docker-compose.yml

networks:
  app:
    driver: bridge

services:
  postgres:
    image: postgres:18-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in the selected env file}
      POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in the selected env file}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in the selected env file}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\"",
        ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s
    ports:
      - "${POSTGRES_PORT:-127.0.0.1:5432:5432}"
    volumes:
      - postgres-data:/var/lib/postgresql
    networks:
      - app

  migrate:
    build:
      context: .
      dockerfile: packages/db/Dockerfile
    restart: "no"
    environment:
      RUNFORGE_DATABASE_URL: ${RUNFORGE_DOCKER_DATABASE_URL:?set RUNFORGE_DOCKER_DATABASE_URL in the selected env file}
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - app

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    profiles: ["public"]
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - app

  dashboard:
    build:
      context: .
      dockerfile: packages/dashboard/Dockerfile
      args:
        - NEXT_PUBLIC_SITE_URL
    restart: unless-stopped
    env_file: ${ENV_FILE:-.env.prod}
    environment:
      RUNFORGE_DATABASE_URL: ${RUNFORGE_DOCKER_DATABASE_URL:?set RUNFORGE_DOCKER_DATABASE_URL in the selected env file}
      NODE_ENV: production
      PLUGINS_DIR: /app/plugins
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY in the selected env file}
    ports:
      - "${DASHBOARD_PORT:-127.0.0.1:3000:3000}"
    depends_on:
      migrate:
        condition: service_completed_successfully
    volumes:
      - ./plugins:/app/plugins:ro
    networks:
      - app
    # On the macOS host: daemon runs natively, dashboard reaches it via host.docker.internal
    # On Hetzner: daemon runs in Docker, dashboard reaches it via Docker service name
    extra_hosts:
      - "host.docker.internal:host-gateway"

  daemon:
    build:
      context: .
      dockerfile: packages/daemon/Dockerfile
    restart: unless-stopped
    profiles: ["containerized-daemon"]
    env_file: ${ENV_FILE:-.env.prod}
    environment:
      RUNFORGE_DATABASE_URL: ${RUNFORGE_DOCKER_DATABASE_URL:?set RUNFORGE_DOCKER_DATABASE_URL in the selected env file}
      DAEMON_HOST: "0.0.0.0"
      DAEMON_DATA_BACKEND: ${DAEMON_DATA_BACKEND:-postgres}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY in the selected env file}
      # The container IS the externally-managed sandbox, so workers run with
      # --dangerously-skip-permissions to clear the CLI "Workspace not trusted"
      # gate on dynamic worktree cwds. The daemon's PreToolUse containment hooks
      # still gate every tool call. Override to 0 only for a non-autonomous run.
      RUNFORGE_SKIP_PERMISSIONS: ${RUNFORGE_SKIP_PERMISSIONS:-1}
      # Subscription-auth home: the CLI reads creds from $HOME/.claude and the
      # onboarding/trust config from $HOME/.claude.json (both operator-mounted).
      HOME: /root
    depends_on:
      migrate:
        condition: service_completed_successfully
    ports: []
    command: >
      sh -c "
        git config --global user.name 'Runforge' &&
        git config --global user.email 'runforge@localhost' &&
        pnpm start
      "
    # WHAT THE IMAGE BAKES (no mount needed): prompts/, FACTORY_RULES.md,
    # fitness/ — see packages/daemon/Dockerfile. PROMPTS_DIR is baked too.
    # WHAT THE OPERATOR MOUNTS:
    #   - the pilot config (runforge.config.json)
    #   - plugins/ (optional)
    #   - subscription creds: an ISOLATED COPY of ~/.claude mounted WRITABLE at
    #     /root/.claude (the CLI refreshes the OAuth token and needs write; :ro
    #     401s), plus ~/.claude.json -> /root/.claude.json for onboarding/trust.
    #     Creds are secret -> operator-mounted, NEVER baked. Set them via:
    #       RUNFORGE_CLAUDE_CREDS_DIR=/tmp/pilot-claude
    #       RUNFORGE_CLAUDE_JSON=$HOME/.claude.json
    volumes:
      - ./plugins:/app/plugins:ro
      - ${RUNFORGE_CONFIG_FILE:-./runforge.config.json}:/app/packages/daemon/runforge.config.json:ro
      - ${RUNFORGE_CLAUDE_CREDS_DIR:-./.docker-noop-claude}:/root/.claude
      - ${RUNFORGE_CLAUDE_JSON:-./.docker-noop-claude.json}:/root/.claude.json
      - daemon-state:/app/packages/daemon/state
    networks:
      - app

  briefing-summarizer:
    build:
      context: .
      dockerfile: packages/briefing-summarizer/Dockerfile
    restart: unless-stopped
    env_file: ${ENV_FILE:-.env.prod}
    environment:
      RUNFORGE_DATABASE_URL: ${RUNFORGE_DOCKER_DATABASE_URL:?set RUNFORGE_DOCKER_DATABASE_URL in the selected env file}
      BRIEFING_DATA_BACKEND: ${BRIEFING_DATA_BACKEND:-postgres}
      NODE_ENV: production
      GIT_REPO_PATH: /repo
    depends_on:
      migrate:
        condition: service_completed_successfully
    volumes:
      - .:/repo:ro
    networks:
      - app
    extra_hosts:
      - "host.docker.internal:host-gateway"

volumes:
  caddy_data:
  caddy_config:
  daemon-state:
  postgres-data: