docker-compose.override.yml

secrets:
  openai_api_key:
    file: ./secrets/openai_api_key.txt
services:
  linkeddatahub:
    image: atomgraph/linkeddatahub:latest
    environment:
      - TZ="Europe/Vilnius"
      - ENABLE_WEBID_SIGNUP=false # disable public WebID signup
    # Custom XSLT overrides for the END-USER app only (admin untouched), the
    # linkeddatahub.com pattern — see CLAUDE.md "XSLT overrides". layout.xsl
    # replaces the stock end-user ac:stylesheet target (static/xsl/layout.xsl)
    # and imports overrides.xsl from its own dir; client.xsl + its compiled SEF
    # live under static/lt/linkeddata/xsl/ (repointed by layout.xsl's xhtml:Script).
    # Rebuild the SEF (`make sef`) and recreate this container after editing any
    # of them. Not :ro on layout.xsl — LDH's InstallPackage endpoint appends to it.
    volumes:
      - ./files/layout.xsl:/usr/local/tomcat/webapps/ROOT/static/xsl/layout.xsl
      - ./files/overrides.xsl:/usr/local/tomcat/webapps/ROOT/static/xsl/overrides.xsl:ro
      - ./files/client.xsl:/usr/local/tomcat/webapps/ROOT/static/lt/linkeddata/xsl/client.xsl:ro
      - ./files/client.xsl.sef.json:/usr/local/tomcat/webapps/ROOT/static/lt/linkeddata/xsl/client.xsl.sef.json:ro
      # social-preview card, the og:image fallback in layout.xsl
      - ./files/og-image.png:/usr/local/tomcat/webapps/ROOT/static/lt/linkeddata/og-image.png:ro
  web-algebra:
    # the assistant writes plans here: the model key, which the base leaves out as it does the OAuth secrets
    environment:
      - OPENAI_API_KEY_FILE=/run/secrets/openai_api_key
    secrets:
      - secretary_cert_password
      - openai_api_key
  # one-off bulk loader: `make load` runs it with fuseki stopped. It mounts ./fuseki/end-user
  # itself, so its --loc /fuseki/databases/DB2 still writes the end-user dataset's TDB2 folder.
  # The fuseki image bundles the full Jena CLI inside the fuseki-server jar.
  # Committed TriG is base-relative with no @base; resolve it against the
  # deployment base (BASE_URI, injected by `make load` from .env) with riot
  # first — tdb2.tdbloader has no --base and would otherwise store file:// IRIs.
  # Progress: N-Quads is one quad per line, so `wc -l` gives the total and awk appends a
  # percentage to the loader's "Add: N" lines (pipefail keeps a failed load failing).
  tdb-loader:
    image: atomgraph/fuseki:6.1.0
    profiles: [ "load" ]
    user: root
    mem_limit: 4096m
    volumes:
      - ./fuseki/end-user:/fuseki/databases
      - ./datasets/current:/staging:ro
    entrypoint: [ "/bin/sh", "-c" ]
    command:
      - >
        set -eo pipefail;
        echo "Resolving /staging/*/*.trig against $${BASE_URI:?BASE_URI not set} ...";
        "$${JAVA_HOME}/bin/java" -Xmx3g -cp "/fuseki/$${FUSEKI_JAR}" riotcmd.riot
        --quiet --time --base="$${BASE_URI}" --syntax=trig --output=nquads /staging/*/*.trig > /tmp/staging.nq;
        total=$$(wc -l < /tmp/staging.nq);
        echo "Loading $$total quads";
        "$${JAVA_HOME}/bin/java" -Xmx3g -cp "/fuseki/$${FUSEKI_JAR}" tdb2.tdbloader
        --loc /fuseki/databases/DB2 /tmp/staging.nq 2>&1
        | awk -v total="$$total" '{
            if (total > 0 && match($$0, /Add: [0-9,]+/)) {
              n = substr($$0, RSTART + 5, RLENGTH - 5); gsub(",", "", n);
              printf "%s [%d / %d, %d%%]\n", $$0, n, total, 100 * n / total
            } else print;
            fflush()
          }'
  # The base defines the service; this repo has no Dockerfile, so its `build:` cannot apply. Pin an
  # image built from the same source tree as the platform image above, so the sef-compiler's copy of
  # the static tree matches what is served.
  sef-compiler:
    image: atomgraph/linkeddatahub-sef-compiler:latest