OpenExecutive

services:
  api:
    build:
      context: ..
      dockerfile: docker/Dockerfile
    # Load the full repo-root .env (the file README's quickstart has you
    # create) into the API container: model providers, integrations, auth,
    # etc. `required: false` tolerates setups that export vars in the shell
    # and run `make docker` (the Makefile passes --env-file so ${VAR}
    # interpolation sees them) without a .env file.
    # NOTE: anything listed under `environment:` below SHADOWS the same key
    # from this env_file — keep that list to container-specific fixed paths.
    env_file:
      - path: ../.env
        required: false
    # Bound to loopback deliberately. The UI reaches the API over the compose
    # network (http://api:8000), so nothing needs the port on 0.0.0.0 — and
    # publishing it there puts an API whose shared-secret gate may be unset on
    # every interface of the host. Front it with a reverse proxy to expose it,
    # and set BACKEND_SHARED_SECRET + OE_PUBLIC_DEPLOYMENT when you do.
    ports:
      - "127.0.0.1:8000:8000"
    environment:
      - VECTOR_STORE_PATH=/data/chroma_db
      - COMPANY_PROFILE_PATH=/data/company/profile.yaml
      - EPISODIC_DB_PATH=/data/episodic_memory.db
    volumes:
      - executive_data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  ui:
    image: node:22-alpine
    working_dir: /app
    command: sh -c "npm install && npm run dev"
    ports:
      - "3000:3000"
    volumes:
      - ../packages/ui:/app
      - /app/node_modules
    # Deliberately NO env_file here: this container runs `npm install` at
    # boot, and npm postinstall scripts can read process.env — so the UI
    # gets only the variables it actually uses, not the backend's provider
    # keys and bot tokens. ${VAR:-} resolves from the repo-root .env when
    # invoked as `make docker` (the Makefile passes --env-file .env), or
    # from exported shell variables. Auth.js needs the AUTH_* set at
    # runtime — without them sign-in fails with MissingSecret (issue #44).
    environment:
      - NODE_ENV=development
      # Reach the API over the compose network (the UI proxy/auth default of
      # localhost:8000 resolves to the UI container itself, not the API).
      - BACKEND_BASE_URL=http://api:8000
      - AUTH_SECRET=${AUTH_SECRET:-}
      - AUTH_GOOGLE_ID=${AUTH_GOOGLE_ID:-}
      - AUTH_GOOGLE_SECRET=${AUTH_GOOGLE_SECRET:-}
      - AUTH_TRUST_HOST=${AUTH_TRUST_HOST-true}
      - AUTH_URL=${AUTH_URL:-}
      - ALLOWED_EMAILS=${ALLOWED_EMAILS:-}
      - BACKEND_SHARED_SECRET=${BACKEND_SHARED_SECRET:-}
    depends_on:
      - api

volumes:
  executive_data:
    driver: local