# docker compose up -d   →   http://127.0.0.1:4400
# One service, one named volume, one replica: weave is a single SQLite writer.
# Put a front door in front of the published port before exposing it — see
# the Handbook guide "Self-host weave: choose your door".
services:
  weave:
    build: .
    image: weave:local
    restart: unless-stopped
    ports:
      - "4400:4400"
    volumes:
      - weave-data:/data
    environment:
      PORT: 4400
      WEAVE_HOST: 0.0.0.0
      WEAVE_DATA: /data/workspace.db
      WEAVE_KEYSTORE: /data/keystore.json
      WEAVE_BASE_DOMAIN: ""
      WEAVE_OPEN_SIGNUP: ""
      WEAVE_SIGNUP_LIMIT: 1
      # Set this and no key file lands on the volume (Handbook → "Environment reference").
      # WEAVE_KEYSTORE_PASSPHRASE: change-me
      # Sign-in (Handbook → "Door C: sign in with a provider"): the origin browsers
      # use, and 1 when a reverse proxy sits in front so rate limits see the client.
      # WEAVE_ORIGIN: https://weave.example.com
      # WEAVE_TRUST_PROXY: "1"
      # Set this (plus the bucket credentials — Handbook → "Backup and restore")
      # and the server backs itself up nightly at 04:00 UTC, thirty archives kept.
      # WEAVE_BACKUP_DEST: s3://bucket/weave
      # Sign in with one OpenID Connect provider (Handbook → "Door C: sign in
      # with a provider"); its redirect URI is <WEAVE_ORIGIN>/api/auth/oidc/callback.
      # WEAVE_OIDC_ISSUER: https://clerk.example.com
      # WEAVE_OIDC_CLIENT_ID: change-me
      # WEAVE_OIDC_CLIENT_SECRET: change-me
      # WEAVE_OIDC_NAME: Clerk
      # Email invites through Resend (Handbook → "Environment reference"):
      # both set, or weave sends no email and Members shows the link to copy.
      # WEAVE_MAIL_KEY: change-me
      # WEAVE_MAIL_FROM: weave <no-reply@mail.example.com>
      # WEAVE_CLERK_SECRET_KEY: change-me
      # WEAVE_CLERK_PUBLISHABLE_KEY: pk_live_change-me
      # WEAVE_BILLING_PLAN: seat
      # WEAVE_BILLING_SINCE: 2026-10-16T00:00:00Z
      # WEAVE_TRIAL_DAYS: "14"
      # With a provider set, /mcp signs agents in through the browser; a second
      # domain for it on this service is listed here (Handbook, Door C).
      # WEAVE_MCP_ORIGINS: https://mcp.weave.example.com
      # Extra Host names this server answers besides loopback and WEAVE_ORIGIN's
      # host (Handbook, "Environment reference"); any other Host gets 421.
      # WEAVE_ALLOWED_HOSTS: weave.internal,10.0.0.5
      # Other origins allowed to frame weave pages; they join frame-ancestors 'self'.
      # WEAVE_FRAME_ANCESTORS: https://intranet.example.com
      # Attachment types served in place beside images, PDF and plain text.
      # WEAVE_INLINE_FILE_TYPES: audio/mpeg,video/mp4
      # A passcode the task applet at /t asks for before it opens.
      # WEAVE_APPLET_PASSCODE: change-me
      # Workflow webhooks refuse loopback, link-local and private addresses and
      # follow no redirect; 1 allows the ranges for hooks on this network.
      # WEAVE_WEBHOOK_ALLOW_PRIVATE: "1"
      # The server asks GitHub for the latest release once a day; off stops it.
      # WEAVE_UPDATE_CHECK: "off"
      # With command ["node", "bin/weave.js", "supervise"], 1 installs each newer
      # release from grunion-ai/weave main in place (Handbook → "Deploy: Railway").
      # WEAVE_AUTO_UPDATE: "1"
      # The most rows one API call returns when it names a limit (Handbook → "Environment reference").
      # WEAVE_MAX_ROWS: "500"
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:4400/api/health').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3

volumes:
  weave-data: