Stack de IA self-hosted em um droplet Digital Ocean de $40: Qdrant + Langfuse + LiteLLM + Redis

                         ┌──────────────────────────────────────────────┐
                         │   Droplet s-4vcpu-8gb ($40/month)            │
                         │                                              │
  Client (HTTPS) ───► Nginx ──► [ LiteLLM Proxy   :4000 ]               │
                         │         │                                    │
                         │         ├──► Anthropic / OpenAI / Gemini     │
                         │         │   (rate limit + fallback)          │
                         │         │                                    │
                         │         └──► Ollama :11434 (Llama 3.3 8B)    │
                         │                                              │
                         │      [ Qdrant :6333 ]  [ Redis :6379 ]       │
                         │                                              │
                         │      [ Langfuse Web :3000 ]                  │
                         │         └──► Langfuse Worker                 │
                         │         └──► Postgres :5432                  │
                         │         └──► ClickHouse :8123                │
                         │                                              │
                         │      [ Prometheus :9090 ] [ Grafana :3001 ]  │
                         │                                              │
                         │      Restic daemon ──► DO Spaces (S3)        │
                         └──────────────────────────────────────────────┘

version: "3.9"

networks:
  core:
    driver: bridge

volumes:
  qdrant_data:
  redis_data:
  ollama_data:
  lf_postgres:
  lf_clickhouse:
  lf_minio:
  prometheus_data:
  grafana_data:

services:
  # --- Reverse proxy ---
  nginx:
    image: nginx:1.27-alpine
    restart: unless-stopped
    ports: ["80:80", "443:443"]
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./certs:/etc/letsencrypt:ro
    networks: [core]
    depends_on: [litellm, langfuse-web, grafana]

  # --- Vector database ---
  qdrant:
    image: qdrant/qdrant:v1.12.5
    restart: unless-stopped
    volumes: [qdrant_data:/qdrant/storage]
    environment:
      QDRANT__SERVICE__API_KEY: ${QDRANT_API_KEY}
      QDRANT__STORAGE__PERFORMANCE__MAX_SEARCH_THREADS: 2
    networks: [core]
    deploy:
      resources:
        limits: { memory: 2g, cpus: "1.5" }

  # --- Semantic cache + working memory ---
  redis:
    image: redis/redis-stack-server:7.4.0-v1
    restart: unless-stopped
    command: >
      redis-stack-server
      --requirepass ${REDIS_PASSWORD}
      --maxmemory 1gb
      --maxmemory-policy allkeys-lru
    volumes: [redis_data:/data]
    networks: [core]
    deploy:
      resources:
        limits: { memory: 1200m, cpus: "0.75" }

  # --- Unified LLM gateway ---
  litellm:
    image: ghcr.io/berriai/litellm:main-stable
    restart: unless-stopped
    environment:
      LITELLM_MASTER_KEY: ${LITELLM_MASTER_KEY}
      DATABASE_URL: postgresql://lf:${LF_DB_PASSWORD}@langfuse-db:5432/litellm
      LANGFUSE_PUBLIC_KEY: ${LF_PUBLIC_KEY}
      LANGFUSE_SECRET_KEY: ${LF_SECRET_KEY}
      LANGFUSE_HOST: http://langfuse-web:3000
    volumes: [./litellm/config.yaml:/app/config.yaml:ro]
    command: ["--config", "/app/config.yaml", "--port", "4000"]
    networks: [core]
    depends_on: [langfuse-web, redis]
    deploy:
      resources:
        limits: { memory: 512m, cpus: "0.5" }

  # --- Local models ---
  ollama:
    image: ollama/ollama:0.5.4
    restart: unless-stopped
    volumes: [ollama_data:/root/.ollama]
    networks: [core]
    deploy:
      resources:
        limits: { memory: 5g, cpus: "2.5" }

  # --- Langfuse (observability) ---
  langfuse-db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: lf
      POSTGRES_PASSWORD: ${LF_DB_PASSWORD}
      POSTGRES_DB: langfuse
    volumes: [lf_postgres:/var/lib/postgresql/data]
    networks: [core]

  langfuse-clickhouse:
    image: clickhouse/clickhouse-server:24.8
    restart: unless-stopped
    environment:
      CLICKHOUSE_USER: lf
      CLICKHOUSE_PASSWORD: ${LF_CLICKHOUSE_PASSWORD}
      CLICKHOUSE_DB: langfuse
    volumes: [lf_clickhouse:/var/lib/clickhouse]
    networks: [core]

  langfuse-web:
    image: langfuse/langfuse:3
    restart: unless-stopped
    environment:
      DATABASE_URL: postgresql://lf:${LF_DB_PASSWORD}@langfuse-db:5432/langfuse
      CLICKHOUSE_URL: http://langfuse-clickhouse:8123
      CLICKHOUSE_USER: lf
      CLICKHOUSE_PASSWORD: ${LF_CLICKHOUSE_PASSWORD}
      REDIS_CONNECTION_STRING: redis://:${REDIS_PASSWORD}@redis:6379/1
      NEXTAUTH_URL: https://langfuse.${DOMAIN}
      NEXTAUTH_SECRET: ${LF_NEXTAUTH_SECRET}
      SALT: ${LF_SALT}
      ENCRYPTION_KEY: ${LF_ENCRYPTION_KEY}
    depends_on: [langfuse-db, langfuse-clickhouse, redis]
    networks: [core]

  langfuse-worker:
    image: langfuse/langfuse-worker:3
    restart: unless-stopped
    environment:
      DATABASE_URL: postgresql://lf:${LF_DB_PASSWORD}@langfuse-db:5432/langfuse
      CLICKHOUSE_URL: http://langfuse-clickhouse:8123
      CLICKHOUSE_USER: lf
      CLICKHOUSE_PASSWORD: ${LF_CLICKHOUSE_PASSWORD}
      REDIS_CONNECTION_STRING: redis://:${REDIS_PASSWORD}@redis:6379/1
      SALT: ${LF_SALT}
      ENCRYPTION_KEY: ${LF_ENCRYPTION_KEY}
    depends_on: [langfuse-web]
    networks: [core]

  # --- Metrics ---
  prometheus:
    image: prom/prometheus:v2.55.1
    restart: unless-stopped
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    networks: [core]

  grafana:
    image: grafana/grafana:11.3.1
    restart: unless-stopped
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD}
    volumes: [grafana_data:/var/lib/grafana]
    networks: [core]

  # --- Backups ---
  restic:
    image: mazzolino/restic:1.7.3
    restart: unless-stopped
    environment:
      RUN_ON_STARTUP: "false"
      BACKUP_CRON: "0 4 * * *"
      RESTIC_REPOSITORY: s3:${SPACES_ENDPOINT}/${SPACES_BUCKET}/restic
      RESTIC_PASSWORD: ${RESTIC_PASSWORD}
      AWS_ACCESS_KEY_ID: ${SPACES_KEY}
      AWS_SECRET_ACCESS_KEY: ${SPACES_SECRET}
      RESTIC_FORGET_ARGS: "--keep-daily 7 --keep-weekly 4 --keep-monthly 6"
    volumes:
      - qdrant_data:/mnt/qdrant:ro
      - lf_postgres:/mnt/lf_postgres:ro
      - lf_clickhouse:/mnt/lf_clickhouse:ro
      - redis_data:/mnt/redis:ro
    networks: [core]

model_list:
  - model_name: claude-sonnet
    litellm_params:
      model: anthropic/claude-sonnet-4-6
      api_key: os.environ/ANTHROPIC_API_KEY
  - model_name: claude-opus
    litellm_params:
      model: anthropic/claude-opus-4-7
      api_key: os.environ/ANTHROPIC_API_KEY
  - model_name: gpt-4o
    litellm_params:
      model: openai/gpt-4o
      api_key: os.environ/OPENAI_API_KEY
  - model_name: llama-local
    litellm_params:
      model: ollama/llama3.3:8b-instruct-q4_K_M
      api_base: http://ollama:11434

litellm_settings:
  cache: true
  cache_params:
    type: redis-semantic
    host: redis
    port: 6379
    password: os.environ/REDIS_PASSWORD
    similarity_threshold: 0.92
    ttl: 86400
  success_callback: ["langfuse"]
  failure_callback: ["langfuse"]

router_settings:
  routing_strategy: latency-based-routing
  fallbacks:
    - claude-sonnet: [gpt-4o, llama-local]
    - gpt-4o: [claude-sonnet, llama-local]

general_settings:
  master_key: os.environ/LITELLM_MASTER_KEY
  database_url: os.environ/DATABASE_URL

server {
  listen 443 ssl http2;
  server_name api.yourdomain.com;
  ssl_certificate     /etc/letsencrypt/live/api.yourdomain.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/api.yourdomain.com/privkey.pem;

  client_max_body_size 25m;

  location / {
    proxy_pass http://litellm:4000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 300s;
  }
}