name: nomadcode-core

services:
  nomadcode-core:
    build: .
    environment:
      APP_ENV: dev
      HTTP_ADDR: :8080
      DATABASE_URL: ${DATABASE_URL:-postgres://nomadcode:nomadcode@code-server-postgres:5432/nomad-core-dev?sslmode=disable}
      REDIS_URL: ${DEV_REDIS_URL:-redis://code-server-redis:6379/4}
      REDIS_KEY_PREFIX: ${DEV_REDIS_KEY_PREFIX:-nomadcode-core:dev}
      AUTH_USERNAME: ${AUTH_USERNAME:-nomadcode}
      AUTH_PASSWORD: ${AUTH_PASSWORD:-}
      MODEL_BASE_URL: ${MODEL_BASE_URL:-http://toki-labs.com:18083/v1}
      MODEL_API_KEY: ${MODEL_API_KEY:-}
      MODEL_NAME: ${MODEL_NAME:-codex}
      MODEL_CONTEXT_SIZE: ${MODEL_CONTEXT_SIZE:-0}
      MODEL_TIMEOUT_SEC: ${MODEL_TIMEOUT_SEC:-900}
      A2A_EDGE_URL: ${A2A_EDGE_URL:-}
      A2A_AGENT_URL: ${A2A_AGENT_URL:-}
      A2A_TOKEN: ${A2A_TOKEN:-}
      A2A_TIMEOUT_SEC: ${A2A_TIMEOUT_SEC:-300}
      AUTHORING_STALE_AFTER_SEC: ${AUTHORING_STALE_AFTER_SEC:-1200}
      MATTERMOST_BASE_URL: ""
      MATTERMOST_TOKEN: ""
      PLANE_BASE_URL: ${PLANE_BASE_URL:-}
      PLANE_TOKEN: ${PLANE_TOKEN:-}
      PLANE_WEBHOOK_SECRET: ${PLANE_WEBHOOK_SECRET:-}
      PLANE_WORKSPACE_SLUG: ${PLANE_WORKSPACE_SLUG:-general}
      PLANE_WORKSPACE_ID: ${PLANE_WORKSPACE_ID:-dadf050e-cd1e-4590-bc33-672511630841}
      PLANE_CREATION_BACKLOG_STATE_ID: ${PLANE_CREATION_BACKLOG_STATE_ID:-62d4c50c-0cea-4a76-a0ed-ec97498b2d5f}
      PLANE_AGENT_ASSIGNEE_ID: ${PLANE_AGENT_ASSIGNEE_ID:-5d116a77-d3df-4f54-80bf-eca61e0118c4}
      PLANE_SELF_ACTOR_ID: ${PLANE_SELF_ACTOR_ID:-}
      GITO_PROTO_SOCKET_URL: ${GITO_PROTO_SOCKET_URL:-}
      GITO_WEBHOOK_SECRET: ${GITO_WEBHOOK_SECRET:-}
      GITO_REPO_ID: ${GITO_REPO_ID:-}
      GITO_DEVELOP_REPO_PATH: ${GITO_DEVELOP_REPO_PATH:-}
      GITO_BRANCH: ${GITO_BRANCH:-develop}
      GITO_REMOTE_NAME: ${GITO_REMOTE_NAME:-origin}
      # Reuse the host's existing file-based git credential store inside the
      # Linux container: the develop workspace remote is HTTPS, and without a
      # credential helper the Core-authored identity backfill push fails with
      # "could not read Username". The credential material itself stays in the
      # ignored host file mounted read-only below; only the helper wiring lives
      # here. GIT_CONFIG_* is git's env-based config (>= 2.31).
      GIT_CONFIG_COUNT: ${GIT_CONFIG_COUNT:-1}
      GIT_CONFIG_KEY_0: ${GIT_CONFIG_KEY_0:-credential.helper}
      GIT_CONFIG_VALUE_0: ${GIT_CONFIG_VALUE_0:-store --file=/Users/toki/.git-credentials}
      ROADMAP_CREATION_TODO_STATE_ID: ${ROADMAP_CREATION_TODO_STATE_ID:-}
      PLANE_TODO_STATE_ID: ${PLANE_TODO_STATE_ID:-}
      PLANE_PROJECT_ID: ${PLANE_PROJECT_ID:-}
    ports:
      - "${NOMADCODE_CORE_HOST_PORT:-18010}:8080"
    volumes:
      - /Users/toki/agent-work:/Users/toki/agent-work
      # Ignored host credential file (never tracked); read-only so the container
      # can authenticate git push without embedding any secret in this compose.
      - ${GIT_CREDENTIALS_FILE:-/Users/toki/.git-credentials}:/Users/toki/.git-credentials:ro
    networks:
      - net_nginx

networks:
  net_nginx:
    external: true