services:
  gateway:
    # Defaults to a self-built image; to use a prebuilt release image instead:
    #   OPENSQUILLA_GATEWAY_IMAGE=ghcr.io/opensquilla/opensquilla:latest docker compose up -d
    # Full container guide: docs/docker.md
    image: ${OPENSQUILLA_GATEWAY_IMAGE:-opensquilla:local}
    environment:
      # In-container bind address. Keep it 0.0.0.0 — Docker port publishing
      # needs the wildcard bind, and what the network can actually reach is
      # decided by `ports` below, not by this value.
      OPENSQUILLA_LISTEN: "0.0.0.0"
      # Administering a containerized gateway through the Web UI (/control/)
      # requires token auth, even from this host. Enable it with:
      #   OPENSQUILLA_AUTH_MODE: token
      #   OPENSQUILLA_AUTH_TOKEN: ${OPENSQUILLA_AUTH_TOKEN:?generate one with openssl rand -hex 32}
      # and put the value in a git-ignored .env next to this file.
      # See docs/docker.md for the /control/?token=... login flow.
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      BRAVE_SEARCH_API_KEY: ${BRAVE_SEARCH_API_KEY:-}
      TZ: ${TZ:-UTC}
    volumes:
      # Config, state, logs, and workspace persist in a Docker-managed
      # named volume mounted at the image's OPENSQUILLA_STATE_DIR. The
      # image pre-creates that path owned by the non-root container user,
      # so persistence works consistently on Linux, macOS, Windows, and WSL2.
      - opensquilla-state:/var/lib/opensquilla
    ports:
      # Published on the host loopback only: the gateway is reachable from
      # this machine and invisible to the rest of the network. To reach the
      # Web UI from other devices (home server / NAS), publish on all
      # interfaces AND configure token auth above first:
      #   - "18791:18791"
      # Exposure is controlled here — do not change OPENSQUILLA_LISTEN.
      # Never forward this port to the internet; see docs/docker.md.
      - "127.0.0.1:18791:18791"
    healthcheck:
      test: ["CMD-SHELL", "curl --fail --silent --show-error http://127.0.0.1:18791/healthz || exit 1"]
      interval: 30s
      timeout: 5s
      start_period: 10s
      retries: 3
    restart: unless-stopped

volumes:
  opensquilla-state: