feat(chore): impelmented seecret generation

docker-compose.yml

@@ -56,26 +56,35 @@ services:
       - qdrant-data:/qdrant/storage
     restart: unless-stopped
     networks: [ai-stack]
+    healthcheck:
+      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/localhost/6333'"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   open-webui:
     image: ghcr.io/open-webui/open-webui:main
     container_name: open-webui
     depends_on:
-      - qdrant
-      - litellm
+      qdrant:
+        condition: service_healthy
+      litellm:
+        condition: service_healthy
     volumes:
       - openwebui-data:/app/backend/data
+    env_file: .env
     environment:
       - WEBUI_AUTH=True
       # Routed through the litellm proxy, not llama-server directly — see issue #15.
       # OPENAI_API_KEY must be a virtual key created for Open WebUI per
-      # docs/proxy-key-onboarding.md (name it "openwebui"), set in .env.
+      # docs/proxy-key-onboarding.md (name it "openwebui"), set as
+      # OPENWEBUI_LITELLM_KEY in .env.
       - OPENAI_API_BASE_URL=http://litellm:4000/v1
-      - OPENAI_API_KEY=${OPENWEBUI_LITELLM_KEY:?set to the openwebui virtual key from LiteLLM's Admin UI}
+      - OPENAI_API_KEY=${OPENWEBUI_LITELLM_KEY}
       - VECTOR_DB=qdrant
       - QDRANT_URI=http://qdrant:6333
     ports:
-      - "${WEBUI_PORT:-3000}:8080"
+      - "${WEBUI_PORT:-8008}:8080"
     restart: unless-stopped
     networks: [ai-stack]
 
@@ -83,14 +92,18 @@ services:
     image: ghcr.io/berriai/litellm:main-stable
     container_name: litellm
     depends_on:
-      - litellm-db
-      - llama-server
+      litellm-db:
+        condition: service_healthy
+      llama-server:
+        condition: service_started
     volumes:
       - ./litellm-config.yaml:/app/config.yaml:ro
+    # LITELLM_MASTER_KEY / LITELLM_SALT_KEY come straight from .env via env_file
+    # (names match what litellm reads). LITELLM_SALT_KEY must not change after
+    # first run — see .env.example.
+    env_file: .env
     environment:
-      - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY:?set a real master key in .env — see docs/proxy-key-onboarding.md}
-      - LITELLM_SALT_KEY=${LITELLM_SALT_KEY:?set a real salt key in .env, do not change after first run}
-      - DATABASE_URL=postgresql://litellm:${LITELLM_DB_PASSWORD:-litellm}@litellm-db:5432/litellm
+      - DATABASE_URL=postgresql://litellm:${LITELLM_DB_PASSWORD}@litellm-db:5432/litellm
     command: ["--config", "/app/config.yaml", "--port", "4000"]
     ports:
       # published for LAN access (proxy.ai.home) and, via NPM, proxy.ai.haylan.ch —
@@ -98,18 +111,32 @@ services:
       - "${LITELLM_PORT:-4000}:4000"
     restart: unless-stopped
     networks: [ai-stack]
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - python3 -c "import urllib.request; urllib.request.urlopen('http://localhost:4000/health/liveliness')"
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
 
   litellm-db:
     image: postgres:16-alpine
     container_name: litellm-db
+    env_file: .env
     environment:
       - POSTGRES_USER=litellm
-      - POSTGRES_PASSWORD=${LITELLM_DB_PASSWORD:-litellm}
+      - POSTGRES_PASSWORD=${LITELLM_DB_PASSWORD}
       - POSTGRES_DB=litellm
     volumes:
       - litellm-db-data:/var/lib/postgresql/data
     restart: unless-stopped
     networks: [ai-stack]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d litellm -U litellm"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
 
   lazytainer:
     image: ghcr.io/vmorganp/lazytainer:master