docker-compose.yml

name: opendata-ai

x-ollama-base: &ollama-base
  # Pre-built image with qwen2.5:32k (num_ctx=16384, temperature 0) already baked in.
  # Published via .github/workflows/publish-ollama.yml.
  # Fallback: set OLLAMA_IMAGE=ollama/ollama:latest and run `make pull-models`.
  image: ${OLLAMA_IMAGE:-ghcr.io/agent-engineering-studio/opendata-ai-ollama:latest}
  # Default to `if_not_present` so a locally-built image (via `make build-ollama`)
  # isn't silently overwritten by the registry. Override to `always` only when you
  # explicitly want the GHCR tag to win.
  pull_policy: ${OLLAMA_PULL_POLICY:-if_not_present}
  container_name: opendata-ai-ollama
  ports:
    - "${OLLAMA_PORT:-11435}:11434"
  volumes:
    - ollama_data:/root/.ollama
  restart: unless-stopped
  healthcheck:
    test: ["CMD", "ollama", "list"]
    interval: 15s
    timeout: 5s
    retries: 10
    start_period: 30s

services:
  # ───── Redis 7 — cache + per-user fixed-window rate-limit (logical db 1) ─────
  redis:
    image: redis:7-alpine
    container_name: opendata-ai-redis
    command: ["redis-server", "--save", "60", "1", "--appendonly", "yes"]
    ports:
      - "${REDIS_PORT:-16379}:6379"
    volumes:
      - redis_data:/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 5s

  # ───── Postgres 16 + PostGIS — shared state + modello canonico territoriale ─────
  # postgis/postgis:16-3.4 = stesso major (16) di postgres:16-alpine → riusa il
  # volume esistente. PostGIS è disponibile nell'immagine; l'estensione viene
  # creata dalla migrazione (CREATE EXTENSION postgis, solo su dialetto postgresql).
  # NB: `postgis/postgis` è SOLO amd64 → su Mac Apple Silicon gira emulato (warning
  # "platform does not match"). In locale puoi impostare POSTGRES_IMAGE con la build
  # multi-arch drop-in (arm64): POSTGRES_IMAGE=imresamu/postgis:16-3.4 (stessi sorgenti
  # PostGIS, stesso major/PostGIS → riusa il volume). Default invariato per prod/CI.
  postgres:
    image: ${POSTGRES_IMAGE:-postgis/postgis:16-3.4}
    container_name: opendata-ai-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-opendata}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-opendata}
      POSTGRES_DB: ${POSTGRES_DB:-opendata}
    ports:
      - "${POSTGRES_PORT:-15432}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER:-opendata} -d $${POSTGRES_DB:-opendata}"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 10s

  # ───── Ollama — GPU profile ─────
  ollama-gpu:
    <<: *ollama-base
    profiles: ["gpu"]
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]

  # ───── Ollama — CPU profile ─────
  ollama-cpu:
    <<: *ollama-base
    profiles: ["cpu"]

  # ───── CKAN MCP server (Streamable HTTP) ─────
  ckan-mcp:
    build:
      context: .
      dockerfile: ckan-mcp-server/Dockerfile
    image: ckan-mcp-server:local
    container_name: ckan-mcp
    ports:
      - "${CKAN_MCP_PORT:-18080}:8080"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8080"
      MCP_PATH: /mcp
      CKAN_DEFAULT_BASE_URL: ${CKAN_DEFAULT_BASE_URL:-https://www.dati.gov.it/opendata}
      CKAN_HTTP_TIMEOUT: "30"
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── ISTAT MCP server (Streamable HTTP) ─────
  istat-mcp:
    build:
      context: .
      dockerfile: istat-mcp-server/Dockerfile
    image: istat-mcp-server:local
    container_name: istat-mcp
    ports:
      - "${ISTAT_MCP_PORT:-18081}:8081"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8081"
      MCP_PATH: /mcp
      ISTAT_SDMX_BASE_URL: ${ISTAT_SDMX_BASE_URL:-https://esploradati.istat.it/SDMXWS/rest}
      # esploradati.istat.it supera regolarmente i 60s sul primo fetch del
      # catalogo (visto live: transport error a 60.1s); la cache L2 rende
      # veloci le chiamate successive.
      ISTAT_HTTP_TIMEOUT: "120"
      # L2 persistent cache for the dataflow catalogue (slow + rarely changes).
      SDMX_PERSISTENT_CACHE_DIR: /var/cache/sdmx
      SDMX_PERSISTENT_CACHE_TTL_SECONDS: ${SDMX_PERSISTENT_CACHE_TTL_SECONDS:-86400}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    volumes:
      - sdmx_cache:/var/cache/sdmx
    restart: unless-stopped

  # ───── OpenCoesione MCP server (Streamable HTTP) ─────
  opencoesione-mcp:
    build:
      context: .
      dockerfile: opencoesione-mcp-server/Dockerfile
    image: opencoesione-mcp-server:local
    container_name: opencoesione-mcp
    ports:
      - "${OPENCOESIONE_MCP_PORT:-18082}:8082"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8082"
      MCP_PATH: /mcp
      OPENCOESIONE_BASE_URL: ${OPENCOESIONE_BASE_URL:-https://opencoesione.gov.it/it/api}
      OPENCOESIONE_HTTP_TIMEOUT: "60"
      OPENCOESIONE_CACHE_TTL_SECONDS: ${OPENCOESIONE_CACHE_TTL_SECONDS:-3600}
      # Local-aggregates tool (opencoesione_query_local): read-only mirror of
      # opendata.oc_progetti, populated by `make oc-sync`. Empty = tool off.
      OPENCOESIONE_DB_URL: ${OPENCOESIONE_DB_URL:-}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── OpenPNRR MCP server (Streamable HTTP) — openpolis NRRP open data ─────
  openpnrr-mcp:
    build:
      context: .
      dockerfile: openpnrr-mcp-server/Dockerfile
    image: openpnrr-mcp-server:local
    container_name: openpnrr-mcp
    ports:
      - "${OPENPNRR_MCP_PORT:-18091}:8091"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8091"
      MCP_PATH: /mcp
      OPENPNRR_BASE_URL: ${OPENPNRR_BASE_URL:-https://openpnrr.it/api/v1}
      OPENPNRR_HTTP_TIMEOUT: "60"
      OPENPNRR_CACHE_TTL_SECONDS: ${OPENPNRR_CACHE_TTL_SECONDS:-3600}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── Centri d'Italia MCP server (Streamable HTTP) — openpolis accoglienza ─────
  # Dati bulk CSV → mirror SQLite locale (costruito al primo uso). Il volume
  # persiste il mirror tra i restart (evita di riscaricare ~20 MB ogni volta).
  centriditalia-mcp:
    build:
      context: .
      dockerfile: centriditalia-mcp-server/Dockerfile
    image: centriditalia-mcp-server:local
    container_name: centriditalia-mcp
    ports:
      - "${CENTRIDITALIA_MCP_PORT:-18092}:8092"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8092"
      MCP_PATH: /mcp
      CENTRIDITALIA_BASE_URL: ${CENTRIDITALIA_BASE_URL:-https://migrantidb.s3.eu-central-1.amazonaws.com/opendata}
      CENTRIDITALIA_DATASET_VERSION: ${CENTRIDITALIA_DATASET_VERSION:-v2026}
      CENTRIDITALIA_DB_PATH: /data/centriditalia_mirror.sqlite
      CENTRIDITALIA_REFRESH_TTL_SECONDS: ${CENTRIDITALIA_REFRESH_TTL_SECONDS:-604800}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    volumes:
      - centriditalia_mirror:/data
    restart: unless-stopped

