services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-artex}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Please set POSTGRES_PASSWORD in .env}
      POSTGRES_DB: ${POSTGRES_DB:-artex}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-artex} -d ${POSTGRES_DB:-artex}"]
      interval: 5s
      timeout: 3s
      retries: 10
    restart: unless-stopped

  artex:
    # Built from this checkout. The previous reference was a third-party
    # namespace whose repository is gone: whoever controls that name could
    # publish the tag this file would pull.
    build:
      context: .
      args:
        ARTEX_VERSION: ${ARTEX_VERSION:-dev}
    image: artex:local
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      ARTEX_PG_DSN: postgres://${POSTGRES_USER:-artex}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-artex}?sslmode=disable
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ARTEX_LLM_PROVIDER: ${ARTEX_LLM_PROVIDER:-}
      ARTEX_LLM_MODEL: ${ARTEX_LLM_MODEL:-}
      ARTEX_LLM_BASE_URL: ${ARTEX_LLM_BASE_URL:-}
      ARTEX_LLM_PROXY: ${ARTEX_LLM_PROXY:-}
      ARTEX_JWT_KEY_DIR: /app/keys
      ARTEX_TRUSTED_PROXIES: ${ARTEX_TRUSTED_PROXIES:-}
      # Untrusted-output boundary: on by default (empty = on); ARTEX_UNTRUSTED_BOUNDARY=0 in .env
      # disables it. Cost: about 154 bytes per tool result plus one system note.
      ARTEX_UNTRUSTED_BOUNDARY: ${ARTEX_UNTRUSTED_BOUNDARY:-}
      ARTEX_UPDATE_CHECK: ${ARTEX_UPDATE_CHECK:-}
      # Noise profile for target requests: off (default) | quiet | balanced | aggressive.
      ARTEX_NOISE_PROFILE: ${ARTEX_NOISE_PROFILE:-}
      ARTEX_TARGET_USER_AGENT: ${ARTEX_TARGET_USER_AGENT:-}
      # Hierarchical run budgets: unset or 0 = unlimited (no change). See README.
      ARTEX_TASK_BUDGET_TOKENS: ${ARTEX_TASK_BUDGET_TOKENS:-}
      ARTEX_TASK_BUDGET_TURNS: ${ARTEX_TASK_BUDGET_TURNS:-}
      ARTEX_INTENT_BUDGET_TOKENS: ${ARTEX_INTENT_BUDGET_TOKENS:-}
      ARTEX_INTENT_BUDGET_TURNS: ${ARTEX_INTENT_BUDGET_TURNS:-}
    ports:
      - "${ARTEX_BIND_ADDR:-127.0.0.1}:8787:8787"
      - "127.0.0.1:8788:8788"
    volumes:
      # Bind the data directory (SQLite, task files, etc.) to data/ in the project root,
      # so it is easy to inspect/back up on the host and survives container rebuilds.
      - ./data:/app/data
      # JWT signing key (jwt.key), kept out of data/, which the file manager browses.
      # Persisting it keeps users signed in across container rebuilds.
      - ./keys:/app/keys
      # Mount skills/ from the project root into the container (overriding the image's built-in /app/skills);
      # skill changes require no image rebuild — the container reads the host copy.
      - ./skills:/app/skills
    restart: unless-stopped

volumes:
  pgdata: