services:
  portal:
    build: .
    container_name: pithagoras
    restart: unless-stopped
    network_mode: host
    volumes:
      - portal-data:/data
      # Workspaces pi works in. Read-write: the whole point is that it edits code.
      - ${WORKSPACES_DIR:-/root/repos}:/workspaces
      # Only needed when EXECUTOR=container.
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      # With host networking the portal binds PORT directly on the host.
      PORT: ${PORT:-4100}
      PORTAL_PASSWORD: ${PORTAL_PASSWORD:?set PORTAL_PASSWORD in .env}
      # Keeps logins valid across restarts; generate with: openssl rand -hex 32
      PORTAL_SECRET: ${PORTAL_SECRET:-}
      # host = pi runs in this container | container = one container per task
      EXECUTOR: ${EXECUTOR:-host}
      # Overrides only — left empty so pi's own settings.json (defaultProvider,
      # defaultModel) decides. Baking values in here made those unreachable.
      PI_PROVIDER: ${PI_PROVIDER:-}
      PI_MODEL: ${PI_MODEL:-}
      PI_THINKING_LEVEL: ${PI_THINKING_LEVEL:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}

volumes:
  portal-data: