hissih/layers repository overview

sudo apt install nginx certbot python3-certbot-nginx

sudo certbot certonly --nginx -d example.com -d www.example.com

server {
    listen 80;
    server_name example.com;
    location /.well-known/acme-challenge/ { root /var/www/certbot; }
    location / { return 301 https://example.com$request_uri; }
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 300;
    }
}

sudo ln -s /etc/nginx/sites-available/layers.conf /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

# WebSocket signaling
location /livekit/ {
    proxy_pass http://127.0.0.1:7880/;   # trailing slash matters
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_read_timeout 86400s;
}

# LiveKit REST API — backend SDK hits /twirp/ on root, not under /livekit/
location /twirp/ {
    proxy_pass http://127.0.0.1:7880/twirp/;
    proxy_set_header Host $host;
    proxy_read_timeout 86400s;
}

ufw allow 7881/tcp
ufw allow 50000:50100/udp

# Add to layers service environment:
MAIL_PROVIDER: smtp                           # Enable SMTP email
SPRING_MAIL_HOST: smtp.gmail.com              # Your SMTP server
SPRING_MAIL_PORT: "587"                       # SMTP port (587 for STARTTLS, 465 for SSL)
SPRING_MAIL_USERNAME: [email protected]     # SMTP login
SPRING_MAIL_PASSWORD: your-app-password       # SMTP password (use app-specific password for Gmail)
SPRING_MAIL_SMTP_AUTH: "true"                 # Enable authentication
SPRING_MAIL_SMTP_STARTTLS_ENABLE: "true"      # Enable STARTTLS (port 587)
# SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE: "true"  # Use instead of STARTTLS for port 465
# APP_MAIL_FROM: [email protected]          # Sender address (defaults to SMTP username)

MAIL_PROVIDER: sendgrid
SENDGRID_API_KEY: SG.xxxxx                    # Your SendGrid API key
SENDGRID_FROM: [email protected]            # Sender address

MAIL_PROVIDER: mailchimp
MAILCHIMP_API_KEY: md-xxxxx                   # Mandrill API key

GOOGLE_AUTH_ENABLED: "true"                              # Must be set to enable the login button
GOOGLE_CLIENT_ID: 123...apps.googleusercontent.com      # OAuth client ID
GOOGLE_CLIENT_SECRET: GOCSPX-...                        # OAuth client secret
GOOGLE_REDIRECT_URI: https://example.com/auth/google/callback  # Must match Google Console

AI_ENABLED: "true"                            # Enable AI features
AI_PROVIDER: openai                           # openai (default) | ollama | custom
OPENAI_API_KEY: sk-proj-xxxxx                 # Your API key
OPENAI_MODEL: gpt-4o-mini                     # Model name (default: gpt-4o-mini)

ollama:
  image: ollama/ollama:latest
  volumes:
    - ollama_data:/root/.ollama

docker compose up -d
docker exec layers-ollama-1 ollama pull qwen2.5:0.5b

AI_ENABLED: "true"
AI_PROVIDER: ollama
OLLAMA_URL: http://ollama:11434               # Default if using Docker Compose service name
OPENAI_MODEL: qwen2.5:0.5b                    # Model to use (must be pulled first)

YANDEX_AUTH_ENABLED: "true"
YANDEX_CLIENT_ID: your-client-id
YANDEX_CLIENT_SECRET: your-client-secret
YANDEX_REDIRECT_URI: https://example.com/auth/yandex/callback

VK_AUTH_ENABLED: "true"
VK_CLIENT_ID: "51234567"
VK_CLIENT_SECRET: your-secure-key
VK_REDIRECT_URI: https://example.com/auth/vk/callback

ESIA_AUTH_ENABLED: "true"
ESIA_CLIENT_ID: YOUR_SYSTEM_MNEMONIC
ESIA_REDIRECT_URI: https://example.com/auth/esia/callback
ESIA_CERT_PATH: /path/to/certificate.p12
ESIA_CERT_PASSWORD: your-cert-password

UNSPLASH_ENABLED: "true"                      # Must be set to enable image search
UNSPLASH_ACCESS_KEY: your-key                 # Get at unsplash.com/developers

GIPHY_ENABLED: "true"                         # Must be set to enable GIF search
GIPHY_API_KEY: your-key                       # Get at developers.giphy.com

