docker-compose.yml

services:
  traefik:
    image: traefik:v3.6.9
    container_name: nanofleet-traefik
    restart: unless-stopped
    profiles: [prod]
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt
    networks:
      - nanofleet-net

  api:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    container_name: nanofleet-api
    restart: unless-stopped
    ports:
      - "${PORT:-3000}:3000"
    env_file:
      - apps/api/.env
    environment:
      # Override/add variables not in .env
      # Internal URL used by agent/plugin containers to reach this API (container-to-container DNS)
      NANO_API_INTERNAL_URL: "http://nanofleet-api:3000"
      # Allow requests originating from the browser via the web container's exposed port
      ALLOWED_ORIGINS: "${ALLOWED_ORIGINS:-http://localhost:8080}"
      # Real host path passed to Docker daemon for agent/plugin bind mounts.
      # Must be the absolute path on the HOST machine (not inside the container).
      NANOFLEET_HOST_HOME: "${NANOFLEET_HOST_HOME:-$HOME/.nanofleet}"
    volumes:
      # Docker socket — required to manage agent/plugin containers
      - /var/run/docker.sock:/var/run/docker.sock
      # Persist the SQLite database
      - nanofleet-db:/app/apps/api/data
      # Host paths for agent instances, workspace, shared files
      # These must match what agent containers mount (host paths are passed via bind mounts)
      - ${NANOFLEET_HOST_HOME:-~/.nanofleet}:/root/.nanofleet
    networks:
      - nanofleet-net

  web:
    build:
      context: .
      dockerfile: apps/web/Dockerfile
    container_name: nanofleet-web
    restart: unless-stopped
    depends_on:
      - api
    networks:
      - nanofleet-net
    # Dev: expose directly. Prod: Traefik handles ingress (ports commented out via profile).
    ports:
      - "${WEB_PORT:-8080}:80"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.web.entrypoints=websecure"
      - "traefik.http.routers.web.tls.certresolver=letsencrypt"
      - "traefik.http.services.web.loadbalancer.server.port=80"

networks:
  nanofleet-net:
    name: nanofleet-net
    driver: bridge

volumes:
  nanofleet-db:
  letsencrypt: