Updates to add sage recipe host

docker-compose.yaml

@@ -4,6 +4,7 @@ include:
   - ./immich-compose.yaml
   - ./matrix-compose.yaml
   - ./authentik.yaml
+  - ./recipe-sage.yaml
 secrets:
   JWT_SECRET:
     file: '/data/authelia/secrets/JWT_SECRET'
@@ -62,6 +63,9 @@ networks:
   matrix:
     external: false
     enable_ipv6: true
+  sage:
+    external: false
+    enable_ipv6: true
 services:
   web:
     build:
@@ -86,6 +90,7 @@ services:
       - bitwarden
       - matrix
       - immich
+      - sage
     depends_on:
       - jellyfin
       - ollama-webui
@@ -98,6 +103,9 @@ services:
       - authentik
       - matrix-server
       - jackett
+      - sage-static
+      - sage-api
+      - sage-pushpin
     logging: &logging
       options:
         max-size: "50m"

gitea-runner.yaml

@@ -77,7 +77,7 @@ container:
   # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
   privileged: false
   # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
-  options: '-v /data/site:/data/site'
+  options: '-v /data/site:/data/site -v /var/run/docker.sock:/var/run/docker.sock'
   # The parent directory of a job's working directory.
   # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
   # If the path starts with '/', the '/' will be trimmed.
@@ -100,7 +100,7 @@ container:
   # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
   docker_host: "-"
   # Pull docker image(s) even if already present
-  force_pull: false
+  force_pull: true
   # Rebuild docker image(s) even if already present
   force_rebuild: false
   # Always require a reachable docker daemon, even if not required by act_runner

nginx/sites-enabled/gpodder

@@ -16,12 +16,6 @@ server {
     # Permissions policy. May cause issues with some clients
     add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
 
-    # Content Security Policy
-    # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
-    # Enforces https content and restricts JS/CSS to origin
-    # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
-    add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self'";
-
     location / {
         # Proxy main karakeep traffic
         proxy_pass http://gpodder:8000;

nginx/sites-enabled/sage

@@ -0,0 +1,46 @@
+server {
+  # Nginx versions 1.25+
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  http2 on;
+
+  server_name sage.loadingm.xyz;
+  acme_certificate      letsencrypt;
+  ssl_certificate       $acme_certificate; 
+  ssl_certificate_key   $acme_certificate_key; 
+  ssl_certificate_cache max=2;
+
+  ## The default `client_max_body_size` is 1M, this might not be enough for some posters, etc.
+  client_max_body_size 200G;
+
+  # Security / XSS Mitigation Headers
+  add_header X-Content-Type-Options "nosniff";
+
+  # Permissions policy. May cause issues with some clients
+  add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
+
+  location /grip/ws {
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_connect_timeout 1h;
+    proxy_send_timeout 1h;
+    proxy_read_timeout 1h;
+    proxy_pass http://sage-pushpin:7999/ws;
+  }
+
+  # Alias minio in case minio container is not present
+  set $minio http://sage-minio:9000;
+  location /minio/ {
+    rewrite ^/minio/(.*)$ /$1 break;
+    proxy_pass $minio;
+  }
+
+  location /api/ {
+    proxy_pass http://sage-api:3000/;
+  }
+
+  location / {
+    proxy_pass http://sage-static:80/;
+  }
+}