  # ───── Product MCP server (Streamable HTTP) — Esplora/Territorio/Maturità/Qualità ─────
  # Espone le 4 modalità di prodotto come tool MCP a client esterni (OpenClaw,
  # Claude Desktop). Proxy sottile verso opendata-backend (#131, Opzione A).
  opendata-mcp:
    build:
      context: .
      dockerfile: opendata-mcp-server/Dockerfile
    image: opendata-mcp-server:local
    container_name: opendata-mcp
    ports:
      - "${OPENDATA_MCP_PORT:-18093}:8093"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8093"
      MCP_PATH: /mcp
      OPENDATA_API_BASE_URL: ${OPENDATA_API_BASE_URL:-http://opendata-backend:8000}
      OPENDATA_API_KEY: ${OPENDATA_API_KEY:-}
      OPENDATA_API_TIMEOUT: ${OPENDATA_API_TIMEOUT:-300}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── ISPRA IdroGEO MCP server (Streamable HTTP) ─────
  ispra-mcp:
    build:
      context: .
      dockerfile: ispra-mcp-server/Dockerfile
    image: ispra-mcp-server:local
    container_name: ispra-mcp
    ports:
      - "${ISPRA_MCP_PORT:-18083}:8083"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8083"
      MCP_PATH: /mcp
      ISPRA_IDROGEO_BASE_URL: ${ISPRA_IDROGEO_BASE_URL:-https://idrogeo.isprambiente.it/api}
      ISPRA_HTTP_TIMEOUT: "30"
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── OpenDataSoft MCP server (Streamable HTTP) ─────
  ods-mcp:
    build:
      context: .
      dockerfile: ods-mcp-server/Dockerfile
    image: ods-mcp-server:local
    container_name: ods-mcp
    ports:
      - "${ODS_MCP_PORT:-18089}:8080"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8080"
      MCP_PATH: /mcp
      ODS_DEFAULT_BASE_URL: ${ODS_DEFAULT_BASE_URL:-https://public.opendatasoft.com}
      ODS_HTTP_TIMEOUT: "30"
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── Socrata MCP server (Streamable HTTP) ─────
  socrata-mcp:
    build:
      context: .
      dockerfile: socrata-mcp-server/Dockerfile
    image: socrata-mcp-server:local
    container_name: socrata-mcp
    ports:
      - "${SOCRATA_MCP_PORT:-18084}:8080"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8080"
      MCP_PATH: /mcp
      SOCRATA_DEFAULT_BASE_URL: ${SOCRATA_DEFAULT_BASE_URL:-https://opendata.socrata.com}
      SOCRATA_HTTP_TIMEOUT: "30"
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── BDAP MCP server (Streamable HTTP) ─────
  bdap-mcp:
    build:
      context: .
      dockerfile: bdap-mcp-server/Dockerfile
    image: bdap-mcp-server:local
    container_name: bdap-mcp
    ports:
      - "${BDAP_MCP_PORT:-18090}:8080"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8080"
      MCP_PATH: /mcp
      BDAP_BASE_URL: ${BDAP_BASE_URL:-https://bdap-opendata.rgs.mef.gov.it}
      BDAP_HTTP_TIMEOUT: "30"
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── OSM MCP server — renders Leaflet+OSM HTML maps for GeoJSON ─────
  osm-mcp:
    build:
      context: .
      dockerfile: osm-mcp/Dockerfile
    image: osm-mcp:local
    container_name: osm-mcp
    # Container listens on 8080 (its Dockerfile healthcheck is hardcoded to 8080);
    # exposed on the host as 8085 to avoid clashing with ckan-mcp.
    ports:
      - "${OSM_MCP_PORT:-18085}:8080"
    environment:
      MCP_TRANSPORT: streamable-http
      MCP_HOST: 0.0.0.0
      MCP_PORT: "8080"
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      # I default overpass-api.de + kumi.systems sono irraggiungibili da alcune
      # reti (ConnectError/timeout). Usiamo i mirror FR (primario) + CH
      # (fallback), entrambi raggiungibili; sovrascrivibili via env.
      OVERPASS_URL: ${OVERPASS_URL:-https://overpass.openstreetmap.fr/api/interpreter}
      OVERPASS_FALLBACK_URLS: ${OVERPASS_FALLBACK_URLS:-https://overpass.osm.ch/api/interpreter}
    restart: unless-stopped

  # ───── Maturity MCP server — assessment maturità open-data (ODM 2025) ─────
  maturity-mcp:
    build:
      context: .
      dockerfile: maturity-mcp-server/Dockerfile
    image: maturity-mcp-server:local
    container_name: maturity-mcp
    ports:
      - "${MATURITY_MCP_PORT:-18087}:8080"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8080"
      MCP_PATH: /mcp
      CKAN_DEFAULT_BASE_URL: ${CKAN_DEFAULT_BASE_URL:-https://www.dati.gov.it/opendata}
      # Haiku SOLO per il giudizio semantico (comprensibilità descrizione); opzionale.
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      CLAUDE_CLASSIFY_MODEL: ${CLAUDE_CLASSIFY_MODEL:-claude-haiku-4-5-20251001}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── Overpass self-hosted — istanza locale su estratto Italia (opt-in) ─────
  # Profilo "overpass" (start con `--profile overpass`): elimina rate limit (429)
  # e blocchi di rete verso i mirror pubblici. NON è nel set di default perché
  # richiede disco (~25-50 GB di DB) e un init lungo (download .pbf ~2 GB +
  # build, da ~1 h a freddo: il container resta NON pronto finché non finisce).
  #
  # Per usarlo, oltre ad attivare il profilo, punta i client all'istanza locale:
  #   OVERPASS_URL=http://overpass/api/interpreter            (backend + osm-mcp)
  #   OVERPASS_FALLBACK_URLS=https://overpass.openstreetmap.fr/api/interpreter
  # (in .env / .env.local). Dettagli e sizing in infra/overpass/README.md.
  overpass:
    image: wiktorn/overpass-api:latest
    container_name: opendata-ai-overpass
    profiles: ["overpass"]
    ports:
      - "${OVERPASS_PORT:-18086}:80"
    environment:
      # `no` = niente metadata/attic → DB molto più piccolo e init più rapido
      # (l'app usa solo geometrie/tag correnti, non lo storico delle modifiche).
      OVERPASS_META: ${OVERPASS_META:-no}
      OVERPASS_MODE: init
      # Estratto regionale Geofabrik. Default: Italia intera (margine se l'app
      # esce dalla Puglia). Per ridurre disco/init usa il Sud:
      #   https://download.geofabrik.de/europe/italy/sud-latest.osm.pbf
      #   https://download.geofabrik.de/europe/italy/sud-updates/
      OVERPASS_PLANET_URL: ${OVERPASS_PLANET_URL:-https://download.geofabrik.de/europe/italy-latest.osm.pbf}
      OVERPASS_DIFF_URL: ${OVERPASS_DIFF_URL:-https://download.geofabrik.de/europe/italy-updates/}
      # L'entrypoint scarica sempre su planet.osm.bz2: se la sorgente è .pbf va
      # convertita (osmium è incluso nell'immagine). Diff Geofabrik = giornalieri.
      OVERPASS_PLANET_PREPROCESS: 'mv /db/planet.osm.bz2 /db/planet.osm.pbf && osmium cat /db/planet.osm.pbf -o /db/planet.osm.bz2 && rm /db/planet.osm.pbf'
      OVERPASS_RULES_LOAD: ${OVERPASS_RULES_LOAD:-10}
      OVERPASS_UPDATE_SLEEP: ${OVERPASS_UPDATE_SLEEP:-86400}
    volumes:
      - overpass_db:/db
    healthcheck:
      # In init l'API non risponde: start_period lungo per non marcarlo unhealthy
      # durante il primo build del DB.
      test: ["CMD-SHELL", "wget -qO- 'http://localhost/api/interpreter?data=[out:json][timeout:5];out%20count;' | grep -q count || exit 1"]
      interval: 1m
      timeout: 15s
      retries: 3
      start_period: 2h
    restart: unless-stopped

  # ───── SearXNG — meta-search backend per la fonte web (marketing P10) ─────
  # Profilo "web": opt-in (start con COMPOSE_PROFILES=web o `--profile web`),
  # serve solo quando ENABLE_WEB=true. JSON API abilitata in infra/searxng.
  searxng:
    image: searxng/searxng:latest
    container_name: opendata-ai-searxng
    profiles: ["web"]
    ports:
      - "${SEARXNG_PORT:-18099}:8080"
    volumes:
      # niente :ro — l'entrypoint dell'immagine fa chown di /etc/searxng all'avvio
      # e su un mount read-only fallisce ("chown: ... Read-only file system").
      # SearXNG non scrive nulla qui a runtime, la dir host resta pulita.
      - ./infra/searxng:/etc/searxng
    environment:
      SEARXNG_BASE_URL: http://localhost:${SEARXNG_PORT:-18099}/
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    restart: unless-stopped

  # ───── Web MCP — web_search/web_fetch su SearXNG (ispirazioni marketing) ─────
  web-mcp:
    build:
      context: .
      dockerfile: web-mcp/Dockerfile
    image: web-mcp:local
    container_name: web-mcp
    profiles: ["web"]
    ports:
      - "${WEB_MCP_PORT:-18088}:8080"
    environment:
      TRANSPORT: streamable-http
      HOST: 0.0.0.0
      PORT: "8080"
      MCP_PATH: /mcp
      WEB_SEARCH_PROVIDER: ${WEB_SEARCH_PROVIDER:-searxng}
      SEARXNG_BASE_URL: ${SEARXNG_BASE_URL:-http://searxng:8080}
      WEB_SEARCH_MAX_RESULTS: ${WEB_SEARCH_MAX_RESULTS:-8}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    depends_on:
      - searxng
    restart: unless-stopped

  # ───── Unified backend (multi-source fan-out + /datasets/* + stubs) — main UI entry on :8000 ─────
  opendata-backend:
    build:
      context: .
      dockerfile: opendata-backend/Dockerfile
    image: opendata-backend:local
    container_name: opendata-backend
    ports:
      - "${BACKEND_PORT:-18000}:8000"
    # Il server di inferenza llama.cpp gira sull'host, non in compose:
    # su Linux host.docker.internal non si risolve senza questa riga.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      LLM_PROVIDER: ${LLM_PROVIDER:-auto}
      # Motore predefinito: server llama.cpp self-hosted sull'host.
      # host.docker.internal richiede extra_hosts su Linux (sotto).
      LLAMACPP_BASE_URL: ${LLAMACPP_BASE_URL:-http://host.docker.internal:8080}
      LLAMACPP_MODEL: ${LLAMACPP_MODEL:-qwen3.5-9b}
      LLAMACPP_API_KEY: ${LLAMACPP_API_KEY:-}
      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-http://opendata-ai-ollama:11434}
      OLLAMA_LLM_MODEL: ${OLLAMA_LLM_MODEL:-qwen2.5:32k}
      OLLAMA_NUM_CTX: ${OLLAMA_NUM_CTX:-16384}
      OLLAMA_TEMPERATURE: ${OLLAMA_TEMPERATURE:-0}
      CKAN_MCP_URL: ${CKAN_MCP_URL:-http://ckan-mcp:8080/mcp}
      ODS_MCP_URL: ${ODS_MCP_URL:-http://ods-mcp:8080/mcp}
      SOCRATA_MCP_URL: ${SOCRATA_MCP_URL:-http://socrata-mcp:8080/mcp}
      ISTAT_MCP_URL: ${ISTAT_MCP_URL:-http://istat-mcp:8081/mcp}
      EUROSTAT_MCP_URL: ${EUROSTAT_MCP_URL:-}
      OECD_MCP_URL: ${OECD_MCP_URL:-}
      OPENCOESIONE_MCP_URL: ${OPENCOESIONE_MCP_URL:-http://opencoesione-mcp:8082/mcp}
      OSM_MCP_URL: ${OSM_MCP_URL:-http://osm-mcp:8080/mcp}
      ENABLE_OSM_MAPS: ${ENABLE_OSM_MAPS:-true}
      # Il backend usa opendata_core.osm in-process (ancore zona/turismo): stessi
      # mirror Overpass raggiungibili dell'osm-mcp (default de+kumi bloccati).
      OVERPASS_URL: ${OVERPASS_URL:-https://overpass.openstreetmap.fr/api/interpreter}
      OVERPASS_FALLBACK_URLS: ${OVERPASS_FALLBACK_URLS:-https://overpass.osm.ch/api/interpreter}
      CKAN_DEFAULT_BASE_URL: ${CKAN_DEFAULT_BASE_URL:-https://www.dati.gov.it/opendata}
      ISTAT_SDMX_BASE_URL: ${ISTAT_SDMX_BASE_URL:-https://esploradati.istat.it/SDMXWS/rest}
      EUROSTAT_SDMX_BASE_URL: ${EUROSTAT_SDMX_BASE_URL:-https://ec.europa.eu/eurostat/api/dissemination/sdmx/2.1}
      OECD_SDMX_BASE_URL: ${OECD_SDMX_BASE_URL:-https://sdmx.oecd.org/public/rest}
      ENABLE_CKAN: ${ENABLE_CKAN:-true}
      ENABLE_ISTAT: ${ENABLE_ISTAT:-true}
      # OpenDataSoft: opt-in; con ENABLE_ODS=true avvia anche il servizio ods-mcp.
      ENABLE_ODS: ${ENABLE_ODS:-false}
      ODS_DEFAULT_BASE_URL: ${ODS_DEFAULT_BASE_URL:-https://public.opendatasoft.com}
      # Socrata: opt-in come ODS (usa il servizio socrata-mcp già definito sopra).
      ENABLE_SOCRATA: ${ENABLE_SOCRATA:-false}
      SOCRATA_AGENT_NAME: ${SOCRATA_AGENT_NAME:-socrata}
      SOCRATA_DEFAULT_BASE_URL: ${SOCRATA_DEFAULT_BASE_URL:-https://opendata.socrata.com}
      ENABLE_EUROSTAT: ${ENABLE_EUROSTAT:-false}
      ENABLE_OECD: ${ENABLE_OECD:-false}
      ENABLE_OPENCOESIONE: ${ENABLE_OPENCOESIONE:-false}
      OPENCOESIONE_AGENT_NAME: ${OPENCOESIONE_AGENT_NAME:-opencoesione}
      ENABLE_OSM: ${ENABLE_OSM:-false}
      OSM_AGENT_NAME: ${OSM_AGENT_NAME:-osm}
      ENABLE_ISPRA: ${ENABLE_ISPRA:-false}
      ISPRA_MCP_URL: ${ISPRA_MCP_URL:-http://ispra-mcp:8083/mcp}
      ISPRA_AGENT_NAME: ${ISPRA_AGENT_NAME:-ispra}
      # Knowledge Graph: deployment esterno (repo knowledge-graph), nessun
      # servizio in questo compose — solo il puntatore.
      ENABLE_KG: ${ENABLE_KG:-false}
      KG_MCP_URL: ${KG_MCP_URL:-}
      KG_AGENT_NAME: ${KG_AGENT_NAME:-kg}
      KG_NAMESPACE_PREFIX: ${KG_NAMESPACE_PREFIX:-comune-}
      KG_UI_URL: ${KG_UI_URL:-}
      # KG come MEMORIA DELLE ANALISI: base REST del KG (FastAPI) + directory
      # CONDIVISA dove il backend scrive il riassunto analisi e chiama POST
      # /ingest (il KG legge lo stesso volume). Vuoto → push analisi disabilitato.
      KG_API_URL: ${KG_API_URL:-}
      KG_UPLOAD_DIR: ${KG_UPLOAD_DIR:-/data/kg-uploads}
      # Fonte web (marketing P10): opt-in. Con ENABLE_WEB=true avvia anche il
      # profilo "web" (searxng + web-mcp): COMPOSE_PROFILES=web make up.
      ENABLE_WEB: ${ENABLE_WEB:-false}
      WEB_MCP_URL: ${WEB_MCP_URL:-http://web-mcp:8080/mcp}
      WEB_AGENT_NAME: ${WEB_AGENT_NAME:-web}
      # Chunking idee per-lente (più idee citate; vedi config.idee_chunking).
      IDEE_CHUNKING: ${IDEE_CHUNKING:-false}
      # Ambito territoriale (vuoto = nessun limite; prod = Puglia).
      TERRITORIO_PROVINCE: ${TERRITORIO_PROVINCE:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      CLAUDE_MODEL: ${CLAUDE_MODEL:-claude-sonnet-4-6}
      CLAUDE_CLASSIFY_MODEL: ${CLAUDE_CLASSIFY_MODEL:-claude-haiku-4-5-20251001}
      # BYOK: chiave Fernet per cifrare le chiavi LLM degli utenti (opendata-byok-keygen).
      # Senza, /account/llm-key rifiuta di salvare (fail-closed). + Ollama Cloud (modello TBD).
      BYOK_ENCRYPTION_KEY: ${BYOK_ENCRYPTION_KEY:-}
      OLLAMA_CLOUD_BASE_URL: ${OLLAMA_CLOUD_BASE_URL:-https://ollama.com}
      OLLAMA_CLOUD_MODEL: ${OLLAMA_CLOUD_MODEL:-gpt-oss:120b}
      AUTH_ENABLED: ${AUTH_ENABLED:-false}
      CLERK_PUBLISHABLE_KEY: ${CLERK_PUBLISHABLE_KEY:-}
      CLERK_SECRET_KEY: ${CLERK_SECRET_KEY:-}
      CLERK_JWT_ISSUER: ${CLERK_JWT_ISSUER:-}
      CLERK_WEBHOOK_SECRET: ${CLERK_WEBHOOK_SECRET:-}
      DATABASE_URL: ${DATABASE_URL:-postgresql+asyncpg://opendata:opendata@postgres:5432/opendata}
      REDIS_URL: ${REDIS_URL:-redis://redis:6379/1}
      RATE_LIMIT_PER_MINUTE: ${RATE_LIMIT_PER_MINUTE:-60}
      # Static UI is served by nginx on host port 13000 (compose UI_PORT).
      # Keep localhost:3000 too for host-side `npm run dev` workflows.
      CORS_ALLOW_ORIGINS: ${CORS_ALLOW_ORIGINS:-http://localhost:13000,http://localhost:3000}
      API_HOST: 0.0.0.0
      API_PORT: "8000"
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      ckan-mcp:
        condition: service_started
      istat-mcp:
        condition: service_started
      osm-mcp:
        condition: service_started
      ollama-cpu:
        condition: service_healthy
        required: false
      ollama-gpu:
        condition: service_healthy
        required: false
    restart: unless-stopped

