Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 92 additions & 0 deletions blueprints/simstudio/docker-compose.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
version: "3.8"

services:
simstudio:
image: ghcr.io/simstudioai/simstudio:latest
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unpinned Docker image tags

All three custom images (simstudio, realtime, migrations) use the :latest tag instead of a pinned version. Per the repository's AGENTS.md guidelines: "Pin Docker images to specific versions to avoid supply chain attacks." While :latest is used by many existing templates in this repo, pinning to a specific release tag (e.g., ghcr.io/simstudioai/simstudio:v1.0.0) would improve reproducibility and protect against unexpected breaking changes.

Note: The pgvector/pgvector:pg17 image is appropriately version-pinned.

Context Used: Context from dashboard - AGENTS.md (source)

restart: unless-stopped
expose:
- 3000
deploy:
resources:
limits:
memory: 8G
environment:
- NODE_ENV=production
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
- BETTER_AUTH_URL=${BETTER_AUTH_URL:-http://localhost:3000}
- NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
- BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-your_auth_secret_here}
- ENCRYPTION_KEY=${ENCRYPTION_KEY:-your_encryption_key_here}
Comment on lines +18 to +19
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Insecure default secrets in fallbacks

The default fallback values for BETTER_AUTH_SECRET and ENCRYPTION_KEY are weak placeholder strings. While template.toml correctly generates proper secrets via ${base64:32}, if anyone uses this docker-compose.yml directly (without Dokploy's template injection), these insecure defaults would be active. Consider using empty strings as defaults to force explicit configuration, similar to how COPILOT_API_KEY on line 20 already uses an empty default.

Context Used: Context from dashboard - AGENTS.md (source)

- COPILOT_API_KEY=${COPILOT_API_KEY:-}
- SIM_AGENT_API_URL=${SIM_AGENT_API_URL:-}
- OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}
- SOCKET_SERVER_URL=http://realtime:3002
- NEXT_PUBLIC_SOCKET_URL=${NEXT_PUBLIC_SOCKET_URL:-http://localhost:3002}
- DEFAULT_ADMIN_EMAIL=${DEFAULT_ADMIN_EMAIL:-admin@example.com}
- DEFAULT_ADMIN_PASSWORD=${DEFAULT_ADMIN_PASSWORD:-admin123}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Weak default admin password

The fallback value for DEFAULT_ADMIN_PASSWORD is a trivially guessable string. The template.toml generates a proper 16-character random password via ${password:16}, but if the compose file is used standalone, the weak default would create an insecure deployment. Consider using an empty default to force explicit configuration.

Context Used: Context from dashboard - AGENTS.md (source)

depends_on:
db:
condition: service_healthy
migrations:
condition: service_completed_successfully
realtime:
condition: service_healthy
healthcheck:
test: ['CMD-SHELL', 'wget --spider --quiet http://127.0.0.1:3000 || curl -f http://127.0.0.1:3000 || exit 1']
interval: 30s
timeout: 10s
retries: 5
start_period: 60s

realtime:
image: ghcr.io/simstudioai/realtime:latest
restart: unless-stopped
expose:
- 3002
deploy:
resources:
limits:
memory: 4G
environment:
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
- NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
- BETTER_AUTH_URL=${BETTER_AUTH_URL:-http://localhost:3000}
- BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-your_auth_secret_here}
depends_on:
db:
condition: service_healthy
healthcheck:
test: ['CMD-SHELL', 'wget --spider --quiet http://127.0.0.1:3002/health || curl -f http://127.0.0.1:3002/health || exit 1']
interval: 30s
timeout: 10s
retries: 5
start_period: 60s

migrations:
image: ghcr.io/simstudioai/migrations:latest
working_dir: /app/packages/db
environment:
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
depends_on:
db:
condition: service_healthy
command: ['bun', 'run', 'db:migrate']
restart: 'no'

db:
image: pgvector/pgvector:pg17
restart: unless-stopped
environment:
- POSTGRES_USER=${POSTGRES_USER:-postgres}
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
- POSTGRES_DB=${POSTGRES_DB:-simstudio}
volumes:
- postgres_data:/var/lib/postgresql/data
healthcheck:
test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-postgres}']
interval: 10s
timeout: 5s
retries: 5

volumes:
postgres_data:
Binary file added blueprints/simstudio/sim.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
41 changes: 41 additions & 0 deletions blueprints/simstudio/template.toml
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
[variables]
main_domain = "${domain}"
realtime_domain = "ws.${domain}"
app_protocol = "https"
postgres_user = "postgres"
postgres_password = "${password:32}"
postgres_db = "simstudio"
auth_secret = "${base64:32}"
encryption_key = "${base64:32}"
copilot_api_key = ""
sim_agent_api_url = ""
ollama_url = "http://localhost:11434"
default_admin_email = "${email}"
default_admin_password = "${password:16}"

[config]
env = [
"POSTGRES_USER=${postgres_user}",
"POSTGRES_PASSWORD=${postgres_password}",
"POSTGRES_DB=${postgres_db}",
"NEXT_PUBLIC_APP_URL=${app_protocol}://${main_domain}",
"BETTER_AUTH_URL=${app_protocol}://${main_domain}",
"NEXT_PUBLIC_SOCKET_URL=${app_protocol}://${realtime_domain}",
"BETTER_AUTH_SECRET=${auth_secret}",
"ENCRYPTION_KEY=${encryption_key}",
"COPILOT_API_KEY=${copilot_api_key}",
"SIM_AGENT_API_URL=${sim_agent_api_url}",
"OLLAMA_URL=${ollama_url}",
"DEFAULT_ADMIN_EMAIL=${default_admin_email}",
"DEFAULT_ADMIN_PASSWORD=${default_admin_password}"
]

[[config.domains]]
serviceName = "simstudio"
port = 3000
host = "${main_domain}"

[[config.domains]]
serviceName = "realtime"
port = 3002
host = "${realtime_domain}"
19 changes: 19 additions & 0 deletions meta.json
Original file line number Diff line number Diff line change
Expand Up @@ -5468,6 +5468,25 @@
"markdown"
]
},
{
"id": "simstudio",
"name": "SimAi",
"version": "latest",
"description": "Sim ai is an open-source AI agent workflow platform that enables building and deploying intelligent automation workflows with real-time capabilities.",
"logo": "sim.png",
"links": {
"github": "https://github.com/simstudioai/simstudio",
"website": "https://simstudio.ai",
"docs": "https://docs.simstudio.ai"
},
"tags": [
"ai",
"automation",
"workflow",
"agents",
"real-time"
]
},
{
"id": "slash",
"name": "Slash",
Expand Down