name: ai-toolbox

services:
  ai-tools:
    image: local/ai-toolbox:${AI_TOOLS_IMAGE_TAG:-0.2.0}
    container_name: ${AI_CONTAINER_NAME:-ai-tools}
    build:
      context: .
      args:
        AI_UID: ${AI_UID:-1000}
        AI_GID: ${AI_GID:-1000}
        CODEX_VERSION: ${CODEX_VERSION:-latest}
        CLAUDE_VERSION: ${CLAUDE_VERSION:-latest}
        CODEBUDDY_VERSION: ${CODEBUDDY_VERSION:-latest}
        KIMI_VERSION: ${KIMI_VERSION:-latest}
        OPENCODE_VERSION: ${OPENCODE_VERSION:-latest}
        QWEN_VERSION: ${QWEN_VERSION:-latest}
        DSH_VERSION: ${DSH_VERSION:-latest}
        CC_SWITCH_VERSION: ${CC_SWITCH_VERSION:-v5.10.2}
        MULTICA_VERSION: ${MULTICA_VERSION:-v0.1.53}
    tty: true
    stdin_open: true
    restart: unless-stopped
    working_dir: /workspace
    environment:
      TZ: ${TZ:-Asia/Shanghai}
      TERM: xterm-256color
      COLORTERM: truecolor
      RUNNER_PORT: 4174
      RUNNER_TOKEN: ${RUNNER_TOKEN:?RUNNER_TOKEN is required}
      WORKSPACE_ROOT: /workspace
      SESSION_DIRECTORY: /home/ai/.ai-console/sessions
      MULTICA_ENABLED: ${MULTICA_ENABLED:-true}
      MULTICA_DAEMON_MAX_CONCURRENT_TASKS: ${MULTICA_DAEMON_MAX_CONCURRENT_TASKS:-2}
      MULTICA_AGENT_RUNTIME_NAME: ${MULTICA_AGENT_RUNTIME_NAME:-AgentDock Ubuntu Runtime}
    volumes:
      - type: bind
        source: ${WORKSPACE_PATH:-/srv/projects}
        target: /workspace
      - type: bind
        source: ${AI_HOME_PATH:-./data}
        target: /home/ai
    networks:
      - runner
      - egress
    security_opt:
      - no-new-privileges:true
    pids_limit: 2048
    mem_limit: ${AI_TOOLS_MEMORY_LIMIT:-6g}
    cpus: ${AI_TOOLS_CPU_LIMIT:-4.0}
    stop_grace_period: 30s
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:4174/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

  ai-console:
    image: local/agentdock-console:${CONSOLE_IMAGE_TAG:-0.1.0}
    build:
      context: ./console
      dockerfile: Dockerfile
    restart: unless-stopped
    environment:
      TZ: ${TZ:-Asia/Shanghai}
      CONSOLE_PORT: 4173
      RUNNER_URL: http://ai-tools:4174
      RUNNER_TOKEN: ${RUNNER_TOKEN:?RUNNER_TOKEN is required}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?ADMIN_PASSWORD is required}
      CONFIG_ENCRYPTION_KEY: ${CONFIG_ENCRYPTION_KEY:?CONFIG_ENCRYPTION_KEY is required}
      CONSOLE_DATA_DIRECTORY: /data
    volumes:
      - type: bind
        source: ${CONSOLE_DATA_PATH:-./console-data}
        target: /data
    networks:
      - frontend
      - runner
    depends_on:
      ai-tools:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    pids_limit: 256
    mem_limit: ${CONSOLE_MEMORY_LIMIT:-512m}
    cpus: ${CONSOLE_CPU_LIMIT:-1.0}
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:4173/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  ai-proxy:
    image: caddy:2.10.2-alpine
    restart: unless-stopped
    ports:
      - "192.168.200.36:${CONSOLE_HTTPS_PORT:-8443}:443"
    volumes:
      - ./proxy/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./proxy/certs:/etc/caddy/certs:ro
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - frontend
      - edge
    depends_on:
      ai-console:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /tmp
      - /config/caddy
    mem_limit: 256m
    cpus: 0.5
    healthcheck:
      test: ["CMD", "wget", "--no-check-certificate", "-qO-", "https://127.0.0.1/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

networks:
  frontend:
    internal: true
  runner:
    internal: true
  egress:
  edge:

volumes:
  caddy_data:
  caddy_config: