services:
  mission-control:
    build: .
    container_name: mission-control
    ports:
      - "${MC_PORT:-3000}:${PORT:-3000}"
    environment:
      - PORT=${PORT:-3000}
      # ── Server-side gateway connection (MC backend → gateway) ──
      # host.docker.internal resolves to the Docker host on Docker Desktop (macOS/Windows).
      # On Linux, the extra_hosts entry below makes this work.
      # If your gateway runs in another container, set this to the container name instead.
      - OPENCLAW_GATEWAY_HOST=${OPENCLAW_GATEWAY_HOST:-host.docker.internal}
      - OPENCLAW_GATEWAY_PORT=${OPENCLAW_GATEWAY_PORT:-18789}
      # ── Browser-side gateway connection (user's browser → gateway) ──
      # NEXT_PUBLIC_GATEWAY_HOST must be reachable from the user's browser, NOT from
      # inside the container. For local Docker: leave empty (auto-detected from browser).
      # For remote/VPS: set to the public hostname or IP where the gateway is reachable.
      #
      # IMPORTANT: NEXT_PUBLIC_* variables are baked into the browser bundle at BUILD TIME,
      # not runtime. Setting them here only works if you rebuild the image:
      #   NEXT_PUBLIC_GATEWAY_HOST=oc.example.com docker compose build
      # Alternative: use the Advanced Settings on the login page to set the gateway URL
      # at runtime — it persists in localStorage and overrides the baked-in value.
      # - NEXT_PUBLIC_GATEWAY_HOST=${NEXT_PUBLIC_GATEWAY_HOST:-}
      # - NEXT_PUBLIC_GATEWAY_PORT=${NEXT_PUBLIC_GATEWAY_PORT:-18789}
      # Set to true if running without an OpenClaw gateway (standalone dashboard mode).
      # - NEXT_PUBLIC_GATEWAY_OPTIONAL=true
    env_file:
      - path: .env
        required: false
    volumes:
      - mc-data:/app/.data
      # Optional: mount your OpenClaw state directory read-only so Mission Control
      # can read agent configs and memory. Uncomment and adjust the host path:
      # - ${OPENCLAW_HOME:-~/.openclaw}:/run/openclaw:ro
    # Allow the container to reach an OpenClaw gateway running on the Docker host.
    # Docker Desktop (macOS/Windows): host.docker.internal works out of the box.
    # Linux: this extra_hosts entry maps host.docker.internal to the host IP.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    read_only: true
    tmpfs:
      - /tmp
      - /app/.next/cache
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1.0'
          pids: 256
    networks:
      - mc-net
    restart: unless-stopped

  # Standalone mode — no gateway required. Start with:
  #   docker compose --profile standalone up
  mission-control-standalone:
    extends:
      service: mission-control
    container_name: mission-control-standalone
    profiles:
      - standalone
    environment:
      - PORT=${PORT:-3000}
      - NEXT_PUBLIC_GATEWAY_OPTIONAL=true

volumes:
  mc-data:

networks:
  mc-net:
    driver: bridge