[integrations] Run Open Brain locally via docker-compose (no Supabase, Ollama)

[moisei]

What

Run Open Brain fully locally via docker compose — three containers, one command, no cloud accounts required:

docker compose up -d

• db — pgvector/pgvector:pg16 (Postgres + pgvector extension)
• ollama — local AI: mxbai-embed-large (1024-dim embeddings) + gemma3:4b (metadata extraction)
• server — the Deno MCP server

All data (Postgres + Ollama models) stored as bind-mounts under docker/openbrain-data/ on the host filesystem — survives docker-compose down, no dependency on Docker's internal volume storage.

---

Why Supabase was removed

The upstream stack uses @supabase/supabase-js in the server, which requires the full Supabase service bundle: PostgREST + Kong API gateway + GoTrue auth + realtime + storage — even though Open Brain only ever uses the database (one table, two SQL functions). Running that bundle locally via supabase start adds ~4–5 Docker containers, a JWT to manage, and a PostgREST REST layer just to reach Postgres.

By connecting the server directly to Postgres (replacing supabase.rpc/.from calls with deno-postgres + raw SQL), the stack collapses to three containers and removes all the Supabase plumbing. The SQL functions (match_thoughts, upsert_thought) are unchanged — only the client layer changes.

---

How — a db.ts data-access seam

Rather than forking a third copy of the server, this mirrors the existing llm.ts pattern: a thin seam with two drivers selected by DB_DRIVER env var.

• supabase (default) — wraps the existing supabase.rpc/.from calls verbatim. Zero behavior change for the upstream/Supabase path — existing deploys are unaffected.
• postgres — deno-postgres Pool calling the same SQL functions (match_thoughts, upsert_thought) for identical semantics. Direct SELECT/UPDATE for list/stats/fetch.

All local-deploy features are preserved: dedup via upsert_thought content fingerprint, date-injected metadata prompt, chat-error surfacing.

---

Docker artifacts (docker/)

File	Purpose
docker-compose.yml	db + ollama + ollama-pull (one-shot model downloader gates server start) + server
Dockerfile	Deno image; full deno cache index.ts at build + --cached-only runtime — hermetic, no network at runtime
docker-bake.hcl	Multiarch build: linux/amd64 + linux/arm64
init/01-init.sql	Canonical schema: uuid, content_fingerprint, upsert_thought, match_thoughts, vector(1024)
.env.example	Non-secret config (committed)
.env.secrets.example	Secret template — MCP_ACCESS_KEY + POSTGRES_PASSWORD (real file gitignored)
README.md	User guide: prerequisites → up → smoke test → wire MCP client
DEVELOPING.md	Developer guide: db.ts seam, multiarch bake, dimension constraint, remote-chat opt-in

docker/openbrain-data/ is gitignored — Docker creates it on first up.

---

TLS proxy note

deno install inside the build container fails behind a TLS-intercepting corporate proxy because the base image doesn't trust the proxy's CA. The Dockerfile supports an optional BuildKit CA build-secret (--secret id=ca,src=corp-ca.pem) that is passed to deno install and deno cache but never baked into the image. Without the secret, the build behaves normally on a clean network. The same pattern is wired through docker-bake.hcl (CA_CERT=) and docker-compose.yml (CA_CERT_FILE=).

---

Verified end-to-end

• deno check clean; db_test.ts shape tests pass (postgres integration tests gated on live DB)
• Image builds (native + multiarch bake)
• docker compose up → capture (metadata via gemma3:4b), semantic search (76–85% match via mxbai-embed-large + pgvector), dedup (re-capture stays 1 row via fingerprint upsert), vectors are 1024-dim
• Data persists in docker/openbrain-data/ on host after docker-compose down
• Connected from Claude Code (native HTTP MCP) and Claude Desktop (mcp-remote bridge)

[github-actions]

Hey @moisei — welcome to Open Brain Source! 👋

Thanks for submitting your first PR. The automated review will run shortly and check things like metadata, folder structure, and README completeness. If anything needs fixing, the review comment will tell you exactly what.

Once the automated checks pass, a human admin will review for quality and clarity. Expect a response within a few days.

If you have questions, check out CONTRIBUTING.md or open an issue.