docker-compose.yml

services:
  gui-tools-service:
    build:
      context: gui-based-tools-docker
      dockerfile: Dockerfile
    image: gui-tools-docker:latest
    container_name: gui-tools-container
    hostname: gui-tools-service

    # GPU support for graphics-intensive work
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]

    environment:
      - MCP_HOST=0.0.0.0
      - MCP_PORT=9876
      - QGIS_MCP_HOST=0.0.0.0
      - QGIS_MCP_PORT=9877
      - PBR_MCP_HOST=0.0.0.0
      - PBR_MCP_PORT=9878

    ports:
      - "5901:5901"   # VNC port
      - "9876:9876"   # MCP Blender port
      - "9877:9877"   # MCP QGIS port
      - "9878:9878"   # MCP PBR Generator port

    # Health check ensures all three services are ready
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 9876 && nc -z localhost 9877 && nc -z localhost 9878"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

    # Restart policy
    restart: unless-stopped

    networks:
      - docker_ragflow

  multi-agent:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        HOST_UID: ${HOST_UID:-1000}
        HOST_GID: ${HOST_GID:-1000}
    image: multi-agent-docker:latest
    container_name: multi-agent-container

    # GPU support (uncomment if you have NVIDIA GPU)
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]

    environment:
      - DISPLAY=:99
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=all
      - PYTHONUNBUFFERED=1
      - BLENDER_HOST=gui-tools-service
      - BLENDER_PORT=9876
      - QGIS_HOST=gui-tools-service
      - QGIS_PORT=9877
      - PBR_HOST=gui-tools-service
      - PBR_PORT=9878
      # MCP TCP Server Configuration
      - MCP_TCP_AUTOSTART=true
      - MCP_TCP_PORT=${MCP_TCP_PORT:-9500}
      - MCP_BRIDGE_PORT=${MCP_BRIDGE_PORT:-3002}
      - MCP_ENABLE_TCP=true
      - MCP_ENABLE_UNIX=false
      - MCP_LOG_LEVEL=${MCP_LOG_LEVEL:-info}
      - MCP_HEALTH_PORT=9501
      # Security Configuration
      - WS_AUTH_ENABLED=${WS_AUTH_ENABLED:-true}
      - WS_AUTH_TOKEN=${WS_AUTH_TOKEN}
      - TCP_AUTH_TOKEN=${TCP_AUTH_TOKEN}
      - JWT_SECRET=${JWT_SECRET}
      - API_KEY=${API_KEY}
      # Connection Limits
      - WS_MAX_CONNECTIONS=${WS_MAX_CONNECTIONS:-100}
      - TCP_MAX_CONNECTIONS=${TCP_MAX_CONNECTIONS:-50}
      - WS_CONNECTION_TIMEOUT=${WS_CONNECTION_TIMEOUT:-300000}
      # Rate Limiting
      - RATE_LIMIT_ENABLED=${RATE_LIMIT_ENABLED:-true}
      - RATE_LIMIT_WINDOW_MS=${RATE_LIMIT_WINDOW_MS:-60000}
      - RATE_LIMIT_MAX_REQUESTS=${RATE_LIMIT_MAX_REQUESTS:-100}
      - RATE_LIMIT_BURST_REQUESTS=${RATE_LIMIT_BURST_REQUESTS:-20}
      # Request Size Limits
      - MAX_REQUEST_SIZE=${MAX_REQUEST_SIZE:-10485760}
      - MAX_MESSAGE_SIZE=${MAX_MESSAGE_SIZE:-1048576}
      - MAX_BUFFER_SIZE=${MAX_BUFFER_SIZE:-16777216}
      # CORS Security
      - CORS_ENABLED=${CORS_ENABLED:-true}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS}
      - CORS_ALLOWED_METHODS=${CORS_ALLOWED_METHODS}
      - CORS_ALLOWED_HEADERS=${CORS_ALLOWED_HEADERS}
      # SSL/TLS Configuration
      - SSL_ENABLED=${SSL_ENABLED:-false}
      - SSL_CERT_PATH=${SSL_CERT_PATH}
      - SSL_KEY_PATH=${SSL_KEY_PATH}
      - SSL_CA_PATH=${SSL_CA_PATH}
      # Monitoring and Logging
      - SECURITY_AUDIT_LOG=${SECURITY_AUDIT_LOG:-true}
      - PERFORMANCE_MONITORING=${PERFORMANCE_MONITORING:-true}
      - HEALTH_CHECK_ENABLED=${HEALTH_CHECK_ENABLED:-true}
      - HEALTH_CHECK_INTERVAL=${HEALTH_CHECK_INTERVAL:-30000}
      # Circuit Breaker
      - CIRCUITBREAKER_ENABLED=${CIRCUITBREAKER_ENABLED:-true}
      - CIRCUITBREAKER_FAILURE_THRESHOLD=${CIRCUITBREAKER_FAILURE_THRESHOLD:-5}
      - CIRCUITBREAKER_TIMEOUT=${CIRCUITBREAKER_TIMEOUT:-30000}
      - CIRCUITBREAKER_RESET_TIMEOUT=${CIRCUITBREAKER_RESET_TIMEOUT:-60000}
      # Encryption
      - ENCRYPTION_ENABLED=${ENCRYPTION_ENABLED:-false}
      - ENCRYPTION_ALGORITHM=${ENCRYPTION_ALGORITHM:-aes-256-gcm}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      # Session Management
      - SESSION_TIMEOUT=${SESSION_TIMEOUT:-1800000}
      - SESSION_CLEANUP_INTERVAL=${SESSION_CLEANUP_INTERVAL:-300000}
      - MAX_CONCURRENT_SESSIONS=${MAX_CONCURRENT_SESSIONS:-10}
      # IP Blocking
      - AUTO_BLOCK_ENABLED=${AUTO_BLOCK_ENABLED:-true}
      - BLOCK_DURATION=${BLOCK_DURATION:-3600000}
      - MAX_FAILED_ATTEMPTS=${MAX_FAILED_ATTEMPTS:-3}
      # Database Security
      - DB_ENCRYPTION_ENABLED=${DB_ENCRYPTION_ENABLED:-false}
      - DB_BACKUP_ENABLED=${DB_BACKUP_ENABLED:-true}
      - DB_BACKUP_INTERVAL=${DB_BACKUP_INTERVAL:-86400000}
      # Environment
      - NODE_ENV=${NODE_ENV:-development}
      - DEBUG_MODE=${DEBUG_MODE:-true}
      - VERBOSE_LOGGING=${VERBOSE_LOGGING:-true}

