docker-compose.unified.yml

# Extension fields for DRY configuration
x-common-environment: &common-environment
  NVIDIA_VISIBLE_DEVICES: ${NVIDIA_VISIBLE_DEVICES:-0}
  NVIDIA_DRIVER_CAPABILITIES: compute,utility
  CUDA_ARCH: ${CUDA_ARCH:-75}
  SYSTEM_NETWORK_PORT: ${SYSTEM_NETWORK_PORT:-4000}
  # MCP and Claude Flow configuration
  CLAUDE_FLOW_HOST: ${CLAUDE_FLOW_HOST:-agentic-workstation}
  MCP_HOST: ${MCP_HOST:-agentic-workstation}
  MCP_TCP_PORT: ${MCP_TCP_PORT:-9500}
  MCP_TRANSPORT: ${MCP_TRANSPORT:-tcp}
  MCP_RECONNECT_ATTEMPTS: ${MCP_RECONNECT_ATTEMPTS:-3}
  MCP_RECONNECT_DELAY: ${MCP_RECONNECT_DELAY:-1000}
  MCP_CONNECTION_TIMEOUT: ${MCP_CONNECTION_TIMEOUT:-30000}
  ORCHESTRATOR_WS_URL: ${ORCHESTRATOR_WS_URL:-ws://mcp-orchestrator:9001/ws}
  MCP_RELAY_FALLBACK_TO_MOCK: ${MCP_RELAY_FALLBACK_TO_MOCK:-true}
  BOTS_ORCHESTRATOR_URL: ${BOTS_ORCHESTRATOR_URL:-ws://agentic-workstation:3002}
  MANAGEMENT_API_HOST: ${MANAGEMENT_API_HOST:-agentic-workstation}
  MANAGEMENT_API_PORT: ${MANAGEMENT_API_PORT:-9090}
  # Solid pod storage (embedded solid-pod-rs, replaces JSS sidecar)
  SOLID_DATA_ROOT: ${SOLID_DATA_ROOT:-/data/solid}

x-common-healthcheck: &common-healthcheck
  test: ["CMD", "curl", "-f", "http://localhost:4000/api/health"]
  interval: 30s
  timeout: 10s
  retries: 3
  start_period: 40s

x-common-logging: &common-logging
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "3"

x-gpu-resources: &gpu-resources
  resources:
    reservations:
      devices:
        - driver: nvidia
          count: 1
          capabilities: [gpu, compute, utility]

services:
  # Unified VisionClaw service with profile-based configuration
  visionclaw:
    container_name: ${CONTAINER_NAME:-visionclaw_container}
    hostname: ${HOSTNAME:-visionclaw-server}
    build:
      context: .
      dockerfile: ${DOCKERFILE:-Dockerfile.unified}
      target: development
      args:
        CUDA_ARCH: ${CUDA_ARCH:-75}
        BUILD_TARGET: ${BUILD_TARGET:-development}
    env_file:
      - .env
    environment:
      <<: *common-environment
      # Development-specific variables (overridden in production profile)
      NODE_ENV: ${NODE_ENV:-development}
      VITE_DEBUG: ${DEBUG_ENABLED:-true}
      VITE_DEV_SERVER_PORT: ${VITE_DEV_SERVER_PORT:-5173}
      VITE_API_PORT: ${VITE_API_PORT:-4000}
      VITE_HMR_PORT: ${VITE_HMR_PORT:-24678}
      RUST_LOG: ${RUST_LOG:-info,actix_web=warn,actix_server=warn,actix_http=warn,h2=warn,hyper=warn,rustls=warn,reqwest=warn,oxigraph=warn,horned_owl=warn,whelk=warn,solid_pod_rs=warn,visionclaw-server::actors::gpu::force_compute_actor=warn,visionclaw-server::handlers::socket_flow_handler=warn}
      RUST_LOG_REDIRECT: ${RUST_LOG_REDIRECT:-true}
      DOCKER_ENV: ${DOCKER_ENV:-true}
      # Dev-only: bypass Nostr auth for settings writes (never set in production)
      SETTINGS_AUTH_BYPASS: "${SETTINGS_AUTH_BYPASS:-false}"
      # Solid pod storage (embedded solid-pod-rs)
      SOLID_DATA_ROOT: ${SOLID_DATA_ROOT:-/data/solid}
      # Nostr bead provenance bridge — scoped to visionclaw only (privkey must not leak to other containers)
      # Bridge pubkey: eb47d8a792a4709329270a9f85f012326c61867a913791dc5f89dc7a0a760754
      VISIONCLAW_NOSTR_PRIVKEY: ${VISIONCLAW_NOSTR_PRIVKEY:-}
      FORUM_RELAY_URL: ${FORUM_RELAY_URL:-}
    volumes:
      # Data volumes - ALWAYS mounted (both dev and prod)
      - visionclaw-data:/app/data
      - visionclaw-logs:/app/logs
      # SOURCE CODE MOUNTS - Live sync from host for development hot-reload
      # These override the COPY'd source in the image with current host files
      # HOST_PROJECT_ROOT resolves DinD path translation (defaults to "." for native Docker)
      - ${HOST_PROJECT_ROOT:-.}/src:/app/src:ro
      - ${HOST_PROJECT_ROOT:-.}/Cargo.toml:/app/Cargo.toml:ro
      - ${HOST_PROJECT_ROOT:-.}/Cargo.lock:/app/Cargo.lock:rw
      - ${HOST_PROJECT_ROOT:-.}/build.rs:/app/build.rs:ro
      - ${HOST_PROJECT_ROOT:-.}/crates:/app/crates:ro
      - ${HOST_PROJECT_ROOT:-.}/docs:/app/docs:ro
      # solid-pod-rs + whelk-rs are crates.io deps — fetched into cargo cache, no bind mount needed.
      - ${HOST_PROJECT_ROOT:-.}/client/src:/app/client/src:ro
      - ${HOST_PROJECT_ROOT:-.}/client/public:/app/client/public:ro
      - ${HOST_PROJECT_ROOT:-.}/client/index.html:/app/client/index.html:ro
      - ${HOST_PROJECT_ROOT:-.}/client/vite.config.ts:/app/client/vite.config.ts:ro
      - ${HOST_PROJECT_ROOT:-.}/client/tsconfig.json:/app/client/tsconfig.json:ro
      # Cache volumes for build optimization
      - npm-cache:/root/.npm
      - cargo-cache:/root/.cargo/registry
      - cargo-git-cache:/root/.cargo/git
      - cargo-target-cache:/app/target
      # Docker socket for controlled access (development only)
      # DEV ONLY — never enable in production. The prod service deliberately omits
      # this mount; exposing the host Docker socket grants effective root on the host.
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # Mount host data directory for graph content
      - ${HOST_PROJECT_ROOT:-.}/data/markdown:/workspace/ext/data/markdown:ro
      - ${HOST_PROJECT_ROOT:-.}/data/metadata:/workspace/ext/data/metadata:rw
    ports:
      # Development: Nginx entry point + API port
      - "${DEV_NGINX_PORT:-3001}:3001"
      - "${API_PORT:-4000}:4000"
    networks:
      visionclaw_network:
        aliases:
          - ${NETWORK_ALIAS:-visionclaw-server}
    deploy:
      <<: *gpu-resources
    runtime: nvidia
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:4000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 300s
    logging:
      <<: *common-logging
    profiles:
      - development
      - dev

  # Production profile configuration
  visionclaw-production:
    container_name: ${CONTAINER_NAME:-visionclaw_prod_container}
    hostname: ${HOSTNAME:-visionclaw-server-prod}
    build:
      context: .
      dockerfile: Dockerfile.production
      args:
        CUDA_ARCH: ${CUDA_ARCH:-75}
        BUILD_TARGET: production
        REBUILD_PTX: ${REBUILD_PTX:-false}
    env_file:
      - .env
    environment:
      <<: *common-environment
      # Production-specific overrides
      NODE_ENV: production
      RUST_LOG: ${RUST_LOG:-info}
      GIT_HASH: ${GIT_HASH:-production}
      VITE_DEBUG: "false"
      # CORS — must include production domain so nginx can pass real Origin
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-https://www.visionclaw.info,https://visionclaw.info,http://localhost:3000,http://localhost:3001}
      # ComfyUI image generation
      COMFYUI_URL: ${COMFYUI_URL:-http://comfyui:8188}
      COMFYUI_SALAD_URL: ${COMFYUI_SALAD_URL:-http://comfyui:3000}
      # Solid pod storage for agent pipeline
      SOLID_PROXY_SECRET_KEY: ${SOLID_PROXY_SECRET_KEY}
      # Fail fast in production if the agent key is unset — no insecure default.
      VISIONCLAW_AGENT_KEY: ${VISIONCLAW_AGENT_KEY:?VISIONCLAW_AGENT_KEY must be set}
      # Nostr bead provenance bridge — scoped here only, never in common-environment
      VISIONCLAW_NOSTR_PRIVKEY: ${VISIONCLAW_NOSTR_PRIVKEY:-}
      FORUM_RELAY_URL: ${FORUM_RELAY_URL:-}
    volumes:
      # Production: ONLY data volumes (no source mounts, no Docker socket)
      - visionclaw-data:/app/data
      - visionclaw-logs:/app/logs
    ports:
      # Production: Only API port
      - "${PROD_API_PORT:-3001}:3001"
    networks:
      visionclaw_network:
        aliases:
          - ${NETWORK_ALIAS:-visionclaw-server}
    deploy:
      <<: *gpu-resources
      resources:
        limits:
          memory: 8G
          cpus: '4'
        reservations:
          memory: 2G
          cpus: '1'
    runtime: nvidia
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    logging:
      <<: *common-logging
    profiles:
      - production
      - prod

  # Cloudflare tunnel - works with both profiles
  cloudflared:
    container_name: ${CLOUDFLARED_CONTAINER:-cloudflared-tunnel}
    # Pinned to the locally-available digest for reproducible production builds.
    image: cloudflare/cloudflared:latest@sha256:6b599ca3e974349ead3286d178da61d291961182ec3fe9c505e1dd02c8ac31b0
    command: tunnel --no-autoupdate run
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}
    volumes:
      - ./config.yml:/etc/cloudflared/config.yml:ro
    depends_on:
      visionclaw:
        condition: service_started
        required: false
      visionclaw-production:
        condition: service_started
        required: false
    networks:
      - visionclaw_network
    restart: unless-stopped
    logging:
      <<: *common-logging
    profiles:
      - production
      - prod

networks:
  visionclaw_network:
    external: true
    name: ${EXTERNAL_NETWORK:-visionclaw_network}

volumes:
  # Persistent data volumes
  visionclaw-data:
    name: ${DATA_VOLUME_NAME:-visionclaw-data}
    driver: local
  visionclaw-logs:
    name: ${LOGS_VOLUME_NAME:-visionclaw-logs}
    driver: local
  # Build cache volumes
  npm-cache:
    name: ${NPM_CACHE_VOLUME:-visionclaw-npm-cache}
    driver: local
  cargo-cache:
    name: ${CARGO_CACHE_VOLUME:-visionclaw-cargo-cache}
    driver: local
  cargo-git-cache:
    name: ${CARGO_GIT_CACHE_VOLUME:-visionclaw-cargo-git-cache}
    driver: local
  cargo-target-cache:
    name: ${CARGO_TARGET_CACHE_VOLUME:-visionclaw-cargo-target-cache}
    driver: local