merge

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:18-bullseye
+FROM node:24.16.0-bullseye
 
 RUN useradd -m -s /bin/bash vscode
 RUN mkdir -p /workspaces && chown -R vscode:vscode /workspaces

.devcontainer/docker-compose.yml

@@ -20,8 +20,7 @@ services:
     environment:
       - HOST=0.0.0.0
       - MONGO_URI=mongodb://mongodb:27017/LibreChat
-      # - CHATGPT_REVERSE_PROXY=http://host.docker.internal:8080/api/conversation # if you are hosting your own chatgpt reverse proxy with docker
-      # - OPENAI_REVERSE_PROXY=http://host.docker.internal:8070/v1/chat/completions # if you are hosting your own chatgpt reverse proxy with docker
+      # - OPENAI_REVERSE_PROXY=http://host.docker.internal:8070/v1
       - MEILI_HOST=http://meilisearch:7700
 
     # Runs app on the same network as the service container, allows "forwardPorts" in devcontainer.json function.

.do/gitnexus/Caddyfile

@@ -0,0 +1,25 @@
+# Caddy reverse proxy with bearer token auth and automatic HTTPS.
+# The domain is supplied via environment variable GITNEXUS_DOMAIN,
+# and the auth token via API_TOKEN. Both are set in docker-compose.yml.
+
+{$GITNEXUS_DOMAIN} {
+	# Health check — unauthenticated so monitoring can probe it
+	@health path /health
+	handle @health {
+		reverse_proxy gitnexus:4747 {
+			rewrite /api/info
+		}
+	}
+
+	# All other routes require bearer token
+	@authed {
+		header Authorization "Bearer {$API_TOKEN}"
+	}
+
+	handle @authed {
+		reverse_proxy gitnexus:4747
+	}
+
+	# Reject unauthenticated requests
+	respond "Unauthorized" 401
+}

.do/gitnexus/Dockerfile

@@ -0,0 +1,46 @@
+# Long-lived GitNexus image for DigitalOcean droplet deployment.
+#
+# This image does NOT bake in the index data. Indexes are mounted from
+# the host at /indexes/<repo>/.gitnexus/ and registered at container
+# startup. A fresh index only requires rsync + container restart — no
+# image rebuild on every push.
+
+FROM node:24.16.0-slim
+
+ARG GITNEXUS_VERSION=1.6.7
+# Pin the native DB to match the index workflow; gitnexus's ^0.17.0 range
+# would otherwise let the served image drift from the CI-produced index.
+ARG LADYBUG_VERSION=0.17.1
+
+# 1. Build native addons with Bookworm toolchain, then remove build tools.
+#    curl stays for the docker healthcheck; Caddy lives in its own container.
+#    LadybugDB is pinned nested under gitnexus so step 3's require() resolves it.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends python3 make g++ curl \
+    && npm install -g gitnexus@${GITNEXUS_VERSION} \
+    && npm install --no-save --prefix /usr/local/lib/node_modules/gitnexus "@ladybugdb/core@${LADYBUG_VERSION}" \
+    && apt-get purge -y --auto-remove python3 make g++ \
+    && rm -rf /var/lib/apt/lists/* /root/.npm
+
+# 2. Upgrade libstdc++ from Trixie — @ladybugdb/core prebuilt binary needs
+#    GLIBCXX_3.4.32 which Bookworm (3.4.31) doesn't ship.
+RUN echo "deb http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.d/trixie.list \
+    && apt-get update \
+    && apt-get install -y -t trixie libstdc++6 \
+    && rm /etc/apt/sources.list.d/trixie.list \
+    && rm -rf /var/lib/apt/lists/*
+
+# 3. Pre-install LadybugDB FTS + vector extensions so ~/.kuzu/extension/
+#    is baked into the image. gitnexus serve loads extensions with a
+#    load-only policy and never installs them at runtime, so the cache
+#    must already exist. (GitNexus loads the vector extension itself
+#    via loadVectorExtension — no adapter patch needed.)
+COPY install-extensions.js /tmp/install-extensions.js
+RUN node /tmp/install-extensions.js && rm -rf /tmp/install-extensions.js /tmp/lbug-ext-install
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 4747
+
+ENTRYPOINT ["/entrypoint.sh"]

.do/gitnexus/docker-compose.yml

@@ -0,0 +1,87 @@
+# GitNexus stack for the DigitalOcean droplet.
+#
+# Two services: the gitnexus server (bound to an internal network only)
+# and a Caddy reverse proxy that handles TLS + auth.
+#
+# Index data lives on the host at /opt/gitnexus/indexes/ and is
+# bind-mounted read-write into the gitnexus container. The deploy
+# workflow rsyncs fresh indexes into that directory and restarts
+# only the gitnexus container — Caddy keeps running undisturbed.
+#
+# Break-glass: if gitnexus is stuck unhealthy and you need to restart
+# just Caddy (e.g. to push an emergency Caddyfile fix), the
+# `depends_on: condition: service_healthy` would block:
+#     docker compose up -d caddy
+# Use --no-deps to bypass the dependency check:
+#     docker compose up -d --no-deps caddy
+
+name: gitnexus
+
+# Shared logging defaults applied to both services so the droplet's
+# disk doesn't fill up with unbounded json-file logs.
+x-logging: &default-logging
+  driver: json-file
+  options:
+    max-size: '50m'
+    max-file: '3'
+
+services:
+  gitnexus:
+    # Override via GITNEXUS_IMAGE in /opt/gitnexus/.env to use a fork or
+    # a pinned version tag like :v1.5.3 for reproducible rollbacks.
+    image: ${GITNEXUS_IMAGE:-ghcr.io/danny-avila/librechat-gitnexus:latest}
+    container_name: gitnexus
+    restart: unless-stopped
+    networks:
+      - gitnexus-net
+    volumes:
+      - /opt/gitnexus/indexes:/indexes
+    # memswap_limit equal to mem_limit disables swap for this container.
+    # Without it, Docker lets the process silently swap onto host disk,
+    # turning sub-second graph queries into multi-second ones. Hard
+    # OOM-kill is preferable — the container restarts via unless-stopped,
+    # the deploy health poll catches it, and the failure is explicit.
+    mem_limit: 1792m
+    memswap_limit: 1792m
+    logging: *default-logging
+    healthcheck:
+      test: ['CMD', 'curl', '-fsS', 'http://127.0.0.1:4747/api/info']
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 60s
+
+  caddy:
+    image: caddy:2-alpine
+    container_name: gitnexus-caddy
+    restart: unless-stopped
+    # service_healthy (not just service_started) ensures Caddy doesn't
+    # start routing traffic until gitnexus passes its initial healthcheck
+    # on a cold `compose up`. This only governs initial startup ordering —
+    # during force-recreates of gitnexus, Caddy stays up and may briefly
+    # return 502 while the new gitnexus container binds its port. The
+    # deploy workflow's health poll catches any sustained failure.
+    depends_on:
+      gitnexus:
+        condition: service_healthy
+    ports:
+      - '80:80'
+      - '443:443'
+    networks:
+      - gitnexus-net
+    volumes:
+      - /opt/gitnexus/Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+    logging: *default-logging
+    environment:
+      GITNEXUS_DOMAIN: ${GITNEXUS_DOMAIN}
+      API_TOKEN: ${API_TOKEN}
+
+networks:
+  gitnexus-net:
+    driver: bridge
+
+volumes:
+  caddy-data:
+  caddy-config:

.do/gitnexus/entrypoint.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+set -e
+
+# Cap Node heap below the container's cgroup limit (1792m in compose),
+# leaving room for @ladybugdb/core's C++ heap and OS overhead. Native
+# allocations happen outside V8's view, so a slim V8 budget is the only
+# thing between a heavy query and a cgroup OOM-kill. Without this cap,
+# gitnexus defaults to --max-old-space-size=8192 and reserves memory
+# the container doesn't have.
+export NODE_OPTIONS="${NODE_OPTIONS:---max-old-space-size=1280}"
+
+# Register every index mounted under /indexes/<name>/.gitnexus/.
+# This is idempotent — re-registering an existing repo updates the
+# metadata pointer without touching the index data.
+#
+# Registration failure handling:
+#   - main (LibreChat) and dev (LibreChat-dev) are critical. If either
+#     fails to register, exit 1 so docker marks the container unhealthy
+#     and the deploy workflow's readiness check surfaces the error.
+#   - PR indexes (LibreChat-pr-*) are best-effort. A corrupt PR index
+#     shouldn't take the whole server down.
+if [ -d /indexes ]; then
+  for dir in /indexes/*/; do
+    [ -d "$dir" ] || continue
+    name=$(basename "$dir")
+    [ -d "$dir.gitnexus" ] || continue
+    echo "Registering index: $name"
+    if ! gitnexus index "$dir" --allow-non-git; then
+      case "$name" in
+        LibreChat|LibreChat-dev)
+          echo "ERROR: failed to register critical index $name" >&2
+          exit 1
+          ;;
+        *)
+          echo "WARN: failed to register PR index $name — skipping" >&2
+          ;;
+      esac
+    fi
+  done
+else
+  echo "WARN: /indexes directory not mounted" >&2
+fi
+
+# Bind 0.0.0.0 inside the container so Caddy (in a separate container
+# on the same docker network) can reach gitnexus at gitnexus:4747.
+# docker-compose.yml intentionally does NOT expose port 4747 on the
+# host — only Caddy's 80/443 are published.
+exec gitnexus serve --host 0.0.0.0 --port 4747

.do/gitnexus/install-extensions.js

@@ -0,0 +1,46 @@
+/**
+ * Pre-install LadybugDB extensions (FTS + vector) into the Docker image's
+ * extension cache (~/.kuzu/extension/). Without this, gitnexus serve's
+ * lbug-adapter calls LOAD EXTENSION fts at runtime but fails silently
+ * because the extension was never installed, causing all BM25 and
+ * semantic queries via the query() tool to return empty.
+ *
+ * Workaround for upstream GitNexus 1.5.3 bug where the CI-produced
+ * .gitnexus/ artifact doesn't include the extension cache.
+ */
+
+const path = require('path');
+const fs = require('fs');
+
+// @ladybugdb/core lives under the globally-installed gitnexus package.
+// This path is stable across gitnexus versions because npm always nests
+// transitive deps under the installed package's node_modules.
+const lbugPath = '/usr/local/lib/node_modules/gitnexus/node_modules/@ladybugdb/core';
+const lbug = require(lbugPath);
+
+const tmpDir = '/tmp/lbug-ext-install';
+fs.mkdirSync(tmpDir, { recursive: true });
+
+// Open a throwaway database just to run INSTALL against. The extension
+// cache persists in ~/.kuzu/extension/ regardless of which database was
+// used to install it, so the throwaway db and tmpDir are deleted in the
+// Dockerfile after this script finishes.
+const db = new lbug.Database(path.join(tmpDir, 'db'), 0, false, false);
+const conn = new lbug.Connection(db);
+
+(async () => {
+  try {
+    await conn.query('INSTALL fts');
+    console.log('FTS extension installed');
+  } catch (err) {
+    console.error('FTS install failed:', err.message);
+    process.exit(1);
+  }
+  try {
+    await conn.query('INSTALL vector');
+    console.log('Vector extension installed');
+  } catch (err) {
+    console.error('Vector install failed:', err.message);
+    process.exit(1);
+  }
+})();