version: '3.8'

services:
  hardtruth-daemon:
    build:
      context: ..
      dockerfile: docker/Dockerfile
    container_name: hardtruth-daemon
    restart: always
    ports:
      - "127.0.0.1:49281:8000"
    environment:
      # Round 7: daemon API write token. Set the SAME value for the hook via
      # HARDTRUTH_API_TOKEN env, or place it in ~/.hardtruth/daemon_api.key.
      # Generate one with: python3 -c "import secrets; print(secrets.token_hex(32))"
      HARDTRUTH_API_TOKEN: ${HARDTRUTH_API_TOKEN:?set HARDTRUTH_API_TOKEN in your environment}
      # Round 7: map host workspace prefixes to their mount point inside the
      # daemon container so Tier 2 can verify agent workspaces.
      # Example: {"\\/Users\\/ai\\/dev":"\\/workspaces\\/dev"}
      HARDTRUTH_WORKSPACE_MAP: ${HARDTRUTH_WORKSPACE_MAP:-{}}
      # Subprocess execution authorized inside containerized daemon (runs in dedicated container)
      HARDTRUTH_TIER2_ALLOW_SUBPROCESS: "1"
    volumes:
      # Private state volume for ledger and keys (single source of truth).
      - ${HARDTRUTH_STATE_DIR:-~/.hardtruth}:/root/.hardtruth
      # Mount host workspace strictly read-only into container.
      - ${HARDTRUTH_WORKSPACE:-/Users/ai/dev/hardtruth-fix}:${HARDTRUTH_WORKSPACE_MOUNT:-/Users/ai/dev/hardtruth-fix}:ro