# compose.cloud.yml — Multi-tenant cloud stack for menagerie.circuitforge.tech/peregrine
#
# Each authenticated user gets their own encrypted SQLite data tree at
# /devl/menagerie-data/<user-id>/peregrine/
#
# Caddy injects the Directus session cookie as X-CF-Session header before forwarding.
# cloud_session.py resolves user_id → per-user db_path at session init.
#
# Services: api (FastAPI :8601), web (Vue :8508), searxng (internal)
# Streamlit app service removed — Vue+FastAPI is the only frontend (peregrine#104).
#
# Usage:
#   docker compose -f compose.cloud.yml --project-name peregrine-cloud up -d
#   docker compose -f compose.cloud.yml --project-name peregrine-cloud down
#   docker compose -f compose.cloud.yml --project-name peregrine-cloud logs api -f

services:
  api:
    build:
      context: ..
      dockerfile: peregrine/Dockerfile.cfcore
    command: >
      bash -c "uvicorn dev_api:app --host 0.0.0.0 --port 8601"
    ports:
      - "8601:8601"   # LAN-accessible — Caddy gates the public route; Kuma monitors this port directly
    volumes:
      - /devl/menagerie-data:/devl/menagerie-data
      - ./config/llm.cloud.yaml:/app/config/llm.yaml:ro
    environment:
      - CLOUD_MODE=true
      - CLOUD_DATA_ROOT=/devl/menagerie-data
      - STAGING_DB=/devl/menagerie-data/cloud-default.db
      - DIRECTUS_JWT_SECRET=${DIRECTUS_JWT_SECRET}
      - CF_SERVER_SECRET=${CF_SERVER_SECRET}
      - PLATFORM_DB_URL=${PLATFORM_DB_URL}
      - HEIMDALL_URL=${HEIMDALL_URL:-http://cf-license:8000}
      - HEIMDALL_ADMIN_TOKEN=${HEIMDALL_ADMIN_TOKEN}
      - PYTHONUNBUFFERED=1
      - FORGEJO_API_TOKEN=${FORGEJO_API_TOKEN:-}
      - CF_ORCH_URL=http://host.docker.internal:7700
      - CF_APP_NAME=peregrine
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped

  web:
    build:
      context: .
      dockerfile: docker/web/Dockerfile
      args:
        VITE_BASE_PATH: /peregrine/
    ports:
      - "8508:80"
    depends_on:
      - api
    restart: unless-stopped

  # cf-orch-agent: not needed in cloud — a host-native agent already runs on :7701
  # and is registered with the coordinator. app/api reach it via CF_ORCH_URL.

  searxng:
    image: searxng/searxng:latest
    volumes:
      - ./docker/searxng:/etc/searxng:ro
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/"]
      interval: 10s
      timeout: 5s
      retries: 3
    restart: unless-stopped
    # No host port — internal only

networks:
  default:
    external: true
    name: caddy-proxy_caddy-internal