FILE_STORAGE_TYPE: S3                         # Switch from LOCAL to S3
USE_AWS: "true"                               # Enable AWS SDK
S3_BUCKET_NAME: my-bucket                     # S3 bucket name
S3_REGION: eu-central-1                       # AWS region
S3_ACCESS_KEY: AKIA...                        # AWS access key
S3_SECRET_KEY: your-secret                    # AWS secret key

SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE: "2GB"
SPRING_SERVLET_MULTIPART_MAX_REQUEST_SIZE: "2GB"

SEARCH_ELASTICSEARCH_ENABLED: "true"
ES_HOST: elasticsearch                        # Elasticsearch host
ES_PORT: "9200"                               # Elasticsearch port
ES_USERNAME: elastic                          # Auth username (if enabled)
ES_PASSWORD: changeme                         # Auth password (if enabled)

USE_SENTRY: "true"                                    # Required to enable error reporting
SENTRY_DSN: https://[email protected]/456    # Sentry DSN
SENTRY_ENVIRONMENT: production                        # Environment tag
SENTRY_TRACES_SAMPLE_RATE: "0.1"                     # % of requests traced (default: 0.0 = disabled)

FRONTEND_ANALYTICS_YANDEX_METRIKA_ID: "12345"     # Yandex.Metrika counter
FRONTEND_ANALYTICS_GTM_ID: GTM-XXXXXXX            # Google Tag Manager

FRONTEND_APP_NAME: "My Company"                       # App name shown in UI
FRONTEND_APP_URL: https://app.company.com             # App URL for emails
FRONTEND_LOGO_FULL_URL: https://cdn.company.com/logo.png   # Full logo URL
FRONTEND_LOGO_ICON_URL: https://cdn.company.com/icon.png   # Icon/favicon URL

FRONTEND_SOCIAL_FACEBOOK: https://facebook.com/mypage
FRONTEND_SOCIAL_INSTAGRAM: https://instagram.com/mypage
FRONTEND_SOCIAL_LINKEDIN: https://linkedin.com/company/myco
FRONTEND_SOCIAL_TELEGRAM: https://t.me/mychannel
FRONTEND_SOCIAL_DISCORD: https://discord.gg/myinvite
FRONTEND_SOCIAL_WHATSAPP: https://wa.me/123456789

DB_SERVER_URL: jdbc:postgresql://your-host:5432/your_db  # Your database JDBC URL
DB_SERVER_USERNAME: your_user                             # Database user
DB_SERVER_PASSWORD: your_password                         # Database password

# Add as a separate service:
layers-mcp:
  image: sinups/layers-mcp-server:latest
  depends_on:
    - layers
  environment:
    LAYERS_BACKEND_BASEURL: http://layers:8080
    LAYERS_BACKEND_FORWARDINCOMINGAUTH: "true"
    LAYERS_BACKEND_REQUIREINCOMINGAUTH: "true"
    SERVER_PORT: "8091"

LAYERS_SELLER: "true"                                    # Enable Distribution in Godmode
LAYERS_REGION: "EU"                                      # Region code (EU, RU, US) — affects social links
LAYERS_DOWNLOAD_DESKTOP_ENABLED: "true"                  # Show /download page
LAYERS_DOWNLOAD_DESKTOP_MAC_URL: https://cdn.example.com/Layers.dmg
LAYERS_DOWNLOAD_DESKTOP_WIN_URL: https://cdn.example.com/Layers-Setup.exe
LAYERS_DOWNLOAD_DESKTOP_LINUX_URL: https://cdn.example.com/Layers.AppImage
LAYERS_DOWNLOAD_SELFHOST_ENABLED: "true"                 # Show /download-install page
LAYERS_DOWNLOAD_SELFHOST_TAR_GZ_URL: /files/layers-server-latest.tar.gz
LAYERS_DOWNLOAD_SELFHOST_TAR_URL: /files/layers-server-latest.tar

docker compose down -v
docker compose up -d

docker exec -it layers-db-1 psql -U postgres -c "ALTER USER layers PASSWORD 'your_new_password'"

docker compose logs layers

docker exec -it layers-db-1 psql -U layers -d layersdb \
  -c "ALTER TABLE workspaces DROP CONSTRAINT IF EXISTS workspaces_plan_check;"
docker compose restart layers

docker compose logs layers --tail=20

client_max_body_size 1000m;