docker-compose.yml

services:
  ocis:
    image: ${OCIS_IMAGE:-owncloud/ocis-rolling:latest}
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    entrypoint: /bin/sh
    command: ['-c', 'ocis init || true && ocis server']
    environment:
      OCIS_URL: https://host.docker.internal:9200
      OCIS_INSECURE: true
      OCIS_LOG_LEVEL: error
      IDM_ADMIN_PASSWORD: admin
      IDM_CREATE_DEMO_USERS: true
      PROXY_ENABLE_BASIC_AUTH: true
      PROXY_ENABLE_APP_AUTH: true
      OCIS_ADD_RUN_SERVICES: auth-app
      PROXY_TLS: 'false'
      WEB_ASSET_APPS_PATH: /web/apps
    labels:
      traefik.enable: true
      traefik.http.routers.ocis.tls: true
      traefik.http.routers.ocis.rule: Host(`host.docker.internal`) && PathPrefix(`/`)
      traefik.http.routers.ocis.entrypoints: ocis
      traefik.http.services.ocis.loadbalancer.server.port: 9200
      traefik.http.routers.ocis.middlewares: cors
    volumes:
      - ocis-config:/etc/ocis
      - ./dev/docker/ocis/apps.yaml:/etc/ocis/apps.yaml
      - ./frontend/dist:/web/apps/workflows
    depends_on:
      - traefik

  workflows-backend:
    build:
      context: ./backend
      dockerfile: ../docker/Dockerfile
      args:
        CMD_PATH: ./cmd/workflows
    command: ['server']
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    environment:
      WORKFLOWS_OCIS_URL: https://host.docker.internal:9200
      WORKFLOWS_OCIS_INSECURE: 'true'
      # Defaults to Ollama running on the host. Override LLM_ENDPOINT/LLM_MODEL/
      # LLM_API_KEY to point at a different Ollama model or a hosted API instead.
      WORKFLOWS_LLM_ENDPOINT: ${LLM_ENDPOINT:-http://host.docker.internal:11434/v1}
      WORKFLOWS_LLM_MODEL: ${LLM_MODEL:-llama3.2}
      WORKFLOWS_LLM_API_KEY: ${LLM_API_KEY:-ollama}
      WORKFLOWS_HTTP_ADDR: 0.0.0.0:9105
      WORKFLOWS_DEBUG_ADDR: 0.0.0.0:9109
      WORKFLOWS_ALLOWED_ORIGIN: https://host.docker.internal:9200
      WORKFLOWS_DB_PATH: /data/workflows.db
      # Dev-only fixed key so automation (app-passwords) survives container restarts in
      # this stack. Generate your own for anything beyond local dev/e2e.
      WORKFLOWS_ENCRYPTION_KEY: ${WORKFLOWS_ENCRYPTION_KEY:-mP/XDZvobHVH8mW0A7bIoodaApk0oHUN5RRtmiYI80o=}
    volumes:
      - workflows-data:/data
    labels:
      traefik.enable: true
      traefik.http.routers.workflows-backend.tls: true
      traefik.http.routers.workflows-backend.rule: Host(`host.docker.internal`) && PathPrefix(`/workflows/api`)
      traefik.http.routers.workflows-backend.entrypoints: ocis
      traefik.http.services.workflows-backend.loadbalancer.server.port: 9105
      traefik.http.routers.workflows-backend.middlewares: workflows-backend-stripprefix,cors
      traefik.http.middlewares.workflows-backend-stripprefix.stripprefix.prefixes: /workflows
    depends_on:
      - traefik

  # Deterministic LLM stand-in for e2e/CI runs, so they don't depend on a real model being
  # installed. Only starts with --profile test; pair it with LLM_ENDPOINT/LLM_MODEL/
  # LLM_API_KEY pointed at it (see backend/tests/e2e/main_test.go).
  fake-llm:
    profiles: [test]
    build:
      context: ./backend
      dockerfile: ../docker/Dockerfile
      args:
        CMD_PATH: ./cmd/fakellm

  traefik:
    image: traefik:v3.6.10
    restart: unless-stopped
    entrypoint:
      [
        '/bin/sh',
        '-c',
        "[ -f /certificates/server.key ] && ./entrypoint.sh $$@ || (apk add openssl && openssl req -subj '/CN=ocis.test' -x509 -sha256 -nodes -days 3650 -newkey rsa:2048 -keyout /certificates/server.key -out /certificates/server.crt && chmod -R 777 /certificates && ./entrypoint.sh $$@)"
      ]
    command:
      - '--pilot.dashboard=false'
      - '--log.level=DEBUG'
      - '--api.dashboard=true'
      - '--api.insecure=true'
      - '--providers.file.directory=/configs'
      - '--providers.docker=true'
      - '--providers.docker.exposedbydefault=false'
      - '--entrypoints.web.address=:80'
      - '--entrypoints.ocis.address=:9200'
      - '--entrypoints.ocis-federated.address=:10200'
      - '--entrypoints.websecure.address=:443'
      - '--entrypoints.websecure.http.middlewares=https_config@docker'
      - '--entrypoints.websecure.http.tls.options=default'
    labels:
      traefik.enable: true
      traefik.http.routers.http_catchall.rule: HostRegexp(`{any:.+}`)
      traefik.http.routers.http_catchall.entrypoints: web
      traefik.http.routers.http_catchall.middlewares: https_config
      traefik.http.middlewares.https_config.headers.sslRedirect: true
      traefik.http.middlewares.https_config.headers.stsSeconds: 63072000
      traefik.http.middlewares.https_config.headers.stsIncludeSubdomains: true
      traefik.http.middlewares.cors.headers.accesscontrolallowmethods: '*'
      traefik.http.middlewares.cors.headers.accesscontrolallowheaders: '*'
      traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist: '*'
      traefik.http.middlewares.cors.headers.accesscontrolexposeheaders: '*'
      traefik.http.middlewares.cors.headers.accesscontrolmaxage: 100
      traefik.http.middlewares.cors.headers.addvaryheader: true
    ports:
      - '9200:9200'
    volumes:
      - './dev/docker/traefik/certificates:/certificates'
      - './dev/docker/traefik/configs:/configs'
      - '/var/run/docker.sock:/var/run/docker.sock:ro'

volumes:
  ocis-config:
  workflows-data: