPLOY_DIR}:${DEPLOY_DIR}" \
-            --entrypoint sh \
-            alpine/git:latest \
-            -c "
-              if [ ! -d '${DEPLOY_DIR}/.git' ]; then
-                echo 'Erstmaliges Klonen nach ${DEPLOY_DIR}...'
-                git clone '${REPO_URL}' '${DEPLOY_DIR}'
-              else
-                cd '${DEPLOY_DIR}'
-                git fetch origin main
-                git reset --hard origin/main
-              fi
-            "
-          echo "Code aktualisiert auf ${SHORT_SHA}"
-
-          # 2. .env sicherstellen
-          docker run --rm -v "${DEPLOY_DIR}:${DEPLOY_DIR}" alpine \
-            sh -c "
-              if [ ! -f '${DEPLOY_DIR}/.env' ]; then
-                echo 'WARNUNG: ${DEPLOY_DIR}/.env fehlt!'
-                echo 'Erstelle .env aus .env.example mit Defaults...'
-                if [ -f '${DEPLOY_DIR}/.env.example' ]; then
-                  cp '${DEPLOY_DIR}/.env.example' '${DEPLOY_DIR}/.env'
-                  echo '.env aus .env.example erstellt'
-                else
-                  echo 'Kein .env.example gefunden — Services starten mit Defaults'
-                fi
-              else
-                echo '.env vorhanden'
-              fi
-            "
-
-          # 3. Shared Network erstellen (falls noch nicht vorhanden)
-          docker network create breakpilot-network 2>/dev/null || true
-
-          # 4. Build + Deploy via Helper-Container
-          echo ""
-          echo "=== Building + Deploying ==="
-          docker run --rm \
-            -v /var/run/docker.sock:/var/run/docker.sock \
-            -v "${DEPLOY_DIR}:${DEPLOY_DIR}" \
-            -w "${DEPLOY_DIR}" \
-            docker:27-cli \
-            sh -c "
-              set -e
-              COMPOSE_FILES='-f docker-compose.yml -f docker-compose.hetzner.yml'
-
-              echo '=== Building Docker Images ==='
-              docker compose \${COMPOSE_FILES} build --parallel \
-                backend-core consent-service rag-service embedding-service health-aggregator
-
-              echo ''
-              echo '=== Starting infrastructure ==='
-              docker compose \${COMPOSE_FILES} up -d postgres valkey qdrant minio mailpit
-
-              echo 'Warte auf DB + Cache...'
-              sleep 10
-
-              echo ''
-              echo '=== Starting Ollama + pulling bge-m3 ==='
-              docker compose \${COMPOSE_FILES} up -d ollama
-              sleep 5
-
-              # bge-m3 Modell pullen (nur beim ersten Mal ~670MB)
-              echo 'Pulling bge-m3 model (falls noch nicht vorhanden)...'
-              docker exec bp-core-ollama ollama pull bge-m3 2>&1 || echo 'WARNUNG: bge-m3 pull fehlgeschlagen (wird spaeter nachgeholt)'
-
-              echo ''
-              echo '=== Starting application services ==='
-              docker compose \${COMPOSE_FILES} up -d \
-                embedding-service rag-service backend-core consent-service health-aggregator
-
-              echo ''
-              echo '=== Health Checks ==='
-              sleep 15
-              for svc in bp-core-postgres bp-core-valkey bp-core-qdrant bp-core-ollama bp-core-embedding-service bp-core-rag-service bp-core-backend bp-core-consent-service bp-core-health; do
-                STATUS=\$(docker inspect --format='{{.State.Status}}' \"\${svc}\" 2>/dev/null || echo 'not found')
-                echo \"\${svc}: \${STATUS}\"
-              done
-            "
-
-          echo ""
-          echo "=== Deploy abgeschlossen: ${SHORT_SHA} ==="
+          apk add --no-cache curl
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK }}" \
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
-- 
2.49.1