services:
  maestro:
    build:
      context: .
      dockerfile: Dockerfile
    image: maestro:latest
    container_name: maestro
    restart: unless-stopped
    # Headed Chromium (display_mode: novnc) crashes with Docker's default 64MB
    # /dev/shm. Give it room so the Browser tab / InteractiveBrowse / CAPTCHA
    # pool work. Harmless when display_mode is headless.
    shm_size: "1gb"
    ports:
      # Published on ALL host interfaces so a Docker host is reachable from your
      # LAN out of the box (the common case for a headless server). Because the
      # agent API includes the Bash tool, an UNAUTHENTICATED instance on the
      # network is effectively remote code execution — so a FRESH install that
      # binds a non-loopback interface now boots WITH a login: it generates an
      # admin account and prints the password at startup (#1024, see
      # src/bridge/initial-admin.ts and docs/docker.md "Quick start"). That is
      # the floor, not a finished setup: also set `safety.bash_sandbox: always`
      # and terminate TLS before a shared/untrusted network. To keep it
      # local-only instead, change this to "127.0.0.1:9876:9876".
      - "9876:9876"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    # .env is optional: a bare `docker compose up --build` works with zero setup.
    # Put overrides here (OLLAMA_*, auth secrets, HOST, ...) to inject them into
    # the container — copy .env.example to .env and edit. `required: false` stops
    # a fresh clone (no .env) from failing with "env file .env not found".
    # Needs Docker Compose v2.24+ (Docker Desktop / recent WSL installs have it).
    env_file:
      - path: .env
        required: false
    environment:
      - NODE_ENV=production
      - PORT=9876
      - DB_PATH=/app/data/maestro.db
      - WORKTREE_DIR=/workspaces
    volumes:
      # アプリの状態 (DB / users / skills / secrets) を永続化。
      # アプリは WORKDIR /app からの相対 ./data に書くので /app/data にマウントする。
      - maestro-data:/app/data
      # エージェントワークスペース永続化
      - maestro-workspaces:/workspaces
      # config.yaml をホストから永続化したい場合は bind-mount (書き込み可)。
      # Settings UI / npm run setup で書き換えるなら :ro は付けないこと。
      # :ro を付けた新規インストールは、認証設定を書けないため起動を拒否する
      # (#1024)。bind-mount しない場合、コンテナを作り直すと config.yaml は
      # イメージの初期状態に戻る。認証だけは起動時に自動で復旧する。
      # - ./config.yaml:/app/config.yaml
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:9876/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

volumes:
  maestro-data:
    driver: local
  maestro-workspaces:
    driver: local