docker-compose.yml

services:
  proxy:
    build: .
    image: openclaw-billing-proxy:latest
    restart: unless-stopped
    ports:
      # IMPORTANT: 127.0.0.1 ensures proxy is only accessible locally
      - "127.0.0.1:${PROXY_PORT:-18801}:${PROXY_PORT:-18801}"
    volumes:
      # Mount Claude Code credentials (read-only). Not needed if OAUTH_TOKEN is set.
      - ${HOME}/.claude:/root/.claude:ro
      # Uncomment to use custom replacement rules:
      # - ./config.json:/app/config.json:ro
    environment:
      - OAUTH_TOKEN=${OAUTH_TOKEN:-}        # Set in .env to skip credential file mount
      - PROXY_PORT=${PROXY_PORT:-}
      - PROXY_HOST=0.0.0.0                  # Required: container must bind all interfaces for port mapping
    healthcheck:
      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:${PROXY_PORT:-18801}/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))\""]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 5s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"