# Reference deployment when Paperclip, the bridge and the Hermes Agent all run
# on the SAME host. For split-domain topologies (Paperclip on one VPS, Hermes
# elsewhere) use the bridge's own docker-compose.yml from
# https://github.com/felipefontoura/paperclip-skills-bridge

services:
  paperclip:
    # Upstream image — pin to a release tag in production. `:latest` is fine for
    # local development where you can `docker compose pull` deliberately.
    image: ghcr.io/paperclipai/paperclip:${PAPERCLIP_IMAGE_TAG:-latest}
    restart: unless-stopped
    ports:
      - "3100:3100"
    environment:
      DATABASE_URL: ${DATABASE_URL}
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
      PAPERCLIP_PUBLIC_URL: ${PAPERCLIP_PUBLIC_URL:-http://localhost:3100}
    depends_on:
      hermes-gateway:
        condition: service_healthy
      paperclip-skills-bridge:
        condition: service_healthy
    networks: [paperclip-net]
    healthcheck:
      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3100/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
      interval: 15s
      timeout: 3s
      retries: 5
      start_period: 30s

  paperclip-skills-bridge:
    # Companion package — same author, separate repo:
    # https://github.com/felipefontoura/paperclip-skills-bridge
    image: ${BRIDGE_IMAGE:-ghcr.io/felipefontoura/paperclip-skills-bridge:0.1.0}
    restart: unless-stopped
    environment:
      PAPERCLIP_URL: http://paperclip:3100
      PAPERCLIP_COMPANY_ID: ${PAPERCLIP_COMPANY_ID}
      PAPERCLIP_API_KEY: ${PAPERCLIP_API_KEY:-}
      PAPERCLIP_SESSION_COOKIE: ${PAPERCLIP_SESSION_COOKIE:-}
      BRIDGE_AUTH_TOKEN: ${BRIDGE_AUTH_TOKEN:-}
    networks: [paperclip-net]
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - "fetch('http://127.0.0.1:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
      interval: 15s
      timeout: 3s
      retries: 3
      start_period: 10s

  hermes-gateway:
    # Hermes image — pin in production. The Hermes team ships frequent
    # breaking changes, so `:latest` here can surprise you.
    image: nousresearch/hermes-agent:${HERMES_IMAGE_TAG:-latest}
    restart: unless-stopped
    command: ["gateway", "run"]
    environment:
      HERMES_UID: ${HERMES_UID:-10000}
      HERMES_GID: ${HERMES_GID:-10000}
      API_SERVER_ENABLED: "true"
      API_SERVER_KEY: ${HERMES_API_KEY}
      API_SERVER_HOST: "0.0.0.0"
      API_SERVER_PORT: "8642"
      API_SERVER_MODEL_NAME: ${HERMES_MODEL_NAME:-hermes-agent}
    volumes:
      - hermes-data:/opt/data
      - ./reference/hermes-config.yaml:/opt/data/config.yaml:ro
    networks: [paperclip-net]
    healthcheck:
      # Hermes API server doesn't advertise an unauthenticated probe, so we
      # hit `/v1/models` with the bearer; consider the service healthy once it
      # answers with HTTP 200.
      test:
        - CMD-SHELL
        - "curl -fsS -H \"Authorization: Bearer $${API_SERVER_KEY}\" http://127.0.0.1:8642/v1/models >/dev/null"
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 60s

volumes:
  hermes-data:

networks:
  paperclip-net:
    driver: bridge