docker-compose.yml

# SaaS deployment from this checkout: the public website and multi-tenant control plane.
# Run `docker compose up --build`; this file deliberately builds local source and never pulls
# MindWire application images. For versioned, prebuilt self-hosted images, use the Compose file below.
# Agent runtimes are selected per session; this stack intentionally does not mount Docker or run a daemon.
# For a private console plus daemon, use packages/docker/docker-compose.selfhost.yml instead.

services:
  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-mindwire}
      POSTGRES_USER: ${POSTGRES_USER:-mindwire}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      # Separate 32-byte base64url/hex key for the encrypted user credential vault.
      SECRETS_ENCRYPTION_KEY: ${SECRETS_ENCRYPTION_KEY}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U mindwire -d mindwire"]
      interval: 10s
      timeout: 5s
      retries: 10

  web:
    build:
      context: .
      dockerfile: packages/docker/web.Dockerfile
      args:
        NEXT_PUBLIC_CONSOLE_URL: ${NEXT_PUBLIC_CONSOLE_URL:-https://console.mindwire.sh}
        NEXT_PUBLIC_IOS_APP_URL: ${NEXT_PUBLIC_IOS_APP_URL:-}
    restart: unless-stopped
    environment:
      NODE_ENV: production
      PORT: "4327"
    ports:
      - "${MINDWIRE_BIND_ADDR:-127.0.0.1}:${WEB_PORT:-4327}:4327"

  console:
    build:
      context: .
      dockerfile: packages/docker/console.Dockerfile
    restart: unless-stopped
    env_file:
      - path: .env
        required: false
    environment:
      NODE_ENV: production
      PORT: "8787"
      CONSOLE_MODE: cloud
      ALLOW_LOCAL_RUNTIME: "false"
      ALLOW_SSH_RUNTIME: "false"
      ALLOW_DOCKER_RUNTIME: "false"
      ALLOW_REMOTE_RUNTIME: "true"
      # An explicit DATABASE_URL is supported for managed Postgres. Otherwise the console builds a safe
      # connection URL from these standard Postgres settings (including correctly escaped passwords).
      DATABASE_URL: ${DATABASE_URL:-}
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DB: ${POSTGRES_DB:-mindwire}
      POSTGRES_USER: ${POSTGRES_USER:-mindwire}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      # Better Auth's canonical public origin. Override BASE_URL for a custom SaaS domain; it is also
      # the OAuth callback origin and is automatically included in the trusted-origin allowlist.
      BASE_URL: ${BASE_URL:-https://console.mindwire.sh}
      SEED_DEFAULT_DAEMON: "false"
    ports:
      - "${MINDWIRE_BIND_ADDR:-127.0.0.1}:${CONSOLE_PORT:-8787}:8787"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8787/api/ping').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3

volumes:
  postgres_data: