name: assistant
services:
  postgres:
    build:
      context: ..
      dockerfile: deploy/images/postgres.Dockerfile
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: ${POSTGRES_SUPERUSER}
      POSTGRES_PASSWORD: ${POSTGRES_SUPERUSER_PASSWORD}
      CONTINUITY_DB_PASSWORD: ${CONTINUITY_DB_PASSWORD}
      IDENTITY_DB_PASSWORD: ${IDENTITY_DB_PASSWORD}
      AUTHORITY_DB_PASSWORD: ${AUTHORITY_DB_PASSWORD}
      SITUATION_DB_PASSWORD: ${SITUATION_DB_PASSWORD}
      WORK_DB_PASSWORD: ${WORK_DB_PASSWORD}
      CAPABILITY_DB_PASSWORD: ${CAPABILITY_DB_PASSWORD}
      COMMIT_DB_PASSWORD: ${COMMIT_DB_PASSWORD}
    volumes:
      - assistant_pg:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_SUPERUSER} -d ${POSTGRES_DB:-assistant}"]
      interval: 10s
      timeout: 5s
      retries: 20

  nats:
    image: nats:2-alpine
    restart: unless-stopped
    command: ["-js", "-m", "8222"]
    volumes: ["assistant_nats:/data"]

  core-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: core-runtime } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8080"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: situation_role
      POSTGRES_PASSWORD: ${SITUATION_DB_PASSWORD}
      IDENTITY_POSTGRES_USER: identity_role
      IDENTITY_POSTGRES_PASSWORD: ${IDENTITY_DB_PASSWORD}
      CREATOR_BOOTSTRAP_TOKEN_FILE: /run/secrets/creator_bootstrap_token
      CREATOR_SESSION_SIGNING_KEY_FILE: /run/secrets/creator_session_signing_key
      CREATOR_USERNAME: ${CREATOR_USERNAME}
      CREATOR_PASSWORD_FILE: /run/secrets/creator_password
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
      CAPABILITY_POSTGRES_USER: capability_role
      CAPABILITY_POSTGRES_PASSWORD: ${CAPABILITY_DB_PASSWORD}
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  continuity-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: continuity-runtime } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8081"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: continuity_role
      POSTGRES_PASSWORD: ${CONTINUITY_DB_PASSWORD}
      CORE_RUNTIME_URL: http://core-runtime:8080
      COMMIT_EXECUTOR_TOKEN: ${COMMIT_EXECUTOR_TOKEN}

  commit-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: commit-runtime } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8082"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: commit_role
      POSTGRES_PASSWORD: ${COMMIT_DB_PASSWORD}
      AUTHORITY_POSTGRES_USER: authority_role
      AUTHORITY_POSTGRES_PASSWORD: ${AUTHORITY_DB_PASSWORD}
      CORE_RUNTIME_URL: http://core-runtime:8080
      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
      COMMIT_EXECUTOR_TOKEN: ${COMMIT_EXECUTOR_TOKEN}
    # External mutation credentials belong here only via Portainer/Docker secrets/env injection.
    depends_on: [core-runtime, continuity-runtime]

  cognitive-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: cognitive-worker } }
    restart: unless-stopped
    environment: { LISTEN_ADDR: ":8083" }

  creator-web:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: creator-web } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8084"
      CORE_RUNTIME_URL: http://core-runtime:8080
      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
      COMMIT_RUNTIME_URL: http://commit-runtime:8082
    ports: ["${CREATOR_WEB_PORT:-18080}:8084"]
    depends_on: [core-runtime, continuity-runtime, commit-runtime]
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8084/healthz >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

volumes:
  assistant_pg:
  assistant_nats:
  assistant_core_secrets:
    external: true