---
include:
 - docker-compose-traefik.yml
 - docker-compose-authentik.yml

services:
  web:
    build:
      context: .
      dockerfile: web.Dockerfile
    image: ghcr.io/eli-labz/ai-agent-container:latest
    container_name: ai-agent-container-web
    restart: unless-stopped
    volumes:
      - flowcase-data:/flowcase/data
      - flowcase-nginx-data:/flowcase/nginx
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - FLASK_APP=run.py
      - FLASK_DEBUG=0
      - AI_AGENT_CONTAINER_ENV=production
      - AI_AGENT_CONTAINER_HOST=${AI_AGENT_CONTAINER_HOST:-0.0.0.0}
      - AI_AGENT_CONTAINER_PORT=5000
      - AI_AGENT_CONTAINER_DATABASE_URL=${AI_AGENT_CONTAINER_DATABASE_URL:-}
      - SECRET_KEY=${SECRET_KEY:-}
      - DOCKER_HOST=${DOCKER_HOST:-unix:///var/run/docker.sock}
    networks:
      - default_network
    command: python run.py # --traefik-authentik # --registry-lock https://my-private-locked-registry.example
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5000/api/v1/health', timeout=3)"]
      interval: 30s
      timeout: 5s
      retries: 3

  nginx:
    image: nginx:1.28-alpine
    container_name: flowcase-nginx
    restart: unless-stopped
    volumes:
      - flowcase-nginx-data:/etc/nginx/conf.d
    depends_on:
      web:
        condition: service_healthy
    labels:
      - traefik.enable=true
      - traefik.http.routers.ai-agent-container.rule=Host(`${DOMAIN}`)
      - traefik.http.routers.ai-agent-container.entrypoints=websecure
      - traefik.http.routers.ai-agent-container.tls.certresolver=acme-resolver
      - traefik.http.services.ai-agent-container.loadbalancer.server.port=80
      # enable middleware to add authentication by authentik
      # - traefik.http.routers.ai-agent-container.middlewares=authentik@file
      - traefik.docker.network=proxy_network
    networks:
      - default_network
      - proxy_network

networks:
  default_network:
    driver: bridge
  proxy_network:
    name: proxy_network

volumes:
  flowcase-data:
    external: false
  flowcase-nginx-data:
    external: false