docker-compose.yml

# ============================================================================
# PUBLISHED PORTS / BIND HOST NOTE
# ============================================================================
# Several services have permissive defaults that are fine for localhost-only
# development but would be a foot-gun on a shared network: admin/admin on the
# frontend, PLANEXE_MCP_REQUIRE_AUTH=false with empty API key on mcp_cloud,
# default postgres password, no auth at all on worker_plan.
#
# Ports policy:
#  - database_postgres and worker_plan have NO host port mapping. They are
#    reached by other containers via the docker network at
#    database_postgres:5432 and worker_plan:8000. To inspect them from the
#    host use `docker compose exec` or a one-off override file. Side effect:
#    no host port to collide with a local Postgres on 5432.
#  - frontend_multi_user and mcp_cloud are published, bound to PLANEXE_BIND_HOST
#    (default 127.0.0.1). To expose them to the LAN (testing from your phone,
#    Claude Desktop on another machine), set:
#      export PLANEXE_BIND_HOST=0.0.0.0
#      docker compose up
#    First set strong PLANEXE_FRONTEND_MULTIUSER_ADMIN_PASSWORD,
#    PLANEXE_MCP_API_KEY, and PLANEXE_MCP_REQUIRE_AUTH=true.
# ============================================================================

x-worker_plan_database-base: &worker_plan_database_base
  build:
    context: .
    dockerfile: worker_plan_database/Dockerfile
  depends_on:
    database_postgres:
      condition: service_healthy
  env_file:
    - .env
  environment: &worker_plan_database_env
    PLANEXE_WORKER_ID: ${PLANEXE_WORKER_ID:-worker_plan_database}
    PLANEXE_CONFIG_PATH: /app
    # Internal container-to-container connection always uses port 5432.
    # This is NOT affected by PLANEXE_POSTGRES_PORT (which is for host mapping only).
    PLANEXE_POSTGRES_HOST: database_postgres
    PLANEXE_POSTGRES_PORT: "5432"
    PLANEXE_POSTGRES_DB: ${PLANEXE_POSTGRES_DB:-planexe}
    PLANEXE_POSTGRES_USER: ${PLANEXE_POSTGRES_USER:-planexe}
    PLANEXE_POSTGRES_PASSWORD: ${PLANEXE_POSTGRES_PASSWORD:-planexe}
    PLANEXE_IFRAME_GENERATOR_CONFIRMATION_PRODUCTION_URL: ${PLANEXE_IFRAME_GENERATOR_CONFIRMATION_PRODUCTION_URL:-https://example.com/iframe_generator_confirmation}
    PLANEXE_IFRAME_GENERATOR_CONFIRMATION_DEVELOPMENT_URL: ${PLANEXE_IFRAME_GENERATOR_CONFIRMATION_DEVELOPMENT_URL:-https://example.com/iframe_generator_confirmation}
  volumes:
    - ./.env:/app/.env:ro
    - ./llm_config:/app/llm_config:ro
  restart: unless-stopped

services:
  database_postgres:
    build:
      context: .
      dockerfile: database_postgres/Dockerfile
    container_name: database_postgres
    environment:
      PLANEXE_POSTGRES_USER: ${PLANEXE_POSTGRES_USER:-planexe}
      PLANEXE_POSTGRES_PASSWORD: ${PLANEXE_POSTGRES_PASSWORD:-planexe}
      PLANEXE_POSTGRES_DB: ${PLANEXE_POSTGRES_DB:-planexe}
      POSTGRES_USER: ${PLANEXE_POSTGRES_USER:-planexe}
      POSTGRES_PASSWORD: ${PLANEXE_POSTGRES_PASSWORD:-planexe}
      POSTGRES_DB: ${PLANEXE_POSTGRES_DB:-planexe}
    # No host port mapping by default. Other containers reach this DB via the
    # docker network as database_postgres:5432. If you want to inspect the
    # database from your host (DBeaver, psql) use a one-off override file or
    # `docker compose exec database_postgres psql -U planexe`.
    volumes:
      - database_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${PLANEXE_POSTGRES_USER:-planexe}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s
    restart: unless-stopped

  worker_plan:
    build:
      context: .
      dockerfile: worker_plan/Dockerfile
    container_name: worker_plan
    env_file:
      - .env
    environment:
      PLANEXE_CONFIG_PATH: /app
      PLANEXE_WORKER_RELAY_PROCESS_OUTPUT: "true"
    # No host port mapping by default. frontend_multi_user reaches this API
    # via the docker network as worker_plan:8000. To curl it from the host
    # use a one-off override file or `docker compose exec worker_plan ...`.
    volumes:
      - ./.env:/app/.env:ro
      - ./llm_config:/app/llm_config:ro
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/healthcheck').read()"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s
    restart: unless-stopped
    develop:
      watch:
        - action: sync
          path: ./worker_plan
          target: /app/worker_plan
        - action: rebuild
          path: ./worker_plan/pyproject.toml
        - action: restart
          path: ./docker-compose.yml

  worker_plan_database:
    <<: *worker_plan_database_base
    container_name: worker_plan_database
    profiles:
      - manual

  worker_plan_database_1:
    <<: *worker_plan_database_base
    container_name: worker_plan_database_1
    environment:
      <<: *worker_plan_database_env
      PLANEXE_WORKER_ID: "1"

  worker_plan_database_2:
    <<: *worker_plan_database_base
    container_name: worker_plan_database_2
    environment:
      <<: *worker_plan_database_env
      PLANEXE_WORKER_ID: "2"

  worker_plan_database_3:
    <<: *worker_plan_database_base
    container_name: worker_plan_database_3
    environment:
      <<: *worker_plan_database_env
      PLANEXE_WORKER_ID: "3"

  frontend_multi_user:
    build:
      context: .
      dockerfile: frontend_multi_user/Dockerfile
    container_name: frontend_multi_user
    depends_on:
      database_postgres:
        condition: service_healthy
      worker_plan:
        condition: service_healthy
    env_file:
      - .env
    environment:
      PLANEXE_FRONTEND_MULTIUSER_DB_HOST: ${PLANEXE_FRONTEND_MULTIUSER_DB_HOST:-database_postgres}
      PLANEXE_FRONTEND_MULTIUSER_DB_PORT: ${PLANEXE_FRONTEND_MULTIUSER_DB_PORT:-5432}
      PLANEXE_FRONTEND_MULTIUSER_DB_NAME: ${PLANEXE_POSTGRES_DB:-planexe}
      PLANEXE_FRONTEND_MULTIUSER_DB_USER: ${PLANEXE_POSTGRES_USER:-planexe}
      PLANEXE_FRONTEND_MULTIUSER_DB_PASSWORD: ${PLANEXE_POSTGRES_PASSWORD:-planexe}
      PLANEXE_FRONTEND_MULTIUSER_ADMIN_USERNAME: ${PLANEXE_FRONTEND_MULTIUSER_ADMIN_USERNAME:-admin}
      PLANEXE_FRONTEND_MULTIUSER_ADMIN_PASSWORD: ${PLANEXE_FRONTEND_MULTIUSER_ADMIN_PASSWORD:-admin}
      PLANEXE_DATABASE_WORKER_URL: ${PLANEXE_DATABASE_WORKER_URL:-http://database_worker:8002}
      PLANEXE_DATABASE_WORKER_API_KEY: ${PLANEXE_DATABASE_WORKER_API_KEY:-}
    ports:
      # PLANEXE_BIND_HOST defaults to 127.0.0.1; override with 0.0.0.0 only
      # after setting a strong PLANEXE_FRONTEND_MULTIUSER_ADMIN_PASSWORD.
      - "${PLANEXE_BIND_HOST:-127.0.0.1}:${PLANEXE_FRONTEND_MULTIUSER_PORT:-5001}:5000"
    volumes:
      - ./.env:/app/.env:ro
      - ./llm_config:/app/llm_config:ro
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:5000/healthcheck').read()"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s
    # Use on-failure so config errors (exit 0) stop the container immediately
    # instead of restart-looping. Runtime crashes (exit != 0) still restart.
    restart: on-failure

  database_worker:
    build:
      context: .
      dockerfile: database_worker/Dockerfile
    container_name: database_worker
    depends_on:
      database_postgres:
        condition: service_healthy
    environment:
      PLANEXE_POSTGRES_HOST: database_postgres
      PLANEXE_POSTGRES_PORT: "5432"
      PLANEXE_POSTGRES_DB: ${PLANEXE_POSTGRES_DB:-planexe}
      PLANEXE_POSTGRES_USER: ${PLANEXE_POSTGRES_USER:-planexe}
      PLANEXE_POSTGRES_PASSWORD: ${PLANEXE_POSTGRES_PASSWORD:-planexe}
      PLANEXE_DATABASE_WORKER_API_KEY: ${PLANEXE_DATABASE_WORKER_API_KEY:-}
    restart: unless-stopped

  mcp_cloud:
    build:
      context: .
      dockerfile: mcp_cloud/Dockerfile
    container_name: mcp_cloud
    depends_on:
      database_postgres:
        condition: service_healthy
      worker_plan:
        condition: service_healthy
    env_file:
      - .env
    environment:
      PLANEXE_CONFIG_PATH: /app
      # Internal container-to-container connection always uses port 5432.
      PLANEXE_POSTGRES_HOST: database_postgres
      PLANEXE_POSTGRES_PORT: "5432"
      PLANEXE_POSTGRES_DB: ${PLANEXE_POSTGRES_DB:-planexe}
      PLANEXE_POSTGRES_USER: ${PLANEXE_POSTGRES_USER:-planexe}
      PLANEXE_POSTGRES_PASSWORD: ${PLANEXE_POSTGRES_PASSWORD:-planexe}
      PLANEXE_MCP_HTTP_HOST: "0.0.0.0"
      PLANEXE_MCP_HTTP_PORT: "8001"
      PLANEXE_MCP_API_KEY: ${PLANEXE_MCP_API_KEY:-}
      PLANEXE_MCP_REQUIRE_AUTH: ${PLANEXE_MCP_REQUIRE_AUTH:-false}
      PLANEXE_MCP_PUBLIC_BASE_URL: ${PLANEXE_MCP_PUBLIC_BASE_URL:-http://localhost:8001}
      PLANEXE_WORKER_PLAN_URL: ${PLANEXE_WORKER_PLAN_URL:-http://worker_plan:8000}
    ports:
      # PLANEXE_BIND_HOST defaults to 127.0.0.1; override with 0.0.0.0 only
      # after setting PLANEXE_MCP_REQUIRE_AUTH=true and PLANEXE_MCP_API_KEY.
      - "${PLANEXE_BIND_HOST:-127.0.0.1}:${PLANEXE_MCP_HTTP_PORT:-8001}:8001"
    volumes:
      - ./llm_config:/app/llm_config:ro
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8001/healthcheck').read()"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s

volumes:
  database_postgres_data:
    # Use the volume from the main PlanExe repo so both repos share the same database.
    external: true
    name: planexe_database_postgres_data