services:
  docker:
    image: docker:dind
    container_name: opencode-docker
    privileged: true
    cap_add:
      - ALL
    security_opt:
      - apparmor=unconfined
      - seccomp=unconfined
    environment:
      - DOCKER_TLS_CERTDIR=/certs
    volumes:
      - docker-data:/var/lib/docker
      - docker-certs-client:/certs/client
    restart: unless-stopped

  opencode:
    image: ghcr.io/almeidapaulopt/opencode-web:latest
    build: .
    container_name: opencode-web
    depends_on:
      - docker
    command: ["web", "--hostname", "0.0.0.0", "--port", "4096"]
    ports:
      - "4096:4096"
      - "2222:22"
    environment:
      - GIT_USER_NAME=${GIT_USER_NAME:-}
      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}
      - DOCKER_HOST=tcp://docker:2376
      - DOCKER_TLS_VERIFY=1
      - DOCKER_CERT_PATH=/docker-certs
    secrets:
      - opencode_password
    volumes:
      - opencode-home:/home/opencode
      - opencode-workspace:/home/opencode/workspace
      - docker-certs-client:/docker-certs:ro
    restart: unless-stopped

secrets:
  opencode_password:
    file: ./opencode_password.txt

volumes:
  opencode-home:
  opencode-workspace:
  docker-data:
  docker-certs-client: