x-common-config: &common-config
  build:
    context: .
    dockerfile: Dockerfile
    args:
      PAWBOT_CHANNELS: ${PAWBOT_CHANNELS:-whatsapp}
  volumes:
    - ~/.pawbot:/home/pawbot/.pawbot
  cap_drop:
    - ALL
  # Entrypoint uses these to fix bind-mount ownership and drop to the pawbot user.
  cap_add:
    - CHOWN
    - SETGID
    - SETUID
  # Prevent the non-root process from regaining capabilities through setuid
  # binaries or file capabilities left inside the container image.
  security_opt:
    - no-new-privileges:true

services:
  pawbot-gateway:
    container_name: pawbot-gateway
    <<: *common-config
    command: ["gateway"]
    restart: unless-stopped
    ports:
      - 127.0.0.1:18790:18790
      - 8765:8765
    deploy:
      resources:
        limits:
          cpus: "1"
          memory: 1G
        reservations:
          cpus: "0.25"
          memory: 256M

  pawbot-api:
    container_name: pawbot-api
    <<: *common-config
    # The API server is an optional dependency group; install it in this
    # service explicitly instead of inheriting the gateway's channel-only image.
    build:
      context: .
      dockerfile: Dockerfile
      args:
        PAWBOT_CHANNELS: ${PAWBOT_CHANNELS:-whatsapp}
        PAWBOT_EXTRAS: api
    # Set PAWBOT_API_KEY in the shell or .env when using the 0.0.0.0 bind below.
    environment:
      PAWBOT_API_KEY: ${PAWBOT_API_KEY:-}
    command:
      ["serve", "--host", "0.0.0.0", "-w", "/home/pawbot/.pawbot/api-workspace"]
    restart: unless-stopped
    ports:
      - 127.0.0.1:8900:8900
    deploy:
      resources:
        limits:
          cpus: "1"
          memory: 1G
        reservations:
          cpus: "0.25"
          memory: 256M

  pawbot-cli:
    <<: *common-config
    profiles:
      - cli
    command: ["status"]
    stdin_open: true
    tty: true