# Run the Cirdan repair daemon in a container: it receives alerts over HTTP
# (/v1/ingest/*), reproduces failures in isolated compose stacks via the host's
# Docker (the mounted socket), and opens verified fix PRs. Mount a project root
# holding cirdan.yaml (the services: registry) at /workspace.
services:
  cirdand:
    build: .
    volumes:
      - .:/workspace:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - cirdan-out:/workspace/cirdan-out
    environment:
      # Passed through from the host environment when set:
      - CIRDAN_INGEST_TOKEN   # bearer auth for /v1/ingest/* (required once auto-remediation is active)
      - CIRDAN_MASTER_KEY     # unlocks the encrypted credential store (headless installs)
      - ANTHROPIC_API_KEY     # API-provider coding agent ("Use the API" posture)
      - OPENAI_API_KEY
    ports:
      - "127.0.0.1:8090:8090"
    restart: unless-stopped

volumes:
  cirdan-out: