name: agenta-oss-gh

services:
    web:
        # === ACTIVATION =========================================== #
        profiles:
            - with-web
        # === IMAGE ================================================ #
        # build:
        #     context: ../../../web
        #     dockerfile: oss/docker/Dockerfile.gh
        image: ghcr.io/agenta-ai/${AGENTA_WEB_IMAGE_NAME:-agenta-web}:${AGENTA_WEB_IMAGE_TAG:-latest}
        # === EXECUTION ============================================ #
        command: sh -c "node ./oss/server.js"
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            - AGENTA_SERVICES_INTERNAL_KEY=
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        # === LABELS =============================================== #
        labels:
            - "traefik.http.routers.web.rule=PathPrefix(`/`)"
            - "traefik.http.routers.web.entrypoints=web"
            - "traefik.http.services.web.loadbalancer.server.port=3000"
        # === LIFECYCLE ============================================ #
        restart: always

    web-mobile:
        # === ACTIVATION =========================================== #
        # No profile: the mobile app (/m) starts with the stack, like api and web.
        # Always on: /m is part of every deployment.
        # === IMAGE ================================================ #
        # build:
        #     context: ../../../web
        #     dockerfile: mobile/docker/Dockerfile.gh
        image: ghcr.io/agenta-ai/${AGENTA_WEB_MOBILE_IMAGE_NAME:-agenta-web-mobile}:${AGENTA_WEB_MOBILE_IMAGE_TAG:-latest}
        # === EXECUTION ============================================ #
        command: sh -c "node ./mobile/server.js"
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            - AGENTA_SERVICES_INTERNAL_KEY=
            # The embed page fetches its config from the server side, where AGENTA_API_URL
            # (often http://localhost/api) points at this container, not at the API.
            - AGENTA_API_INTERNAL_URL=${AGENTA_API_INTERNAL_URL:-http://api:8000}
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        # === LABELS =============================================== #
        # (Path(`/m`) || PathPrefix(`/m/`)) auto-wins over the web catch-all PathPrefix(`/`)
        # by rule length; no stripprefix — the app is built with basePath /m.
        labels:
            - "traefik.http.routers.web-mobile.rule=(Path(`/m`) || PathPrefix(`/m/`))"
            - "traefik.http.routers.web-mobile.entrypoints=web"
            - "traefik.http.services.web-mobile.loadbalancer.server.port=3000"
        # === LIFECYCLE ============================================ #
        restart: always

