# Local overrides for docker-compose.yml
#
# Copy this file to docker-compose.override.yml — Docker Compose picks it up
# automatically on every `docker compose up`, no flags needed.
#
# Only uncomment the sections you actually need.

services:

  # --- Build locally instead of pulling from GHCR ---
  # Useful during development or before the first release image is published.
  #
  # toolmesh:
  #   image: toolmesh:dev
  #   build:
  #     context: .
  #     dockerfile: Dockerfile

  # --- Command credential store (CREDENTIAL_STORE=command) ---
  # ToolMesh runs a command that prints the credentials and keeps them in
  # memory only, so they stay out of .env and out of the container
  # configuration. See docs/configuration.md, "Command store". The image has
  # no shell and no libc: mount the statically linked program and everything
  # it reads. The paths below are examples. If you also build locally
  # (section above), put both into one toolmesh: entry.
  #
  # toolmesh:
  #   volumes:
  #     # The program and the encrypted file it decrypts, e.g. sops:
  #     - /usr/local/bin/sops:/usr/local/bin/sops:ro
  #     - ./secrets/toolmesh.env:/run/secrets/toolmesh.env:ro
  #     # The Unix socket of a local agent the program talks to. Long
  #     # syntax, so that a missing socket stops the start instead of Docker
  #     # creating an empty directory in its place on the host. An agent that
  #     # recreates its socket when it restarts needs a restart of ToolMesh
  #     # as well.
  #     - type: bind
  #       source: /run/example-agent/agent.sock
  #       target: /run/example-agent/agent.sock
  #       bind:
  #         create_host_path: false

  # --- External OpenFGA server (TOOLMESH_AUTHZ_MODE=external) ---
  # Authorization runs inside ToolMesh by default. Uncomment all three services
  # only to run your own OpenFGA server; see the Authorization section in .env
  # and docs/configuration.md ("External mode").
  #
  # openfga-migrate:
  #   image: openfga/openfga:latest
  #   command: migrate
  #   environment:
  #     - OPENFGA_DATASTORE_ENGINE=mysql
  #     - OPENFGA_DATASTORE_URI=${OPENFGA_DB_USER:-openfga}:${OPENFGA_DB_PASSWORD:-openfga}@tcp(mysql:3306)/${OPENFGA_DB_NAME:-openfga}?parseTime=true
  #   depends_on:
  #     mysql:
  #       condition: service_healthy
  #
  # openfga:
  #   image: openfga/openfga:latest
  #   ports:
  #     - "8081:8080"
  #     - "8082:8081"
  #   command: run
  #   environment:
  #     - OPENFGA_DATASTORE_ENGINE=mysql
  #     - OPENFGA_DATASTORE_URI=${OPENFGA_DB_USER:-openfga}:${OPENFGA_DB_PASSWORD:-openfga}@tcp(mysql:3306)/${OPENFGA_DB_NAME:-openfga}?parseTime=true
  #   depends_on:
  #     openfga-migrate:
  #       condition: service_completed_successfully
  #   healthcheck:
  #     test: ["CMD", "/usr/local/bin/grpc_health_probe", "-addr=:8081"]
  #     interval: 5s
  #     timeout: 3s
  #     retries: 5
  #
  # mysql:
  #   image: mysql:8.0
  #   environment:
  #     MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-rootpassword}
  #     MYSQL_DATABASE: ${OPENFGA_DB_NAME:-openfga}
  #     MYSQL_USER: ${OPENFGA_DB_USER:-openfga}
  #     MYSQL_PASSWORD: ${OPENFGA_DB_PASSWORD:-openfga}
  #   volumes:
  #     - mysqldata:/var/lib/mysql
  #   healthcheck:
  #     test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
  #     interval: 10s
  #     timeout: 5s
  #     retries: 10
  #     start_period: 30s

  # --- Reverse proxy (HTTPS / Claude.ai access) ---
  # caddy:
  #   image: caddy:2-alpine
  #   ports:
  #     - "443:443"
  #     - "80:80"
  #   volumes:
  #     - ./Caddyfile:/etc/caddy/Caddyfile:ro
  #     - caddy_data:/data
  #     - caddy_config:/config
  #   depends_on:
  #     - toolmesh

# volumes:
#   mysqldata:    # uncomment together with the OpenFGA services above
#   caddy_data:
#   caddy_config: