infra: clean redeploy of Onyx on bart with latest images

Full wipe and fresh start: removed gitea_patch/unstructured_patch
hacks from startup commands, upgraded all onyxdotapp images from
nightly-latest-20260331 pin to :latest, removed UNSTRUCTURED_SERVER_URL
(service decommissioned 2026-04-14), added Watchtower disable labels
to ALL services (was missing on web_server, model_servers, db, cache,
opensearch, vespa, nginx), added nginx.conf for reverse proxy.

Alembic ran 349 migrations cleanly on fresh DB. All 10 containers up,
0 restarts, HTTP 200 at :3005.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

compose/bart/onyx/docker-compose.yml

@@ -1,10 +1,8 @@
 services:
   api_server:
-    image: onyxdotapp/onyx-backend:nightly-latest-20260331
+    image: onyxdotapp/onyx-backend:latest
     command: >
-      /bin/sh -c "python3 /mnt/gitea_patch/gitea_patch.py &&
-      python3 /mnt/gitea_patch/unstructured_patch.py &&
-      alembic upgrade head &&
+      /bin/sh -c "alembic upgrade head &&
       echo Starting Onyx API Server &&
       uvicorn onyx.main:app --host 0.0.0.0 --port 8080"
     depends_on:
@@ -29,23 +27,19 @@ services:
       - OPENSEARCH_HOST=opensearch
       - ENABLE_OPENSEARCH_INDEXING_FOR_ONYX=false
       - FILE_STORE_BACKEND=postgres
-      - UNSTRUCTURED_SERVER_URL=http://192.168.86.100:8000
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes:
       - onyx_file_connector:/home/file_connector_storage
-      - /mnt/docker-data/compose/bart/onyx:/mnt/gitea_patch:ro
     networks:
       - onyx
     labels:
       com.centurylinklabs.watchtower.enable: "false"
 
   background:
-    image: onyxdotapp/onyx-backend:nightly-latest-20260331
+    image: onyxdotapp/onyx-backend:latest
     command: >
-      /bin/sh -c "python3 /mnt/gitea_patch/gitea_patch.py &&
-      python3 /mnt/gitea_patch/unstructured_patch.py &&
-      /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf"
+      /bin/sh -c "/usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf"
     depends_on:
       relational_db:
         condition: service_healthy
@@ -68,12 +62,10 @@ services:
       - OPENSEARCH_HOST=opensearch
       - ENABLE_OPENSEARCH_INDEXING_FOR_ONYX=false
       - FILE_STORE_BACKEND=postgres
-      - UNSTRUCTURED_SERVER_URL=http://192.168.86.100:8000
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes:
       - onyx_file_connector:/home/file_connector_storage
-      - /mnt/docker-data/compose/bart/onyx:/mnt/gitea_patch:ro
     networks:
       - onyx
     labels:
@@ -93,6 +85,8 @@ services:
       - AUTH_TYPE=basic
     networks:
       - onyx
+    labels:
+      com.centurylinklabs.watchtower.enable: "false"
 
   inference_model_server:
     image: onyxdotapp/onyx-model-server:latest
@@ -108,6 +102,8 @@ services:
       - onyx_model_cache_huggingface:/root/.cache/huggingface/
     networks:
       - onyx
+    labels:
+      com.centurylinklabs.watchtower.enable: "false"
 
   indexing_model_server:
     image: onyxdotapp/onyx-model-server:latest
@@ -124,6 +120,8 @@ services:
       - onyx_model_cache_huggingface:/root/.cache/huggingface/
     networks:
       - onyx
+    labels:
+      com.centurylinklabs.watchtower.enable: "false"
 
   relational_db:
     image: postgres:15.2-alpine
@@ -142,6 +140,8 @@ services:
       interval: 10s
       timeout: 5s
       retries: 5
+    labels:
+      com.centurylinklabs.watchtower.enable: "false"
 
   index:
     image: vespaengine/vespa:8.609.39
@@ -158,6 +158,8 @@ services:
       timeout: 10s
       retries: 10
       start_period: 120s
+    labels:
+      com.centurylinklabs.watchtower.enable: "false"
 
   opensearch:
     image: opensearchproject/opensearch:2.11.1
@@ -179,6 +181,8 @@ services:
       timeout: 10s
       retries: 10
       start_period: 120s
+    labels:
+      com.centurylinklabs.watchtower.enable: "false"
 
   cache:
     image: redis:7.4-alpine
@@ -193,6 +197,8 @@ services:
       interval: 10s
       timeout: 5s
       retries: 5
+    labels:
+      com.centurylinklabs.watchtower.enable: "false"
 
   nginx:
     image: nginx:1.25.5-alpine
@@ -208,6 +214,8 @@ services:
       - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
     networks:
       - onyx
+    labels:
+      com.centurylinklabs.watchtower.enable: "false"
 
 volumes:
   onyx_file_connector:

compose/bart/onyx/nginx.conf

@@ -0,0 +1,37 @@
+upstream api {
+    server api_server:8080;
+}
+
+upstream web {
+    server web_server:3000;
+}
+
+server {
+    listen 80;
+    server_name _;
+
+    client_max_body_size 100M;
+
+    location /api {
+        proxy_pass http://api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_connect_timeout 75s;
+        # SSE support
+        proxy_buffering off;
+        proxy_cache off;
+    }
+
+    location / {
+        proxy_pass http://web;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_connect_timeout 75s;
+    }
+}