services:
  openwebui:
    image: "{{ openwebui_image }}"
    container_name: openwebui
    networks:
      - llmnet
    ports:
      # plain HTTP for now — no TLS yet (projektplan §2.2). Put a reverse proxy
      # in front (new stack 04-proxy) once an internal CA certificate exists.
      - "80:8080"
    depends_on:
      - vllm
      - owui-db
    volumes:
      - "{{ appdata_path }}/apps/open-webui:/app/backend/data"
    environment:
      - "WEBUI_URL=http://{{ llm_dns_name }}"
      - "WEBUI_SECRET_KEY={{ vault_owui_secret_key }}"

      # --- inference: vLLM speaks the OpenAI API, Ollama stays off ---
      - OPENAI_API_BASE_URL=http://vllm:8000/v1
      - OPENAI_API_KEY=dummy
      - ENABLE_OLLAMA_API=false

      # --- vector store: pgvector rather than the default chroma, which does
      #     not scale to the corpus sizes discussed in §2.6 ---
      - VECTOR_DB=pgvector
      - "PGVECTOR_DB_URL=postgresql://openwebui:{{ vault_owui_db_password }}@owui-db:5432/openwebui"

      # --- RAG embeddings from the second vLLM instance ---
      - RAG_EMBEDDING_ENGINE=openai
      - RAG_OPENAI_API_BASE_URL=http://embeddings:8000/v1
      - RAG_OPENAI_API_KEY=dummy
      - "RAG_EMBEDDING_MODEL={{ embedding_model_name }}"

      # --- AD/LDAP login (group llm_users) ---
      # NOTE: verify these variable names against the Open WebUI docs for the
      # tag actually deployed — they have changed between releases.
      - ENABLE_LDAP=true
      - LDAP_SERVER_LABEL=Phytron AD
      - "LDAP_SERVER_HOST={{ ldap_server_host }}"
      - "LDAP_SERVER_PORT={{ ldap_server_port }}"
      - "LDAP_APP_DN={{ ldap_bind_dn }}"
      - "LDAP_APP_PASSWORD={{ vault_ldap_bind_password }}"
      - "LDAP_SEARCH_BASE={{ ldap_search_base }}"
      - "LDAP_SEARCH_FILTER={{ ldap_search_filter }}"
      - LDAP_ATTRIBUTE_FOR_USERNAME=sAMAccountName
      - LDAP_USE_TLS=false
    restart: unless-stopped

  owui-db:
    image: "{{ pgvector_image }}"
    container_name: owui-db
    networks:
      - llmnet
    volumes:
      - "{{ appdata_path }}/databases/openwebui-pgdata:/var/lib/postgresql/data"
    environment:
      - POSTGRES_DB=openwebui
      - POSTGRES_USER=openwebui
      - "POSTGRES_PASSWORD={{ vault_owui_db_password }}"
    restart: unless-stopped