recipe-sage.yaml

@@ -0,0 +1,130 @@
+# This config file is for RecipeSage-selfhost config version 4.3.1, and RecipeSage version 3.0.10.
+
+services:
+  # sage-proxy: # The proxy must not be removed. If needed, point your own proxy to this container, rather than removing this
+  #   # container_name: recipesage_proxy
+  #   image: julianpoy/recipesage-selfhost-proxy:v4.0.0
+  #   ports:
+  #   - 7270:80
+  #   depends_on:
+  #     - sage-static
+  #     - sage-api
+  #     - sage-pushpin
+  #   restart: unless-stopped
+  sage-static: # Hosts frontend assets
+    # container_name: recipesage_static
+    image: julianpoy/recipesage-selfhost:static-v3.0.10
+    restart: unless-stopped
+    networks:
+      - sage
+  sage-api: # Hosts backend API
+    # container_name: recipesage_api
+    image: julianpoy/recipesage-selfhost:api-v3.0.10
+    depends_on:
+      sage-postgres:
+        condition: service_healthy
+      sage-typesense:
+        condition: service_started
+      sage-pushpin:
+        condition: service_started
+      sage-browserless:
+        condition: service_started
+    networks:
+      - sage
+      - ollama-int
+    command: sh -c "npx prisma migrate deploy; npx nx seed prisma; npx ts-node --swc --project packages/backend/tsconfig.json packages/backend/src/bin/www"
+    environment:
+      - STORAGE_TYPE=filesystem
+      - FILESYSTEM_STORAGE_PATH=/rs-media
+      - NODE_ENV=selfhost
+      - VERBOSE=false
+      - VERSION=selfhost
+      - POSTGRES_DB=recipesage_selfhost # If changing this, make sure to update the postgres container and the DATABASE_URL below accordingly
+      - POSTGRES_USER=recipesage_selfhost # If changing this, make sure to update the postgres container and the DATABASE_URL below accordingly
+      - POSTGRES_PASSWORD=recipesage_selfhost # If changing this, make sure to update the postgres container and the DATABASE_URL below accordingly
+      - POSTGRES_PORT=5432 # If changing this, make sure to update the postgres container and the DATABASE_URL below accordingly
+      - POSTGRES_HOST=sage-postgres # If changing this, make sure to update the postgres container and the DATABASE_URL below accordingly
+      - POSTGRES_SSL=false
+      - POSTGRES_LOGGING=false
+      - DATABASE_URL=postgresql://recipesage_selfhost:recipesage_selfhost@sage-postgres:5432/recipesage_selfhost # Format is: postgresql://USERNAME:PASSWORD@HOST:PORT/DBNAME and must match the variables from the postgres container if you decide to change them
+      - GCM_KEYPAIR
+      - SENTRY_DSN
+      - GRIP_URL=http://sage-pushpin:5561/
+      - GRIP_KEY=changeme
+      - SEARCH_PROVIDER=typesense
+      - 'TYPESENSE_NODES=[{"host": "sage-typesense", "port": 8108, "protocol": "http"}]'
+      - TYPESENSE_API_KEY=recipesage_selfhost
+      - STRIPE_SK # Value should not be set.
+      - STRIPE_WEBHOOK_SECRET # Value should not be set
+      - BROWSERLESS_HOST=sage-browserless
+      - BROWSERLESS_PORT=3000
+      - BROWSERLESS_TOKEN=
+      - INGREDIENT_INSTRUCTION_CLASSIFIER_URL=http://sage-ingredient-instruction-classifier:3000/
+      - OPENAI_API_KEY=ollama # Please follow the instructions in the README if you decide to supply a value here
+      - OPENAI_API_BASE_URL=http://ollama:11434/v1/
+    volumes:
+      - /srv/sage/apimedia:/rs-media
+    restart: unless-stopped
+  sage-typesense: # Provides the fuzzy search engine
+    # container_name: recipesage_typesense
+    image: typesense/typesense:0.24.1
+    networks:
+      - sage
+    volumes:
+      - /srv/sage/typesensedata:/data
+    command: "--data-dir /data --api-key=recipesage_selfhost --enable-cors"
+    restart: unless-stopped
+  sage-pushpin: # Provides websocket support
+    # container_name: recipesage_pushpin
+    image: julianpoy/pushpin:2023-09-17
+    networks:
+      - sage
+    entrypoint: /bin/sh -c
+    command:
+      [
+        'sed -i "s/sig_key=changeme/sig_key=$$GRIP_KEY/" /etc/pushpin/pushpin.conf && echo "* $${TARGET},over_http" > /etc/pushpin/routes && pushpin --merge-output',
+      ]
+    environment:
+      - GRIP_KEY=changeme
+      - TARGET=api:3000
+    restart: unless-stopped
+  sage-postgres: # Database
+    # container_name: recipesage_postgres
+    image: postgres:16
+    networks:
+      - sage
+    environment:
+      - POSTGRES_DB=recipesage_selfhost # If you change this, make sure to change both POSTGRES_DB and DATABASE_URL on the API container
+      - POSTGRES_USER=recipesage_selfhost # If you change this, make sure to change both POSTGRES_USER and DATABASE_URL on the API container
+      - POSTGRES_PASSWORD=recipesage_selfhost # If you change this, make sure to change both POSTGRES_PASSWORD and DATABASE_URL on the API container
+      - PGUSER=recipesage_selfhost # Change to db user
+    volumes:
+      - /srv/sage/postgresdata:/var/lib/postgresql/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready", "-d", "db_prod", "-U", "recipesage_selfhost"] # Change to db user
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+  sage-browserless: # A headless browser for scraping websites with the auto import tool
+    # container_name: recipesage_browserless
+    image: ghcr.io/browserless/chromium:v2.24.3
+    networks:
+      - sage
+    environment:
+      - MAX_CONCURRENT_SESSIONS=3
+      - MAX_QUEUE_LENGTH=10
+    restart: unless-stopped
+
+  # Uncomment the lines below to enable the ingredient instruction classifier. It's somewhat resource intensive (and large) and requires AVX instruction support on your CPU, but does improve site compatibility for the automatic import tool.
+
+  sage-ingredient-instruction-classifier: # An _optional_ server that runs a machine learning model able to classify text for improved automatic import site support. Not required for application to run, and will crash if your CPU does not support AVX instructions
+    # container_name: recipesage_classifier
+    image: julianpoy/ingredient-instruction-classifier:1.4.11
+    networks:
+      - sage
+    environment:
+      - SENTENCE_EMBEDDING_BATCH_SIZE=200
+      - PREDICTION_CONCURRENCY=2
+    restart: unless-stopped