    ports:
      - "3000:3000"    # Claude Flow UI
      - "3002:3002"    # WebSocket Bridge (existing)
      - "9500:9500"    # MCP TCP Server (NEW)
      - "9501:9501"    # MCP Health Check (NEW)

    volumes:
      - ./workspace:/workspace
      - ./blender-files:/blender-files
      - ./pbr_outputs:/workspace/pbr_outputs
      - /tmp/.X11-unix:/tmp/.X11-unix:rw
      - ${EXTERNAL_DIR:-./.agent-mount/ext}:/workspace/ext
      # For Unix socket support (optional)
      - mcp-sockets:/var/run/mcp

    # Run in interactive mode by default
    command: ["--interactive"]

    # Keep stdin open and allocate a pseudo-TTY
    stdin_open: true
    tty: true

    # Security options
    security_opt:
      - seccomp:unconfined
      - apparmor:unconfined
    cap_add:
      - SYS_PTRACE

    # Resource limits
    mem_limit: ${DOCKER_MEMORY:-16g}
    cpus: "${DOCKER_CPUS:-4}"

    # Health check for both WebSocket and TCP
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:9501/health || curl -f http://localhost:3002/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s


    # Restart policy
    restart: unless-stopped

    networks:
      - docker_ragflow

networks:
  docker_ragflow:
    name: docker_ragflow
    external: true

volumes:
  workspace:
  blender-files:
  mcp-sockets:
    driver: local