# Qdrant vector database, loopback only, with an admin key and a read-only key.
#
# Kit template for guide doc 1 (layer L4) and doc 2 (build step "Qdrant"). Version as of October 2026:
# qdrant/qdrant v1.19.2. Pin the digest you tested after the first good start.
#
# Secrets in ./.env (chmod 600), created on the server by you:
#   QDRANT_API_KEY=<long random>            admin: indexers that write
#   QDRANT_READ_ONLY_API_KEY=<long random>  everything that only searches
# Clients send the key in the "api-key" header. The dashboard is at http://127.0.0.1:6333/dashboard;
# reach it over an SSH tunnel (ssh -L 6333:127.0.0.1:6333 <user>@<server-ip>), not through the web.
#
# Snapshots restore only to the same minor version or the next one, so take one before every upgrade:
#   curl -s -X POST -H "api-key: $QDRANT_API_KEY" http://127.0.0.1:6333/collections/memory/snapshots

name: qdrant

services:
  qdrant:
    image: qdrant/qdrant:v1.19.2
    restart: unless-stopped
    environment:
      QDRANT__SERVICE__API_KEY: ${QDRANT_API_KEY:?set in .env}
      QDRANT__SERVICE__READ_ONLY_API_KEY: ${QDRANT_READ_ONLY_API_KEY:?set in .env}
      QDRANT__TELEMETRY_DISABLED: "true"
    volumes:
      - qdrant_data:/qdrant/storage
      - qdrant_snapshots:/qdrant/snapshots
    ports:
      - "127.0.0.1:6333:6333"               # REST and dashboard; gRPC (6334) stays inside Docker
    networks: [memory]
    cpus: 4
    mem_limit: 8g
    security_opt:
      - no-new-privileges:true
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }

volumes:
  qdrant_data: {}
  qdrant_snapshots: {}

networks:
  memory: {}