    api:
        # === IMAGE ================================================ #
        # build:
        #     context: ../../..
        #     dockerfile: api/oss/docker/Dockerfile.gh
        image: ghcr.io/agenta-ai/${AGENTA_API_IMAGE_NAME:-agenta-api}:${AGENTA_API_IMAGE_TAG:-latest}
        # === EXECUTION ============================================ #
        # A worker recycled at --max-requests finishes its open requests (an LLM gateway
        # stream can run for minutes) for --graceful-timeout seconds while the other
        # worker takes new ones. A container stop still uses docker's default 10 s:
        # a compose recreate stops the old container before it starts the new one, so
        # a longer stop_grace_period would only make an upgrade's downtime longer.
        # --keep-alive is longer than the idle timeout of the proxy in front (Traefik keeps an
        # idle connection to the worker for 90 s). If the worker closed first, a request the
        # proxy sends on that connection in the same instant would fail with 502.
        command: >
            gunicorn entrypoints.routers:app
            --bind 0.0.0.0:8000
            --worker-class entrypoints.uvicorn_worker.DrainingUvicornWorker
            --workers 2
            --worker-connections 1000
            --backlog 2048
            --keep-alive 620
            --max-requests ${AGENTA_API_MAX_REQUESTS:-100000}
            --max-requests-jitter ${AGENTA_API_MAX_REQUESTS_JITTER:-10000}
            --timeout 60
            --graceful-timeout ${AGENTA_API_GRACEFUL_TIMEOUT:-900}
            --log-level info
            --access-logfile -
            --error-logfile -
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            - AGENTA_SERVICES_INTERNAL_KEY=${AGENTA_SERVICES_INTERNAL_KEY:?AGENTA_SERVICES_INTERNAL_KEY is required}
            - SCRIPT_NAME=/api
            - DOCKER_NETWORK_MODE=${DOCKER_NETWORK_MODE:-bridge}
            # kill's direct runner hop (W7.3, sandbox teardown) — same address + shared
            # token as the `services` container's runner_url().
            - AGENTA_RUNNER_INTERNAL_URL=${AGENTA_RUNNER_INTERNAL_URL:-http://runner:8765}
            - AGENTA_RUNNER_TOKEN=${AGENTA_RUNNER_TOKEN:?AGENTA_RUNNER_TOKEN is required}
            - AGENTA_STORE_ENDPOINT_URL=${AGENTA_STORE_ENDPOINT_URL:-}
            - AGENTA_STORE_ACCESS_KEY=${AGENTA_STORE_ACCESS_KEY:-}
            - AGENTA_STORE_SECRET_KEY=${AGENTA_STORE_SECRET_KEY:-}
            - AGENTA_STORE_REGION=${AGENTA_STORE_REGION:-us-east-1}
            - AGENTA_STORE_BUCKET=${AGENTA_STORE_BUCKET:-}
            - AGENTA_STORE_SIGNING_KEY=${AGENTA_STORE_SIGNING_KEY:-}
            # Unset leaves the code default (3600s) in place.
            - AGENTA_MOUNTS_CREDENTIALS_TTL_SECONDS=${AGENTA_MOUNTS_CREDENTIALS_TTL_SECONDS:-}
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        extra_hosts:
            - "host.docker.internal:host-gateway"
        # === ORCHESTRATION ======================================== #
        depends_on:
            postgres:
                condition: service_healthy
            alembic:
                condition: service_completed_successfully
            redis-volatile:
                condition: service_healthy
            redis-durable:
                condition: service_healthy
            seaweedfs:
                condition: service_healthy
        # === LABELS =============================================== #
        labels:
            - "traefik.http.routers.api.rule=PathPrefix(`/api/`)"
            - "traefik.http.routers.api.entrypoints=web"
            # Do NOT strip /api: the app is mounted at /api (SCRIPT_NAME + FastAPI root_path).
            # Forward /api/* unchanged so app-generated redirects keep the prefix.
            - "traefik.http.services.api.loadbalancer.server.port=8000"
            - "traefik.http.routers.api.service=api"
        # === LIFECYCLE ============================================ #
        restart: always

    worker-streams:
        # === IMAGE ================================================ #
        # build:
        #     context: ../../..
        #     dockerfile: api/oss/docker/Dockerfile.gh
        image: ghcr.io/agenta-ai/${AGENTA_API_IMAGE_NAME:-agenta-api}:${AGENTA_API_IMAGE_TAG:-latest}
        # === EXECUTION ============================================ #
        command:
            [
                "python",
                "-m",
                "entrypoints.worker_streams",
            ]
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            - AGENTA_SERVICES_INTERNAL_KEY=
            - DOCKER_NETWORK_MODE=${DOCKER_NETWORK_MODE:-bridge}
            # empty ⇒ all stream loops; see docs/designs/workers-sprawl/specs.md
            - AGENTA_WORKER_STREAMS=
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        extra_hosts:
            - "host.docker.internal:host-gateway"
        # === ORCHESTRATION ======================================== #
        depends_on:
            postgres:
                condition: service_healthy
            alembic:
                condition: service_completed_successfully
            redis-volatile:
                condition: service_healthy
            redis-durable:
                condition: service_healthy
        # === LIFECYCLE ============================================ #
        restart: always
        healthcheck:
            test: ["CMD", "python", "-c", "import pathlib,sys; cmd=pathlib.Path('/proc/1/cmdline').read_bytes().decode('utf-8','ignore'); sys.exit(0 if 'entrypoints.worker_streams' in cmd else 1)"]
            interval: 30s
            timeout: 10s
            retries: 3
            start_period: 20s

    worker-queues:
        # === IMAGE ================================================ #
        # build:
        #     context: ../../..
        #     dockerfile: api/oss/docker/Dockerfile.gh
        image: ghcr.io/agenta-ai/${AGENTA_API_IMAGE_NAME:-agenta-api}:${AGENTA_API_IMAGE_TAG:-latest}
        # === EXECUTION ============================================ #
        command:
            [
                "python",
                "-m",
                "entrypoints.worker_queues",
            ]
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            - AGENTA_SERVICES_INTERNAL_KEY=
            - DOCKER_NETWORK_MODE=${DOCKER_NETWORK_MODE:-bridge}
            # empty ⇒ all queue loops; see docs/designs/workers-sprawl/specs.md
            - AGENTA_WORKER_QUEUES=
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        extra_hosts:
            - "host.docker.internal:host-gateway"
        # === ORCHESTRATION ======================================== #
        depends_on:
            postgres:
                condition: service_healthy
            alembic:
                condition: service_completed_successfully
            redis-volatile:
                condition: service_healthy
            redis-durable:
                condition: service_healthy
        # === LIFECYCLE ============================================ #
        restart: always
        healthcheck:
            test: ["CMD", "python", "-c", "import pathlib,sys; cmd=pathlib.Path('/proc/1/cmdline').read_bytes().decode('utf-8','ignore'); sys.exit(0 if 'entrypoints.worker_queues' in cmd else 1)"]
            interval: 30s
            timeout: 10s
            retries: 3
            start_period: 20s

    cron:
        # === IMAGE ================================================ #
        # build:
        #     context: ../../..
        #     dockerfile: api/oss/docker/Dockerfile.gh
        image: ghcr.io/agenta-ai/${AGENTA_API_IMAGE_NAME:-agenta-api}:${AGENTA_API_IMAGE_TAG:-latest}
        # === EXECUTION ============================================ #
        init: true
        command: supercronic /app/crontab
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            - AGENTA_SERVICES_INTERNAL_KEY=
            - DOCKER_NETWORK_MODE=${DOCKER_NETWORK_MODE:-bridge}
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        extra_hosts:
            - "host.docker.internal:host-gateway"
        # === ORCHESTRATION ======================================== #
        depends_on:
            - postgres
            - api
        # === LIFECYCLE ============================================ #
        restart: always

    alembic:
        # === IMAGE ================================================ #
        # build:
        #     context: ../../..
        #     dockerfile: api/oss/docker/Dockerfile.gh
        image: ghcr.io/agenta-ai/${AGENTA_API_IMAGE_NAME:-agenta-api}:${AGENTA_API_IMAGE_TAG:-latest}
        # === EXECUTION ============================================ #
        command: sh -c "python -m oss.databases.postgres.migrations.runner"
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            AGENTA_SERVICES_INTERNAL_KEY: ""
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        # === ORCHESTRATION ======================================== #
        depends_on:
            postgres:
                condition: service_healthy