  # ───── Web UI (Next.js) — points at the unified backend ─────
  opendata-ai-ui:
    build:
      context: ./opendata-ai-ui
      dockerfile: Dockerfile
      # `next.config.ts` uses `output: 'export'`, so NEXT_PUBLIC_* must be
      # baked at build time. nginx then serves the static `out/` bundle.
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:18000}
        NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY:-}
        NEXT_PUBLIC_CLERK_SIGN_IN_URL: ${NEXT_PUBLIC_CLERK_SIGN_IN_URL:-/sign-in}
        NEXT_PUBLIC_CLERK_SIGN_UP_URL: ${NEXT_PUBLIC_CLERK_SIGN_UP_URL:-/sign-up}
    image: opendata-ai-ui:local
    container_name: opendata-ai-ui
    ports:
      - "${UI_PORT:-13000}:3000"
    depends_on:
      opendata-backend:
        condition: service_started
    restart: unless-stopped

volumes:
  ollama_data:
    name: opendata-ai-ollama-data
  postgres_data:
    name: opendata-ai-postgres-data
  redis_data:
    name: opendata-ai-redis-data
  sdmx_cache:
    name: opendata-ai-sdmx-cache
  overpass_db:
    name: opendata-ai-overpass-db
  centriditalia_mirror:
    name: opendata-ai-centriditalia-mirror