name: ${COMPOSE_PROJECT_NAME:-openmausbot}
services:
  omb:
    # Collects exited browser processes; Chrome's shared memory as on the
    # desktop containers (docs/browser-packaging.md, "Process hygiene").
    init: true
    shm_size: 512m
    build:
      context: ./deploy/local
      args:
        BASE_IMAGE: ${OMB_BASE_IMAGE:-ghcr.io/milind-soni/openmausbot:latest}
        ENGINES: ${ENGINES-@anthropic-ai/claude-code @openai/codex}
    image: ${OMB_LOCAL_IMAGE:-openmausbot-local:latest}
    restart: unless-stopped
    volumes:
      - data:/data
      - edge:/run/openmausbot
    environment:
      OMB_PORT: "8799"
      OMB_WEBHOOK_PORT: "8800"
      # Caddy, in its own container, reaches the server over these (deploy/local/Caddyfile). A request on a socket is
      # never a local one. Caddy does not share the server's network: a server restarted on its own would come back
      # in a new one and leave Caddy, and the port, behind in the old one.
      OMB_TUNNEL_SOCKET: /run/openmausbot/http.sock
      OMB_WEBHOOK_SOCKET: /run/openmausbot/hooks.sock
      # The name the desktop app shows for this server (a container's own hostname is a random id).
      OMB_SERVER_NAME: ${OMB_SERVER_NAME:-mausbot-docker}
      OMB_PUBLIC_URL: ${OMB_PUBLIC_URL:-http://localhost:${OMB_HTTP_PORT:-8080}}
      OMB_WEBHOOK_PUBLIC_URL: ${OMB_WEBHOOK_PUBLIC_URL:-${OMB_PUBLIC_URL:-http://localhost:${OMB_HTTP_PORT:-8080}}}
      # "1": phones pair by QR through MausBot Relay (docs/phone-relay-server.md). Sign the
      # container in once first: docker compose exec omb openmausbot login --relay
      OMB_PHONE_RELAY: ${OMB_PHONE_RELAY:-}
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - "fetch('http://127.0.0.1:8799/api/health', { signal: AbortSignal.timeout(4000) }).then(async r => { if (!r.ok || !(await r.text()).includes('openmausbot')) process.exit(1); }).catch(() => process.exit(1))"
      interval: 15s
      timeout: 5s
      start_period: 30s
      retries: 5
  caddy:
    image: ${CADDY_IMAGE:-caddy:2}
    restart: unless-stopped
    ports:
      - "${OMB_BIND_ADDRESS:-127.0.0.1}:${OMB_HTTP_PORT:-8080}:80"
    environment:
      OMB_HTTPS_HOST: ${OMB_HTTPS_HOST:-}
      OMB_BIND_ADDRESS: ${OMB_BIND_ADDRESS:-127.0.0.1}
    command:
      - /bin/sh
      - -ec
      - |
        export OMB_UPSTREAM_SCHEME=http
        if [ -n "$$OMB_HTTPS_HOST" ] && [ "$$OMB_BIND_ADDRESS" != "127.0.0.1" ]; then
          echo "OMB_HTTPS_HOST requires OMB_BIND_ADDRESS=127.0.0.1; forward HTTPS through a trusted local proxy." >&2
          exit 1
        fi
        if [ -n "$$OMB_HTTPS_HOST" ]; then
          export OMB_UPSTREAM_SCHEME=https
        fi
        exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
    # Started with the server, not after it is healthy: Caddy reaches it over the socket
    # whenever it answers, so `up` never waits on the server's health, and HTTPS is back
    # as soon as a restarted server is.
    depends_on:
      omb:
        condition: service_started
    volumes:
      - ./deploy/local/Caddyfile:/etc/caddy/Caddyfile:ro
      - edge:/run/openmausbot
      - caddy_data:/data
      - caddy_config:/config
volumes:
  data:
    external: ${OMB_DATA_EXTERNAL:-false}
    name: ${OMB_DATA_VOLUME:-${COMPOSE_PROJECT_NAME:-openmausbot}_data}
  # The two sockets: in memory, made afresh by the server at each start. Not under /data, which every bot's sandbox
  # sees; the sandbox has its own /run.
  edge:
    driver_opts:
      type: tmpfs
      device: tmpfs
      o: mode=1777,size=1m
  caddy_data:
  caddy_config: