# Zopu VDS staging — Rivet engine + runner on host network.
#
# The agents registry and Caddy run on the HOST via systemd (not Docker).
# This compose only manages the two Rivet services, both on host networking:
#
#   engine — Rivet Engine (RocksDB backend), binds 127.0.0.1:6420 on the host.
#            UFW (policy DROP, only 22/80/443 open) keeps it private.
#   runner — AgentOS runner, reaches the engine at 127.0.0.1:6420.
#
# With network_mode: host there are no Docker bridge networks, no port
# forwarding, and no host.docker.internal gymnastics — both services share
# the host network namespace directly.
#
# Usage:
#   docker compose --env-file .env up -d

services:
  engine:
    image: ${ENGINE_IMAGE:?ENGINE_IMAGE must be set}
    restart: unless-stopped
    network_mode: host
    volumes:
      - type: bind
        source: ${ZOPU_DEPLOY_ROOT:?ZOPU_DEPLOY_ROOT is required}/data/rivet
        target: /data
    environment:
      RIVET__FILE_SYSTEM__PATH: /data
      RIVET__AUTH__ADMIN_TOKEN: ${RIVET_ADMIN_TOKEN:?RIVET_ADMIN_TOKEN is required}
      RIVET_LOG_LEVEL: ${RIVET_LOG_LEVEL:-info}
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:6420/health"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s

  runner:
    image: ${RUNNER_IMAGE:?RUNNER_IMAGE must be set}
    restart: unless-stopped
    network_mode: host
    environment:
      NODE_ENV: production
      RIVET_RUNNER_VERSION: ${RIVET_RUNNER_VERSION:?RIVET_RUNNER_VERSION is required}
      RIVET_ENVOY_VERSION: ${RIVET_RUNNER_VERSION:?RIVET_RUNNER_VERSION is required}
      RIVET_ENDPOINT: http://${RIVET_NAMESPACE:-default}:${RIVET_ADMIN_TOKEN:?RIVET_ADMIN_TOKEN is required}@127.0.0.1:6420
      RIVET_WORKSPACE_TOKEN: ${RIVET_WORKSPACE_TOKEN:?RIVET_WORKSPACE_TOKEN is required}
      AGENT_WORKSPACE_ROOT: /var/lib/zopu/workspaces
      BUN_EXECUTABLE: /usr/local/bin/bun
      AGENT_MODEL_API_KEY: ${AGENT_MODEL_API_KEY:?AGENT_MODEL_API_KEY is required}
    volumes:
      - type: bind
        source: ${ZOPU_DEPLOY_ROOT:?ZOPU_DEPLOY_ROOT is required}/workspaces
        target: /var/lib/zopu/workspaces
    depends_on:
      engine:
        condition: service_healthy