services:
  marketplace:
    build: .
    ports:
      - "127.0.0.1:8080:8080"
    environment:
      - DATABASE_URL=${DATABASE_URL:-sqlite+aiosqlite:////app/data/agent_marketplace.db}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY:?Set ENCRYPTION_KEY before starting}
      - AGENT_IMAGE=agent-marketplace-agent:latest
      - MARKETPLACE_URL=${MARKETPLACE_URL:-https://hive.rajeev.me}
      - HIVE_URL=http://localhost:8080
      - HIVE_DOMAIN=${HIVE_DOMAIN:-hive.rajeev.me}
      - SECRET_KEY=${SECRET_KEY:?Set SECRET_KEY before starting}
      - HIVE_SIGNING_SECRET=${HIVE_SIGNING_SECRET:?Set HIVE_SIGNING_SECRET before starting}
      - REDIS_URL=redis://redis:6379/0
      - DEV_MODE=0
      - COOKIE_SECURE=${COOKIE_SECURE:-1}
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-https://hive.rajeev.me}
      - OPENCLAW_IMAGE=${OPENCLAW_IMAGE:-openclaw/openclaw:latest}
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      - HIVE_URL_OVERRIDE=${HIVE_URL_OVERRIDE:-}
      - HIVE_SSL_CERT=${HIVE_SSL_CERT:-}
      - HIVE_SSL_KEY=${HIVE_SSL_KEY:-}
      - OPENCLAW_VPS_HOST=${OPENCLAW_VPS_HOST:-}
      - OPENCLAW_VPS_SSH_KEY_PATH=${OPENCLAW_VPS_SSH_KEY_PATH:-/root/.ssh/openclaw_deploy_key}
      - OPENCLAW_VPS_SSH_USER=${OPENCLAW_VPS_SSH_USER:-root}
      - OPENCLAW_VPS_SSH_PORT=${OPENCLAW_VPS_SSH_PORT:-22}
      # Docker access is config-driven: point DOCKER_HOST at a docker-socket
      # proxy or remote daemon. The host socket is NEVER mounted into Hive.
      # See docs/HLD/07-deployment.md for the recommended setup.
      - DOCKER_HOST=${DOCKER_HOST:-tcp://docker-socket-proxy:2375}
      - HIVE_REQUIRE_DOCKER=${HIVE_REQUIRE_DOCKER:-1}
    volumes:
      - ./data:/app/data
      - /root/.ssh:/root/.ssh:ro
    depends_on:
      - redis
    restart: unless-stopped
    networks:
      - agent-marketplace

  redis:
    image: redis:7-alpine
    command: ["redis-server", "--appendonly", "yes", "--maxmemory-policy", "allkeys-lru"]
    volumes:
      - redis-data:/data
    restart: unless-stopped
    networks:
      - agent-marketplace

  # Read-only Docker API proxy: exposes a *filtered* Docker API to Hive
  # (container/image/network ops only — no exec, no host mounts, no root).
  # Enable with: docker compose --profile with-docker up -d
  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy
    environment:
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - POST=1
      - VOLUMES=0
      - EXEC=0
      - ALLOW_RESTARTS=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - agent-marketplace
    restart: unless-stopped
    profiles:
      - with-docker

volumes:
  redis-data:

networks:
  agent-marketplace:
    driver: bridge