name: assistant
services:
  postgres:
    build:
      context: ..
      dockerfile: deploy/images/postgres.Dockerfile
      args: { SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" }
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: ${POSTGRES_SUPERUSER}
      POSTGRES_PASSWORD: ${POSTGRES_SUPERUSER_PASSWORD}
      CONTINUITY_DB_PASSWORD: ${CONTINUITY_DB_PASSWORD}
      IDENTITY_DB_PASSWORD: ${IDENTITY_DB_PASSWORD}
      AUTHORITY_DB_PASSWORD: ${AUTHORITY_DB_PASSWORD}
      SITUATION_DB_PASSWORD: ${SITUATION_DB_PASSWORD}
      WORK_DB_PASSWORD: ${WORK_DB_PASSWORD}
      CAPABILITY_DB_PASSWORD: ${CAPABILITY_DB_PASSWORD}
      COMMIT_DB_PASSWORD: ${COMMIT_DB_PASSWORD}
      EPISTEMICS_DB_PASSWORD_FILE: /run/secrets/epistemics_db_password
      INTERACTION_DB_PASSWORD_FILE: /run/secrets/interaction_db_password
    volumes:
      - assistant_pg:/var/lib/postgresql
      - assistant_core_secrets:/run/secrets:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_SUPERUSER} -d ${POSTGRES_DB:-assistant}"]
      interval: 10s
      timeout: 5s
      retries: 20

  nats:
    image: nats:2-alpine
    restart: unless-stopped
    command: ["-js", "-m", "8222"]
    volumes: ["assistant_nats:/data"]

  notification-receiver:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: notification-receiver, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8085"
      RECEIPT_DIRECTORY: /var/lib/notification-receiver
      RECEIVER_WRITE_TOKEN_FILE: /run/notification-writer/token
      RECEIVER_READ_TOKEN_FILE: /run/notification-reader/token
    ports: ["${NOTIFICATION_RECEIVER_PORT:-18081}:8085"]
    volumes:
      - assistant_notification_receipts:/var/lib/notification-receiver
      - assistant_notification_writer_secret:/run/notification-writer:ro
      - assistant_notification_reader_secret:/run/notification-reader:ro
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8085/healthz >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

  core-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: core-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8080"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: situation_role
      POSTGRES_PASSWORD: ${SITUATION_DB_PASSWORD}
      IDENTITY_POSTGRES_USER: identity_role
      IDENTITY_POSTGRES_PASSWORD: ${IDENTITY_DB_PASSWORD}
      CREATOR_BOOTSTRAP_TOKEN_FILE: /run/secrets/creator_bootstrap_token
      CREATOR_SESSION_SIGNING_KEY_FILE: /run/secrets/creator_session_signing_key
      CREATOR_USERNAME: ${CREATOR_USERNAME}
      CREATOR_PASSWORD_FILE: /run/secrets/creator_password
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
      CAPABILITY_POSTGRES_USER: capability_role
      CAPABILITY_POSTGRES_PASSWORD: ${CAPABILITY_DB_PASSWORD}
      EPISTEMICS_POSTGRES_USER: epistemics_role
      EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
      EPISTEMICS_POSTGRES_PASSWORD_FILE: /run/secrets/epistemics_db_password
      INTERACTION_POSTGRES_USER: interaction_role
      INTERACTION_POSTGRES_CREDENTIAL_REF: credential://domovoy/interaction/db-password/v1
      INTERACTION_POSTGRES_PASSWORD_FILE: /run/secrets/interaction_db_password
      SECRET_BACKEND_ROOT: /run/secrets
      COGNITIVE_ADMISSION_POLICY_ID: creator-advisory-local-v1
      COGNITIVE_ADMISSION_MAX_CONCURRENT: ${COGNITIVE_ADMISSION_MAX_CONCURRENT:-1}
      COGNITIVE_ADMISSION_MAX_ACCEPTED_PER_HOUR: ${COGNITIVE_ADMISSION_MAX_ACCEPTED_PER_HOUR:-60}
      COGNITIVE_ADMISSION_MAX_INPUT_BYTES: ${COGNITIVE_ADMISSION_MAX_INPUT_BYTES:-81920}
      COGNITIVE_ADMISSION_MAX_OUTPUT_BYTES: ${COGNITIVE_ADMISSION_MAX_OUTPUT_BYTES:-16384}
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  agent-canary:
    profiles: ["agent-canary"]
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-canary, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: "no"
    command: ["-enable-canary", "-postgres"]
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
    depends_on: { postgres: { condition: service_healthy } }

  agent-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    command: ["-worker-id", "agent-worker-production", "-status-addr", ":8090"]
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
      WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
      SECRET_BACKEND_ROOT: /run/secrets
      AGENT_EXECUTION_BRIDGE_URL: ${AGENT_EXECUTION_BRIDGE_URL:-}
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  work-graph-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: work-graph-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: :8088
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
      WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  reflection-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: reflection-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    command: ["-worker-id", "reflection-worker-production"]
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      EPISTEMICS_POSTGRES_USER: epistemics_role
      EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
      EPISTEMICS_POSTGRES_PASSWORD_FILE: /run/secrets/epistemics_db_password
      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  research-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: research-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: :8087
      RESEARCH_SOURCE_ROOT: /var/lib/research-sources
      RESEARCH_HTTP_ALLOWED_HOSTS: assistant.cin.su,git.cin.su
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      EPISTEMICS_POSTGRES_USER: epistemics_role
      EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
      EPISTEMICS_POSTGRES_PASSWORD_FILE: /run/secrets/epistemics_db_password
      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro
      - assistant_research_sources:/var/lib/research-sources:ro

  continuity-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: continuity-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8081"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: continuity_role
      POSTGRES_PASSWORD: ${CONTINUITY_DB_PASSWORD}
      CORE_RUNTIME_URL: http://core-runtime:8080
      COMMIT_EXECUTOR_TOKEN: ${COMMIT_EXECUTOR_TOKEN}

  commit-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: commit-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8082"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: commit_role
      POSTGRES_PASSWORD: ${COMMIT_DB_PASSWORD}
      AUTHORITY_POSTGRES_USER: authority_role
      AUTHORITY_POSTGRES_PASSWORD: ${AUTHORITY_DB_PASSWORD}
      CORE_RUNTIME_URL: http://core-runtime:8080
      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
      COMMIT_EXECUTOR_TOKEN: ${COMMIT_EXECUTOR_TOKEN}
      NOTIFICATION_WRITE_TOKEN_FILE: /run/notification-writer/token
      NOTIFICATION_WRITE_SECRET_REF: domovoy-notification-write-v1
    # External mutation credentials belong here only via Portainer/Docker secrets/env injection.
    depends_on: [core-runtime, continuity-runtime, notification-receiver]
    volumes:
      - assistant_notification_writer_secret:/run/notification-writer:ro

  cognitive-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: cognitive-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8083"
      CORE_RUNTIME_URL: http://core-runtime:8080
      LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1
      LOCAL_CPU_PROVIDER_API_KEY_FILE: ${LOCAL_CPU_PROVIDER_API_KEY_FILE:-}
      LOCAL_CPU_PROVIDER_CREDENTIAL_REF: ${LOCAL_CPU_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-cpu/provider-api-key/v1}
      LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-http://llm-local-api:8080/v1}
      LOCAL_MEDIUM_PROVIDER_API_KEY_FILE: ${LOCAL_MEDIUM_PROVIDER_API_KEY_FILE:-}
      LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF: ${LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-medium/provider-api-key/v1}
      LOCAL_LIFEBOAT_PROVIDER_URL: http://cognitive-lifeboat:8086/v1
      LOCAL_GPU_PROVIDER_URL: http://192.168.220.91:11434
      COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
      COGNITIVE_ALLOW_CANARY: "true"
    depends_on: [core-runtime, cognitive-lifeboat]
    volumes:
      - assistant_core_secrets:/run/secrets:ro
    networks: [default, llm-local]

  cognitive-lifeboat:
    image: ghcr.io/ggml-org/llama.cpp:server
    restart: unless-stopped
    command:
      - --host
      - 0.0.0.0
      - --port
      - "8086"
      - --model
      - /models/Qwen3-8B-Q4_K_M.gguf
      - --alias
      - domovoy-lifeboat
      - --jinja
      - --ctx-size
      - "8192"
      - --n-gpu-layers
      - "0"
      - --threads
      - "32"
      - --parallel
      - "1"
      - --reasoning
      - "off"
    volumes:
      - llm_local_models:/models:ro
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8086/health >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

  creator-web:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: creator-web, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8084"
      CORE_RUNTIME_URL: http://core-runtime:8080
      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
      COMMIT_RUNTIME_URL: http://commit-runtime:8082
      COGNITIVE_RUNTIME_URL: http://cognitive-worker:8083
      AGENT_WORKER_URL: http://agent-worker:8090
      ASSISTANT_BUILD_REVISION: ${ASSISTANT_SOURCE_REVISION:-unknown}
    ports: ["${CREATOR_WEB_PORT:-18080}:8084"]
    depends_on: [core-runtime, continuity-runtime, commit-runtime, cognitive-worker]
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8084/healthz >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

volumes:
  assistant_pg:
  assistant_nats:
  assistant_core_secrets:
    external: true
  assistant_notification_receipts:
  assistant_notification_writer_secret:
    external: true
  assistant_notification_reader_secret:
    external: true
  llm_local_models:
    name: llm-local-models
    external: true
  assistant_research_sources:
    name: assistant_research_sources

networks:
  llm-local:
    external: true
    name: llm-local_default