services:
  postgres:
    image: ${POSTGRES_IMAGE:-postgres:16}
    environment:
      # USER/PASSWORD/DB apply only on first pgdata init. Keep existing values in
      # .env, or ALTER ROLE / rename in place. Recreate pgdata only after backup
      # (or when the volume is disposable); down -v deletes all DB state.
      POSTGRES_USER: ${POSTGRES_USER:-rakazo}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
      POSTGRES_DB: ${POSTGRES_DB:-rakazo}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-rakazo} -d ${POSTGRES_DB:-rakazo}"]
      interval: 3s
      timeout: 5s
      retries: 20

  supervisor:
    build:
      context: ../..
      dockerfile: infra/sandboxes/supervisor/Dockerfile
    environment:
      DATA_DIR: /data
      SUPERVISOR_HOST: "0.0.0.0"
      SUPERVISOR_PORT: "7091"
      DOCKER_SOCKET: /var/run/docker.sock
      RAKAZO_COMPUTER_IMAGE: rakazo/computer:local
      RAKAZO_COMPUTER_MEMORY: ${RAKAZO_COMPUTER_MEMORY:-2g}
      RAKAZO_COMPUTER_CPUS: ${RAKAZO_COMPUTER_CPUS:-2}
      RAKAZO_COMPUTER_PIDS_LIMIT: ${RAKAZO_COMPUTER_PIDS_LIMIT:-2048}
      SANDBOX_COMMAND_TIMEOUT_MS: ${SANDBOX_COMMAND_TIMEOUT_MS:-300000}
      SANDBOX_TEAM_SCREEN_LIMIT: ${SANDBOX_TEAM_SCREEN_LIMIT:-0}
      SANDBOX_SUPERVISOR_TOKEN: ${SANDBOX_SUPERVISOR_TOKEN:?Set SANDBOX_SUPERVISOR_TOKEN in .env}
      SANDBOX_SCREEN_NETWORK: isolated
      LOG_LEVEL: ${LOG_LEVEL:-info}
      LOG_FORMAT: ${LOG_FORMAT:-}
      AXIOM_TOKEN: ${AXIOM_TOKEN:-}
      AXIOM_DATASET: ${AXIOM_DATASET:-}
      AXIOM_EDGE: ${AXIOM_EDGE:-}
      AXIOM_EDGE_URL: ${AXIOM_EDGE_URL:-}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ../../data:/data
    depends_on:
      computer:
        condition: service_completed_successfully

  computer:
    image: rakazo/computer:local
    build:
      context: ../sandboxes/computer
    command: ["true"]
    restart: "no"

  data-init:
    image: ${BUSYBOX_IMAGE:-busybox:1}
    command: ["chown", "-R", "1000:1000", "/data"]
    restart: "no"
    volumes:
      - ../../data:/data

  api:
    build:
      context: ../..
      dockerfile: infra/compose/Dockerfile
    command: ["bash", "-lc", "pnpm --filter @rakazo/db exec prisma migrate deploy && pnpm --filter @rakazo/api start"]
    env_file:
      - ../../.env
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER:-rakazo}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@postgres:5432/${POSTGRES_DB:-rakazo}
      API_HOST: "0.0.0.0"
      DATA_DIR: /data
      SANDBOX_SUPERVISOR_URL: http://supervisor:7091
      WAKEUP_DRIVER: graphile
      SANDBOX_PROVIDER: docker
      CLOUD_AGENT_PROVIDER: ${CLOUD_AGENT_PROVIDER:-none}
      CLOUD_AGENT_SPACE_ID: ${CLOUD_AGENT_SPACE_ID:-}
      CURSOR_API_KEY: ${CURSOR_API_KEY:-}
      AGENT_RUNTIME: pi
      # Optional egress proxy (Mainland / corporate). Empty = unset; either case works.
      HTTP_PROXY: ${HTTP_PROXY:-${http_proxy:-}}
      HTTPS_PROXY: ${HTTPS_PROXY:-${https_proxy:-}}
      NO_PROXY: ${NO_PROXY:-${no_proxy:-}}
      http_proxy: ${http_proxy:-${HTTP_PROXY:-}}
      https_proxy: ${https_proxy:-${HTTPS_PROXY:-}}
      no_proxy: ${no_proxy:-${NO_PROXY:-}}
    ports:
      - "127.0.0.1:3100:3100"
    volumes:
      - ../../data:/data
    depends_on:
      postgres:
        condition: service_healthy
      data-init:
        condition: service_completed_successfully

  worker:
    build:
      context: ../..
      dockerfile: infra/compose/Dockerfile
    command: ["pnpm", "--filter", "@rakazo/worker", "start"]
    env_file:
      - ../../.env
    environment:
      BETTER_AUTH_SECRET: ""
      DATABASE_URL: postgres://${POSTGRES_USER:-rakazo}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@postgres:5432/${POSTGRES_DB:-rakazo}
      DATA_DIR: /data
      SANDBOX_SUPERVISOR_URL: http://supervisor:7091
      WAKEUP_DRIVER: graphile
      SANDBOX_PROVIDER: docker
      CLOUD_AGENT_PROVIDER: ${CLOUD_AGENT_PROVIDER:-none}
      CLOUD_AGENT_SPACE_ID: ${CLOUD_AGENT_SPACE_ID:-}
      CURSOR_API_KEY: ${CURSOR_API_KEY:-}
      SCREEN_PROXY_SECRET: ""
      AGENT_RUNTIME: pi
      # Optional egress proxy (Mainland / corporate). Empty = unset; either case works.
      HTTP_PROXY: ${HTTP_PROXY:-${http_proxy:-}}
      HTTPS_PROXY: ${HTTPS_PROXY:-${https_proxy:-}}
      NO_PROXY: ${NO_PROXY:-${no_proxy:-}}
      http_proxy: ${http_proxy:-${HTTP_PROXY:-}}
      https_proxy: ${https_proxy:-${HTTPS_PROXY:-}}
      no_proxy: ${no_proxy:-${NO_PROXY:-}}
    volumes:
      - ../../data:/data
    depends_on:
      postgres:
        condition: service_healthy
      data-init:
        condition: service_completed_successfully

  media-worker:
    # Optional Media Studio sidecar: `docker compose --profile media up`.
    # No published port; the API and worker reach it as http://media-worker:8790.
    profiles: ["media"]
    build:
      context: ../media-worker
      args:
        ACCELERATOR: ${MEDIA_ACCELERATOR:-cpu}
    image: rakazo/media-worker:local
    environment:
      MEDIA_WORKER_HOST: "0.0.0.0"
      MEDIA_WORKER_PORT: "8790"
      MEDIA_WORKER_TOKEN: ${MEDIA_WORKER_TOKEN:?Set MEDIA_WORKER_TOKEN in .env}
      MEDIA_ROOT: /data/media
      MEDIA_MODELS_DIR: /models
      HTTP_PROXY: ${HTTP_PROXY:-${http_proxy:-}}
      HTTPS_PROXY: ${HTTPS_PROXY:-${https_proxy:-}}
      NO_PROXY: ${NO_PROXY:-${no_proxy:-}}
    volumes:
      - ../../data/media:/data/media
      - media-models:/models

  web:
    build:
      context: ../..
      dockerfile: infra/compose/Dockerfile
    command: ["pnpm", "--filter", "@rakazo/web", "preview", "--host", "0.0.0.0", "--port", "5173"]
    environment:
      API_PROXY_TARGET: http://api:3100
      SCREEN_PROXY_SECRET: ${SCREEN_PROXY_SECRET:?Set SCREEN_PROXY_SECRET in .env}
      RAKAZO_HOST: ${RAKAZO_HOST:-localhost}
    ports:
      - "127.0.0.1:5173:5173"
    depends_on:
      - api

volumes:
  media-models:
  pgdata: