# ThetaBot — one long-lived container (scanner + monitor + reconcile + dashboard).
# Deploy on any Docker host (e.g. a Hostinger VPS):  docker compose up -d --build
services:
  agentic:
    build: .
    image: thetabot:latest
    restart: unless-stopped
    env_file:
      - .env                  # your secrets (copy from .env.example)
    environment:
      - TZ=America/New_York   # market-hours logic uses US/Eastern
    ports:
      - "8000:8000"           # dashboard + API (put HTTPS in front for production — see README)
    volumes:
      - ./data:/app/data                      # SQLite state + rh_oauth.json (back this up)
      - ./config.yaml:/app/config.yaml:ro     # your strategy config (copy from config.example.yaml)
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=3).status==200 else 1)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

  # --- Optional: secure public access via a Cloudflare Tunnel (no open ports on your VPS) ---
  # Setup: create a tunnel in the Cloudflare dashboard (free), route its public hostname to
  #   http://agentic:8000, copy the tunnel token into .env as CLOUDFLARE_TUNNEL_TOKEN, then:
  #   docker compose --profile tunnel up -d
  # Add Cloudflare Access on that hostname for a real login layer. See README > Dashboard access.
  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    profiles: [tunnel]        # off by default; only starts with `--profile tunnel`
    command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN:-}
    depends_on:
      - agentic