services:
  # ============ PROXY - holds all API secrets ============
  proxy:
    build: ./proxy
    container_name: proxy
    restart: unless-stopped
    networks:
      - agent-net
    environment:
      # Secrets are injected via .env (host), but only into this proxy container.
      # The agent container never receives API keys.
      - PROXY_PORT=3200
      - BASE_URL=${BASE_URL}
      - API_KEY=${API_KEY}
      - ZAI_API_KEY=${ZAI_API_KEY}
      - TAVILY_API_KEY=${TAVILY_API_KEY}
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:3200/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M

  # ============ GATEWAY - Telegram bot + Agent ============
  gateway:
    build: .
    container_name: gateway
    restart: unless-stopped
    depends_on:
      proxy:
        condition: service_healthy
    environment:
      # NO API KEYS HERE! Only proxy URL
      - PROXY_URL=${PROXY_URL:-http://proxy:3200}
      - MODEL_NAME=${MODEL_NAME:-google/gemini-3-flash-preview}
      - BOT_PROFILE=${BOT_PROFILE:-october}
      - MCP_PORT=${MCP_PORT:-3100}
      - MCP_URL=${MCP_URL:-http://localhost:3100}
      - WORKSPACE=/workspace
      - MAX_CONCURRENT_USERS=${MAX_CONCURRENT_USERS:-10}
      - AGENT_CWD=/workspace
      - TELEGRAM_TOKEN=${TELEGRAM_TOKEN}
    volumes:
      - ./workspace:/workspace
    networks:
      - agent-net
    healthcheck:
      test: ["CMD", "node", "-e", "console.log('ok')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

networks:
  agent-net:
    driver: bridge
    internal: false