    services:
        # === IMAGE ================================================ #
        # build:
        #     context: ../../..
        #     dockerfile: services/oss/docker/Dockerfile.gh
        image: ghcr.io/agenta-ai/${AGENTA_SERVICES_IMAGE_NAME:-agenta-services}:${AGENTA_SERVICES_IMAGE_TAG:-latest}
        # === EXECUTION ============================================ #
        # --keep-alive is longer than the idle timeout of the proxy in front (Traefik keeps an
        # idle connection to the worker for 90 s). If the worker closed first, a request the
        # proxy sends on that connection in the same instant would fail with 502.
        command: >
            gunicorn entrypoints.main:app
            --bind 0.0.0.0:8080
            --worker-class uvicorn.workers.UvicornWorker
            --workers 2
            --worker-connections 1000
            --backlog 2048
            --keep-alive 620
            --max-requests 10000
            --max-requests-jitter 1000
            --timeout 60
            --graceful-timeout 60
            --log-level info
            --access-logfile -
            --error-logfile -
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            - AGENTA_SERVICES_INTERNAL_KEY=${AGENTA_SERVICES_INTERNAL_KEY:?AGENTA_SERVICES_INTERNAL_KEY is required}
            - SCRIPT_NAME=/services
            - DOCKER_NETWORK_MODE=${DOCKER_NETWORK_MODE:-bridge}
            - AGENTA_RUNNER_INTERNAL_URL=${AGENTA_RUNNER_INTERNAL_URL:-http://runner:8765}
            - AGENTA_RUNNER_TOKEN=${AGENTA_RUNNER_TOKEN:?AGENTA_RUNNER_TOKEN is required}
            - AGENTA_STORE_ENDPOINT_URL=${AGENTA_STORE_ENDPOINT_URL:-}
            - AGENTA_STORE_ACCESS_KEY=${AGENTA_STORE_ACCESS_KEY:-}
            - AGENTA_STORE_SECRET_KEY=${AGENTA_STORE_SECRET_KEY:-}
            - AGENTA_STORE_REGION=${AGENTA_STORE_REGION:-us-east-1}
            - AGENTA_STORE_BUCKET=${AGENTA_STORE_BUCKET:-}
            - AGENTA_STORE_SIGNING_KEY=${AGENTA_STORE_SIGNING_KEY:-}
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        extra_hosts:
            - "host.docker.internal:host-gateway"
        # === ORCHESTRATION ======================================== #
        depends_on:
            runner:
                condition: service_healthy
        # === LABELS =============================================== #
        labels:
            - "traefik.http.routers.services.rule=PathPrefix(`/services/`)"
            - "traefik.http.routers.services.entrypoints=web"
            - "traefik.http.middlewares.services-strip.stripprefix.prefixes=/services"
            - "traefik.http.middlewares.services-strip.stripprefix.forceslash=true"
            - "traefik.http.routers.services.middlewares=services-strip"
            - "traefik.http.services.services.loadbalancer.server.port=8080"
            - "traefik.http.routers.services.service=services"
        # === LIFECYCLE ============================================ #
        restart: always

    runner:
        # === IMAGE ================================================ #
        image: ghcr.io/agenta-ai/${AGENTA_RUNNER_IMAGE_NAME:-agenta-runner}:${AGENTA_RUNNER_IMAGE_TAG:-latest}
        # === EXECUTION ============================================ #
        init: true
        extra_hosts:
            - "host.docker.internal:host-gateway"
        # === CONFIGURATION ======================================== #
        environment:
            AGENTA_RUNNER_PORT: "8765"
            AGENTA_RUNNER_HOST: ${AGENTA_RUNNER_HOST:-0.0.0.0}
            # The API binds each turn to one runner by this id, so two runners must never share
            # it. A fixed default is safe because compose runs a single runner.
            AGENTA_RUNNER_REPLICA_ID: ${AGENTA_RUNNER_REPLICA_ID:-local-runner-1}
            AGENTA_API_URL: ${AGENTA_API_URL:-}
            AGENTA_API_INTERNAL_URL: ${AGENTA_API_INTERNAL_URL:-http://api:8000}
            AGENTA_API_KEY: ${AGENTA_API_KEY:-}
            AGENTA_RUNNER_TOKEN: ${AGENTA_RUNNER_TOKEN:?AGENTA_RUNNER_TOKEN is required}
            # Where the runner keeps state that must outlive a container recreate: the per-connection
            # copy of a hosted subscription login (Pi rotates the refresh token on every exchange).
            AGENTA_RUNNER_STATE_DIR: /var/lib/agenta/runner-state
            AGENTA_RUNNER_ENABLED_SANDBOX_PROVIDERS: ${AGENTA_RUNNER_ENABLED_SANDBOX_PROVIDERS:-local}
            AGENTA_RUNNER_DEFAULT_SANDBOX_PROVIDER: ${AGENTA_RUNNER_DEFAULT_SANDBOX_PROVIDER:-local}
            # Worst-case turn duration. Keep AGENTA_MOUNTS_CREDENTIALS_TTL_SECONDS (API) above it
            # plus 60s of skew, or every dispatch rebuilds the environment cold.
            AGENTA_RUNNER_RUN_TOTAL_TIMEOUT_MS: ${AGENTA_RUNNER_RUN_TOTAL_TIMEOUT_MS:-}
            # Defaults: 30 min without progress; 30 min for one tool call.
            AGENTA_RUNNER_RUN_IDLE_TIMEOUT_MS: ${AGENTA_RUNNER_RUN_IDLE_TIMEOUT_MS:-}
            AGENTA_RUNNER_TOOL_CALL_TIMEOUT_MS: ${AGENTA_RUNNER_TOOL_CALL_TIMEOUT_MS:-}
            PI_CODING_AGENT_DIR: ${PI_CODING_AGENT_DIR:-/pi-agent}
            AGENTA_RUNNER_DAYTONA_API_KEY: ${AGENTA_RUNNER_DAYTONA_API_KEY:-}
            AGENTA_RUNNER_DAYTONA_API_URL: ${AGENTA_RUNNER_DAYTONA_API_URL:-}
            AGENTA_RUNNER_DAYTONA_TARGET: ${AGENTA_RUNNER_DAYTONA_TARGET:-}
            AGENTA_RUNNER_DAYTONA_SNAPSHOT: ${AGENTA_RUNNER_DAYTONA_SNAPSHOT:-}
            AGENTA_RUNNER_DAYTONA_IMAGE: ${AGENTA_RUNNER_DAYTONA_IMAGE:-}
            AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES: ${AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES:-}
            AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS: ${AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS:-}
            AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM: ${AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM:-}
            AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES: ${AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES:-}
            AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS: ${AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS:-}
            AGENTA_RUNNER_LIVE_FRAMES: ${AGENTA_RUNNER_LIVE_FRAMES:-true}
            # Also unreachable without an explicit entry (no env_file), and the runner is
            # the leg that refuses a gateway-routed run: it re-validates the transport rule
            # the SDK applied, so a value set for the api and services but not here would
            # admit the run and then strand it inside the sandbox. Default off; see
            # docs/docs/self-host/reference/01-configuration.mdx.
            AGENTA_GATEWAYS_INSECURE_HTTP_ALLOWED: ${AGENTA_GATEWAYS_INSECURE_HTTP_ALLOWED:-}
        # === SUBSCRIPTION MOUNTS (opt-in) ========================= #
        # Use your own harness subscription for LOCAL runs instead of a managed API
        # key. Mount the login READ-WRITE: the harness runs directly out of the mount and
        # refreshes its own OAuth token there, so a rotated token persists and you never
        # have to log in again by hand. Single-operator convenience only — this state is
        # never shipped to a Daytona sandbox, and concurrent local subscription runs share
        # the dir (same as two local harness sessions). A runtime_provided local run
        # without the matching mount fails with a clear error.
        # volumes:
        #     - ~/.pi/agent:/agenta/harness/pi:rw        # Pi / Codex login
        #     - ~/.claude:/agenta/harness/claude:rw      # Claude login
        # Then point the harness config var at the mount (override the defaults above):
        #     PI_CODING_AGENT_DIR: /agenta/harness/pi
        #     CLAUDE_CONFIG_DIR: /agenta/harness/claude
        # === NETWORK ============================================== #
        volumes:
            - runner-state:/var/lib/agenta/runner-state
        networks:
            - agenta-oss-gh-network
        # === RUNTIME ============================================== #
        # FUSE for geesefs mounts (local sandbox cwd). Mirrors docker-compose.dev.yml.
        cap_add:
            - SYS_ADMIN
        devices:
            - /dev/fuse
        security_opt:
            - apparmor:unconfined
        # === LABELS =============================================== #
        labels:
            - "traefik.enable=false"
        # === LIFECYCLE ============================================ #
        restart: always
        healthcheck:
            test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8765/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
            interval: 10s
            timeout: 5s
            retries: 12
            start_period: 20s

    postgres:
        # === IMAGE ================================================ #
        image: postgres:17
        # === STORAGE ============================================== #
        volumes:
            - postgres-data:/var/lib/postgresql/data/
            - ../../../api/oss/databases/postgres/init-db-oss.sql:/docker-entrypoint-initdb.d/init-db.sql
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            AGENTA_SERVICES_INTERNAL_KEY: ""
            POSTGRES_USER: ${POSTGRES_USER:-username}
            POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-password}
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        ports:
            - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
        # === LIFECYCLE ============================================ #
        restart: always
        healthcheck:
            test: ["CMD-SHELL", "pg_isready -U username -d agenta_oss_core"]
            interval: 10s
            timeout: 5s
            retries: 5

    redis-volatile:
        # === IMAGE ================================================ #
        image: redis:8
        # === EXECUTION ============================================ #
        command: >
            redis-server
            --appendonly no
            --save ""
            --maxmemory 512mb
            --maxmemory-policy volatile-lru
            --port 6379
        # === STORAGE ============================================== #
        volumes:
            - redis-volatile-data:/data
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        # === LABELS =============================================== #
        labels:
            - "traefik.enable=false"
        # === LIFECYCLE ============================================ #
        restart: always
        healthcheck:
            test: ["CMD", "redis-cli", "-p", "6379", "ping"]
            interval: 10s
            timeout: 5s
            retries: 5
            start_period: 5s

    redis-durable:
        # === IMAGE ================================================ #
        image: redis:8
        # === EXECUTION ============================================ #
        command: >
            redis-server
            --appendonly yes
            --appendfsync no
            --aof-load-corrupt-tail-max-size 1048576
            --save ""
            --maxmemory 512mb
            --maxmemory-policy noeviction
            --port 6381
        # === STORAGE ============================================== #
        volumes:
            - redis-durable-data:/data
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        # === LABELS =============================================== #
        labels:
            - "traefik.enable=false"
        # === LIFECYCLE ============================================ #
        restart: always
        healthcheck:
            test: ["CMD", "redis-cli", "-p", "6381", "ping"]
            interval: 10s
            timeout: 5s
            retries: 5
            start_period: 5s

    seaweedfs:
        # === IMAGE ================================================ #
        # The bundled durable object store for session/agent mounts. Without it, runner mount
        # signing returns 503 and agent file writes are silently lost. Pinned (not :latest) so the
        # IAM/STS subsystem stays on a known-good build — it has regressed across releases.
        # Never go below 4.42: older builds keep listing a pre-versioning object after its
        # delete marker is written, so a deleted file reappears in a geesefs mount, unreadable.
        image: chrislusf/seaweedfs:4.47
        # === EXECUTION ============================================ #
        # ONLY FOR SEAWEEDFS (the bundled store). Real S3/R2/MinIO ship their own STS/IAM and ignore
        # all of this. Two configs, both generated from env (no committed files):
        #  - s3.json: the master identity only (admin; the API holds these creds, never the runner).
        #  - iam.json: the ADVANCED IAM config — the only path SeaweedFS authorizes STS credentials.
        #    An OIDC provider points at the API's self-served JWKS; the API mints a short-lived
        #    RS256 web-identity token and calls AssumeRoleWithWebIdentity to assume `agenta-store`.
        entrypoint:
            - sh
            - -c
            - |
              cat > /etc/seaweedfs/s3.json <<EOF
              {"identities":[{"name":"agenta","credentials":[{"accessKey":"$${AGENTA_STORE_ACCESS_KEY}","secretKey":"$${AGENTA_STORE_SECRET_KEY}"}],"actions":["Admin","Read","Write","List","Tagging"]}]}
              EOF
              cat > /etc/seaweedfs/iam.json <<EOF
              {"sts":{"tokenDuration":"1h","maxSessionLength":"12h","issuer":"seaweedfs-sts","signingKey":"$${AGENTA_STORE_SIGNING_KEY}"},"providers":[{"name":"agenta","type":"oidc","enabled":true,"config":{"issuer":"$${AGENTA_STORE_JWT_ISSUER}","clientId":"agenta-store","jwksUri":"$${AGENTA_STORE_JWT_ISSUER}/.well-known/jwks.json"}}],"policies":[{"name":"store-rw","document":{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:*"],"Resource":["arn:aws:s3:::$${AGENTA_STORE_BUCKET}","arn:aws:s3:::$${AGENTA_STORE_BUCKET}/*"]}]}}],"roles":[{"roleName":"agenta-store","roleArn":"arn:aws:iam::role/agenta-store","attachedPolicies":["store-rw"],"trustPolicy":{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Federated":"agenta"},"Action":["sts:AssumeRoleWithWebIdentity"]}]}}]}
              EOF
              exec weed server -dir=/data -ip=seaweedfs -volume.max=64 -s3 -s3.port=8333 -s3.config=/etc/seaweedfs/s3.json -s3.iam.config=/etc/seaweedfs/iam.json
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            AGENTA_SERVICES_INTERNAL_KEY: ""
            # The entrypoint bakes these into s3.json/iam.json via raw shell expansion, so they must
            # be present in this service's env (defaults here are for the bundled store, the same way
            # supertokens carries its own connection URI). Keys come from the env file — secrets never
            # get a baked-in default. Override the whole trio via the env file to use S3/R2/MinIO.
            AGENTA_STORE_ACCESS_KEY: ${AGENTA_STORE_ACCESS_KEY}
            AGENTA_STORE_SECRET_KEY: ${AGENTA_STORE_SECRET_KEY}
            AGENTA_STORE_BUCKET: ${AGENTA_STORE_BUCKET:-agenta-store}
            AGENTA_STORE_SIGNING_KEY: ${AGENTA_STORE_SIGNING_KEY}
            AGENTA_STORE_JWT_ISSUER: ${AGENTA_STORE_JWT_ISSUER:-http://api:8000}
        # === STORAGE ============================================== #
        volumes:
            - seaweed-data:/data
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        # Loopback-only by default (never expose the store to a public IP); override AGENTA_STORE_PORT
        # to change. In-network services reach it directly at seaweedfs:8333, no publish needed.
        ports:
            - "127.0.0.1:${AGENTA_STORE_PORT:-8333}:8333"
        # === LABELS =============================================== #
        # Off by default. Daytona cloud sandboxes reach the store over the internet, so set
        # AGENTA_STORE_TRAEFIK_ENABLE=true and AGENTA_STORE_DOMAIN=<store-host> to publish the
        # S3 endpoint on its own subdomain, terminate TLS at your own proxy, then point
        # AGENTA_STORE_ENDPOINT_URL at https://<store-host>. The router is Host-only (no path
        # rewrite), which SeaweedFS S3 SigV4 requires.
        labels:
            - "traefik.enable=${AGENTA_STORE_TRAEFIK_ENABLE:-false}"
            - "traefik.http.routers.store.rule=Host(`${AGENTA_STORE_DOMAIN:-store.localhost}`)"
            - "traefik.http.routers.store.entrypoints=web"
            - "traefik.http.routers.store.service=store"
            - "traefik.http.services.store.loadbalancer.server.port=8333"
        # === LIFECYCLE ============================================ #
        restart: always
        healthcheck:
            test: ["CMD-SHELL", "curl -sf http://localhost:9333/cluster/healthz >/dev/null || exit 1"]
            interval: 5s
            timeout: 5s
            retries: 30
            start_period: 5s

    traefik:
        # === ACTIVATION =========================================== #
        profiles:
            - with-traefik
        # === IMAGE ================================================ #
        image: traefik:2
        # === EXECUTION ============================================ #
        command:
            - --api.dashboard=true
            - --providers.docker
            - --providers.docker.constraints=Label(`com.docker.compose.project`,`${COMPOSE_PROJECT_NAME:-agenta-oss-gh}`)
            - --entrypoints.web.address=:80
        # === STORAGE ============================================== #
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            AGENTA_SERVICES_INTERNAL_KEY: ""
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        ports:
            - "${TRAEFIK_PORT:-80}:80"
            - "127.0.0.1:${TRAEFIK_UI_PORT:-8080}:8080"
        # === LIFECYCLE ============================================ #
        restart: always

    nginx:
        # === ACTIVATION =========================================== #
        profiles:
            - with-nginx
        # === IMAGE ================================================ #
        image: nginx:1
        # === STORAGE ============================================== #
        volumes:
            - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            AGENTA_SERVICES_INTERNAL_KEY: ""
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        ports:
            - "${NGINX_PORT:-80}:80"
        # === ORCHESTRATION ======================================== #
        depends_on:
            - api
            - web
        # === LIFECYCLE ============================================ #
        restart: always

    supertokens:
        # === IMAGE ================================================ #
        image: supertokens/supertokens-postgresql:11
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            AGENTA_SERVICES_INTERNAL_KEY: ""
            POSTGRESQL_CONNECTION_URI: ${POSTGRES_URI_SUPERTOKENS}
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        # === ORCHESTRATION ======================================== #
        depends_on:
            postgres:
                condition: service_healthy
            alembic:
                condition: service_completed_successfully
        # === LIFECYCLE ============================================ #
        restart: always
        healthcheck:
            test: >
                bash -c 'exec 3<>/dev/tcp/127.0.0.1/3567 && echo -e "GET /hello HTTP/1.1\r\nhost: 127.0.0.1:3567\r\nConnection: close\r\n\r\n" >&3 && cat <&3 | grep "Hello"'
            interval: 10s
            timeout: 5s
            retries: 5

    # Dev tunnel for Composio trigger events (disable: run.sh --no-tunnel).
    composio:
        # === ACTIVATION =========================================== #
        profiles:
            - with-tunnel
        # === IMAGE ================================================ #
        image: python:3.13-slim-trixie
        # === EXECUTION ============================================ #
        command:
            - bash
            - -c
            - "pip install --quiet --root-user-action=ignore composio httpx && python /app/dispatcher_composio.py"
        # === STORAGE ============================================== #
        volumes:
            - ../../../api/entrypoints/dispatcher_composio.py:/app/dispatcher_composio.py:ro
        # === CONFIGURATION ======================================== #
        env_file:
            - ${ENV_FILE:-./.env.oss.gh}
        environment:
            AGENTA_SERVICES_INTERNAL_KEY: ""
            AGENTA_INGRESS_URL: http://api:8000/triggers/composio/events/
            PYTHONUNBUFFERED: "1"
        # === NETWORK ============================================== #
        networks:
            - agenta-oss-gh-network
        # === ORCHESTRATION ======================================== #
        depends_on:
            api:
                condition: service_started
        # === LIFECYCLE ============================================ #
        restart: always

networks:
    agenta-oss-gh-network:

volumes:
    runner-state:
    postgres-data:
    redis-volatile-data:
    redis-durable-data:
    seaweed-data: