# OpsDash — launch the whole panel with `docker compose up`.
#
# Quick start:
#   1. docker compose build    # builds the image (uses host proxy if set)
#   2. docker compose up -d
#   3. open http://localhost:3001
#
# Discovery is automatic: OpsDash lists containers via the Docker socket and
# groups them by the `com.docker.compose.project` label. It needs NO configured
# directory to discover projects — that's purely from container labels.
#
# Optional performance optimization: mount frequently used project dirs at the
# SAME path inside the container:
#   OpsDash groups compose projects by the `com.docker.compose.project.working_dir`
#   label, whose value is the HOST path where `docker compose` was run. For file
#   editing / lifecycle ops to work from inside the container, that host path must
#   be reachable at the identical path here — hence `${DIR}:${DIR}` (same path
#   both sides). The backend's allowlist only ever permits paths Docker itself
#   reported. Without a permanent mount, selected projects use a short-lived
#   workspace container that bind-mounts only the selected project directory.
#
#   Mount as many dirs as you like (one `- /host/path:/host/path` line each).
#   Projects whose dir isn't permanently mounted still show up. Once explicitly
#   managed and granted Compose access, editing and full Compose actions run in
#   the isolated workspace container without recreating OpsDash.
#   File access alone does not grant control: newly discovered projects must also
#   be explicitly selected in Settings > Project Management before operations run.
#
# Proxy (build + AI calls):
#   Build-time apt/npm need network. If you're behind a proxy (e.g. Clash on
#   127.0.0.1:7897), set HTTP_PROXY/HTTPS_PROXY in your shell BEFORE
#   `docker compose build` — BuildKit forwards them into the build stages.
#   At runtime the same vars (if set below) also route the AI assistant's
#   outbound calls through the proxy. Leave them unset for direct connectivity.

services:
  opsdash:
    build:
      context: .
      # apt 源默认已切到清华镜像(Dockerfile 里 APT_MIRROR 的默认值就是它),
      # 所以 `docker compose up -d --build` 直接可用,不必再手动传 build-arg。
      # BuildKit 也会自动把宿主 shell 的 HTTP_PROXY/HTTPS_PROXY/NO_PROXY 透传进构建阶段,
      # 设了代理时 apt/npm 会自动走代理。
      #   想换镜像源:docker compose build --build-arg APT_MIRROR=mirrors.ustc.edu.cn
      #   想强制走官方源:docker compose build --build-arg APT_MIRROR=
      # (镜像内部已内置 docker / docker compose / git / ssh,无需再装 docker-ce-cli。)
      args:
        APT_MIRROR: mirrors.tuna.tsinghua.edu.cn
    image: stanly1997/opsdash:latest
    container_name: opsdash
    restart: unless-stopped
    init: true
    ports:
      # Published on all interfaces (change to "127.0.0.1:28765:3001" for
      # localhost-only). For remote access prefer Tailscale or a TLS reverse
      # proxy instead of publishing to the LAN/Internet.
      - "0.0.0.0:28765:3001"
    volumes:
      # Talk to the host Docker engine (dockerode + `docker compose` CLI).
      # This alone is enough to DISCOVER all compose projects (read-only list).
      - /var/run/docker.sock:/var/run/docker.sock
      # --- Optional: mount your compose project dirs (same path both sides) ---
      # Uncomment / add one line per host dir you want to be EDITABLE from the panel.
      # This is optional. Unmounted dirs use project-scoped workspace containers
      # after explicit approval in Settings > Project Management.
      # - /home/sgy/compose-projects:/home/sgy/compose-projects
      # - /opt/app:/opt/app
      # SQLite DB (AI config + API key + history) persists across rebuilds.
      - opsdash-data:/app/backend/data
    environment:
      - SERVE_FRONTEND=1
      - PORT=3001
      - HOST=0.0.0.0
      - LOG_LEVEL=info
      - ENABLE_SHELL=1
      # 按需 Compose 工作容器复用时间与最多缓存项目数。
      # - COMPOSEOPS_WORKSPACE_IDLE_MS=90000
      # - COMPOSEOPS_WORKSPACE_CACHE_MAX=8
      # Optional unattended setup. Prefer the first-run browser setup so the
      # password does not remain in compose environment metadata.
      # - ADMIN_PASSWORD=replace-with-at-least-10-characters
      # 运行时 AI 出站走代理(若你的 AI Base URL 需翻墙)。Node 22 内置 fetch
      # 自动识别 HTTP_PROXY/HTTPS_PROXY/NO_PROXY。不需要时整段注释掉。
      # - HTTP_PROXY=http://host.docker.internal:7897
      # - HTTPS_PROXY=http://host.docker.internal:7897
      # - NO_PROXY=localhost,127.0.0.1
      # Optional: override docker binary, e.g. COMPOSE_BIN=docker-compose
      # - COMPOSE_BIN=docker
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:3001/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    labels:
      - myops.owner=Personal

volumes:
  opsdash-data: