services:
  maestro:
    build:
      context: .
      dockerfile: Dockerfile
    image: maestro:latest
    container_name: maestro
    restart: unless-stopped
    # Headed Chromium (display_mode: novnc) crashes with Docker's default 64MB
    # /dev/shm. Give it room so the Browser tab / InteractiveBrowse / CAPTCHA
    # pool work. Harmless when display_mode is headless.
    shm_size: "1gb"
    ports:
      # Published on ALL host interfaces so a Docker host is reachable from your
      # LAN out of the box (the common case for a headless server). This means a
      # fresh instance is exposed: the agent API includes the Bash tool, so an
      # UNAUTHENTICATED instance on the network is effectively remote code
      # execution. Before leaving it up on a shared/untrusted network, enable
      # auth (`auth` in config.yaml), `safety.bash_sandbox: always`, and TLS —
      # see docs/docker.md "Going beyond localhost". To keep it local-only
      # instead, change this to "127.0.0.1:9876:9876".
      - "9876:9876"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    # .env is optional: a bare `docker compose up --build` works with zero setup.
    # Put overrides here (OLLAMA_*, auth secrets, HOST, ...) to inject them into
    # the container — copy .env.example to .env and edit. `required: false` stops
    # a fresh clone (no .env) from failing with "env file .env not found".
    # Needs Docker Compose v2.24+ (Docker Desktop / recent WSL installs have it).
    env_file:
      - path: .env
        required: false
    environment:
      - NODE_ENV=production
      - PORT=9876
      - DB_PATH=/app/data/maestro.db
      - WORKTREE_DIR=/workspaces
    volumes:
      # アプリの状態 (DB / users / skills / secrets) を永続化。
      # アプリは WORKDIR /app からの相対 ./data に書くので /app/data にマウントする。
      - maestro-data:/app/data
      # エージェントワークスペース永続化
      - maestro-workspaces:/workspaces
      # config.yaml をホストから永続化したい場合は bind-mount (書き込み可)。
      # Settings UI / npm run setup で書き換えるなら :ro は付けないこと。
      # - ./config.yaml:/app/config.yaml
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:9876/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

volumes:
  maestro-data:
    driver: local
  maestro-workspaces:
    driver: local