Layers на вашем сервере

docker --version
docker compose version
mkdir -p /opt/layers && cd /opt/layers
openssl rand -hex 24

name: layers

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: layers
      POSTGRES_USER: layers
      POSTGRES_PASSWORD: change-me-db
    volumes:
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U layers -d layers"]
      interval: 5s
      retries: 20

  manticore:
    image: manticoresearch/manticore:latest
    restart: unless-stopped
    volumes:
      - manticore_data:/var/lib/manticore

  layers:
    image: hissih/layers:latest
    platform: linux/amd64
    restart: unless-stopped
    depends_on:
      db: { condition: service_healthy }
      manticore: { condition: service_started }
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - layers_data:/root/layers_data
    environment:
      SPRING_PROFILES_ACTIVE: server
      # База
      DB_SERVER_URL: jdbc:postgresql://db:5432/layers
      DB_SERVER_USERNAME: layers
      DB_SERVER_PASSWORD: change-me-db
      # Панель администратора /godmode
      ADMIN_USERNAME: admin
      ADMIN_PASSWORD: change-me-admin
      # Домен
      LAYERS_DOMAIN: example.com
      LAYERS_APP_DOMAIN: example.com
      APP_REDIRECT_URL: https://example.com
      APP_CORS_ALLOWED_ORIGINS: https://example.com
      # Поиск
      SEARCH_PROVIDER: manticore
      SEARCH_MANTICORE_ENABLED: "true"
      SEARCH_MANTICORE_URL: http://manticore:9308
      SEARCH_ELASTICSEARCH_ENABLED: "false"
      # Звонки
      LIVEKIT_ENABLED: "true"
      LIVEKIT_URL: ws://livekit:7880
      LIVEKIT_PUBLIC_URL: wss://example.com/livekit/
      LIVEKIT_API_KEY: change-me-livekit-key
      LIVEKIT_API_SECRET: change-me-livekit-secret-min-32-characters
      # Почта (отправка писем)
      MAIL_PROVIDER: smtp
      SPRING_MAIL_HOST: smtp.example.com
      SPRING_MAIL_PORT: "587"
      SPRING_MAIL_USERNAME: noreply@example.com
      SPRING_MAIL_PASSWORD: change-me-smtp
      SPRING_MAIL_SMTP_AUTH: "true"
      SPRING_MAIL_SMTP_STARTTLS_ENABLE: "true"
      # Редакторы SumDoc и SumSheet (адреса, которые видит браузер)
      LAYERS_FASTDOC_URL: https://example.com/sumdoc
      LAYERS_FASTSHEET_URL: https://example.com/sumsheet
      # ИИ: модель подключается в God Mode → ИИ
      AI_ENABLED: "true"
      ASSISTANT_MCP_URL: http://mcp:8091/mcp
      AI_USER_MODEL_CHOICE: "true"

  livekit:
    image: livekit/livekit-server:latest
    restart: unless-stopped
    environment:
      LIVEKIT_CONFIG: |
        port: 7880
        bind_addresses: [""]
        rtc:
          tcp_port: 7881
          port_range_start: 50000
          port_range_end: 50100
          use_external_ip: true
        keys:
          change-me-livekit-key: change-me-livekit-secret-min-32-characters
        webhook:
          api_key: change-me-livekit-key
          urls:
            - http://layers:8080/v1/livekit/webhook
    ports:
      - "7880:7880"
      - "7881:7881"
      - "7882:7882/udp"
      - "50000-50100:50000-50100/udp"

  sumdoc:
    image: hissih/sumdoc-webhost:latest
    platform: linux/amd64
    restart: unless-stopped
    command: ["--base-path", "/sumdoc", "--max-cabins", "12", "--idle-min", "20",
              "--auth-url", "http://layers:8080/v1/me",
              "--attach-url", "http://layers:8080/v1/attachments/{id}/content"]
    ports:
      - "127.0.0.1:8090:8090"
    volumes:
      - sumdoc_cabins:/data/cabins

  sumsheet:
    image: hissih/sumsheet-webhost:latest
    platform: linux/amd64
    restart: unless-stopped
    command: ["--base-path", "/sumsheet", "--max-cabins", "12", "--idle-min", "20",
              "--auth-url", "http://layers:8080/v1/me",
              "--attach-url", "http://layers:8080/v1/attachments/{id}/content"]
    ports:
      - "127.0.0.1:8092:8092"
    volumes:
      - sumsheet_cabins:/data/cabins

  mcp:
    image: layers-mcp-server:from-distribution   # образ MCP-сервера из дистрибутива
    restart: unless-stopped
    depends_on: [layers]
    environment:
      SPRING_PROFILES_ACTIVE: server
      SERVER_PORT: "8091"
      LAYERS_BACKEND_BASEURL: http://layers:8080
      LAYERS_BACKEND_FORWARDINCOMINGAUTH: "true"
      LAYERS_BACKEND_REQUIREINCOMINGAUTH: "true"
    ports:
      - "127.0.0.1:8091:8091"

volumes:
  pg_data:
  manticore_data:
  layers_data:
  sumdoc_cabins:
  sumsheet_cabins:

      SEARCH_PROVIDER: elasticsearch
      SEARCH_ELASTICSEARCH_ENABLED: "true"
      SEARCH_MANTICORE_ENABLED: "false"
      ES_HOST: elasticsearch.example.com
      ES_PORT: "9200"
      ES_PROTOCOL: https
      ES_USERNAME: layers
      ES_PASSWORD: change-me-es

      SEARCH_PROVIDER: lucene
      SEARCH_MANTICORE_ENABLED: "false"
      SEARCH_ELASTICSEARCH_ENABLED: "false"

docker compose up -d
docker compose logs -f layers
curl -s http://127.0.0.1:8080/health
# OK

sudo apt install nginx certbot python3-certbot-nginx
sudo certbot certonly --nginx -d example.com

server {
    listen 80;
    server_name example.com;
    location /.well-known/acme-challenge/ { root /var/www/certbot; }
    location / { return 301 https://example.com$request_uri; }
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    client_max_body_size 1000m;
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;

    # Layers: веб, API, God Mode
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 300;
    }

    # LiveKit: сигналинг (слеш в конце proxy_pass обязателен)
    location /livekit/ {
        proxy_pass http://127.0.0.1:7880/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400s;
    }
    # LiveKit REST: SDK сервера ходит в /twirp/ от корня
    location /twirp/ {
        proxy_pass http://127.0.0.1:7880/twirp/;
        proxy_set_header Host $host;
        proxy_read_timeout 86400s;
    }

    # Редакторы — на том же домене, чтобы получить cookie входа Layers
    location /sumdoc {
        proxy_pass http://127.0.0.1:8090;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
    }
    location /sumsheet {
        proxy_pass http://127.0.0.1:8092;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
    }

    # MCP для внешних агентов (необязательно)
    location /mcp {
        proxy_pass http://127.0.0.1:8091/mcp;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_buffering off;
        proxy_read_timeout 3600s;
    }
}

sudo ln -s /etc/nginx/sites-available/layers.conf /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

sudo ufw allow 7881/tcp
sudo ufw allow 7882/udp
sudo ufw allow 50000:50100/udp

SPRING_MAIL_PORT: "465"
SPRING_MAIL_SMTP_STARTTLS_ENABLE: "false"
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE: "true"

curl -s http://127.0.0.1:8090/sumdoc/health     # "status": "ok", "skewMin": 0
curl -s http://127.0.0.1:8092/sumsheet/health   # "status": "ok", "skewMin": 0
curl -s https://example.com/v1/capabilities
# {"fastdoc":{"enabled":true,"url":"https://example.com/sumdoc"},
#  "fastsheet":{"enabled":true,"url":"https://example.com/sumsheet"}, …}

  ollama:
    image: ollama/ollama:latest
    restart: unless-stopped
    volumes:
      - ollama_data:/root/.ollama
# и в volumes:
#   ollama_data:

docker compose up -d ollama
docker compose exec ollama ollama pull gpt-oss:20b
# адрес в «Своём подключении»: http://ollama:11434/v1
# OpenAI‑совместимый сервер на другой машине: http://<адрес>:8000/v1

curl -s http://127.0.0.1:8091/actuator/health
# {"status":"UP", …}

curl -s https://example.com/layers/license/status
# {"mode":"MISSING", …, "node":{"regime":"evaluation","evaluationDaysLeft":89, …}}
# с ключом: "regime":"full"

cd /opt/layers
docker compose pull
docker compose up -d

cd /opt/layers
docker compose exec -T db sh -c 'pg_dump -U $POSTGRES_USER $POSTGRES_DB' | gzip > layers-db-$(date +%F).sql.gz
docker run --rm -v layers_layers_data:/data -v "$PWD":/backup alpine \
  tar czf /backup/layers-data-$(date +%F).tar.gz -C /data .