docker-compose.prod.yml

services:
  postgres:
    image: pgvector/pgvector:pg16
    restart: unless-stopped
    environment:
      POSTGRES_USER: "${POSTGRES_USER:-bidwright}"
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-bidwright}"
      POSTGRES_DB: "${POSTGRES_DB:-bidwright}"
    volumes:
      - ${POSTGRES_DATA_PATH:-pgdata}:/var/lib/postgresql/data
      - ./scripts/db/init-pgvector.sql:/docker-entrypoint-initdb.d/01-pgvector.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-bidwright} -d ${POSTGRES_DB:-bidwright}"]
      interval: 5s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - ${REDIS_DATA_PATH:-redisdata}:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5

  ollama:
    image: ollama/ollama
    profiles:
      - embeddings
    restart: unless-stopped
    volumes:
      - ${OLLAMA_DATA_PATH:-ollama_data}:/root/.ollama
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://127.0.0.1:11434/"]
      interval: 5s
      timeout: 5s
      retries: 10

  # Pulls the embedding model on first run, then exits
  ollama-init:
    image: curlimages/curl:latest
    profiles:
      - embeddings
    depends_on:
      ollama:
        condition: service_healthy
    restart: "no"
    entrypoint: >
      sh -c "curl -sf -X POST http://ollama:11434/api/pull -d '{\"name\":\"${EMBEDDING_MODEL:-snowflake-arctic-embed}\"}' && echo 'Model ready'"

  # Applies pending Prisma migrations from packages/db/prisma/migrations
  # against Postgres before api/worker start. Migrations are the canonical
  # source of truth; destructive changes must be authored explicitly.
  db-migrate:
    build:
      context: .
      dockerfile: Dockerfile.api
      target: builder
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DATABASE_URL: "${DATABASE_URL:-postgresql://bidwright:bidwright@postgres:5432/bidwright}"
    restart: "no"
    # Use `prisma migrate deploy` so migration files in
    # packages/db/prisma/migrations are the canonical source of truth.
    # Destructive changes must be authored as explicit SQL with backfill
    # blocks; `migrate deploy` applies them exactly as written.
    command: >
      sh -c "pnpm --filter @bidwright/db db:migrate"

  api:
    build:
      context: .
      dockerfile: Dockerfile.api
    restart: unless-stopped
    # CAP_SYS_ADMIN + relaxed seccomp/apparmor are required by bubblewrap
    # (BubblewrappedHost) for per-tenant pivot_root + mount inside CLI
    # session namespaces. Scope is the api container only; bwrap drops
    # all caps before exec'ing the actual CLI child.
    cap_add:
      - SYS_ADMIN
    security_opt:
      - seccomp:unconfined
      - apparmor:unconfined
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
    environment:
      DATABASE_URL: "${DATABASE_URL:-postgresql://bidwright:bidwright@postgres:5432/bidwright}"
      REDIS_URL: "${REDIS_URL:-redis://redis:6379}"
      DATA_DIR: "${DATA_DIR:-/data}"
      API_PORT: "${API_PORT:-3001}"
      # Multi-tenant server mode: each authenticated user gets a per-user CLI
      # auth namespace under AGENT_HOME_ROOT/users/<userId>; CLAUDE_CONFIG_DIR /
      # CODEX_HOME / XDG_DATA_HOME / HOME are written at spawn time so user A's
      # OAuth never leaks into user B's CLI session.
      BIDWRIGHT_MODE: "${BIDWRIGHT_MODE:-server}"
      AGENT_HOME_ROOT: "${AGENT_HOME_ROOT:-/data/agent-home}"
      # When true, every CLI spawn runs inside a per-user bwrap sandbox.
      # Required for any multi-user deployment. bwrap ships setuid root in
      # the api image so no --privileged flag is needed.
      BIDWRIGHT_MULTITENANT: "${BIDWRIGHT_MULTITENANT:-true}"
      # Workspace snapshot/restore so user project files survive host
      # restarts and follow them across api pool members. Set
      # WORKSPACE_STORAGE_PROVIDER=s3 + the S3-compatible config below
      # (Cloudflare R2 by default — auto region, R2 endpoint).
      WORKSPACE_STORAGE_PROVIDER: "${WORKSPACE_STORAGE_PROVIDER:-}"
      WORKSPACE_S3_BUCKET: "${WORKSPACE_S3_BUCKET:-}"
      WORKSPACE_S3_REGION: "${WORKSPACE_S3_REGION:-auto}"
      WORKSPACE_S3_ENDPOINT: "${WORKSPACE_S3_ENDPOINT:-}"
      WORKSPACE_S3_ACCESS_KEY_ID: "${WORKSPACE_S3_ACCESS_KEY_ID:-}"
      WORKSPACE_S3_SECRET_ACCESS_KEY: "${WORKSPACE_S3_SECRET_ACCESS_KEY:-}"
      WORKSPACE_S3_PREFIX: "${WORKSPACE_S3_PREFIX:-bidwright/workspaces}"
      WORKSPACE_S3_FORCE_PATH_STYLE: "${WORKSPACE_S3_FORCE_PATH_STYLE:-false}"
      # The db-migrate container applies pending migrations (`prisma migrate deploy`) before
      # api starts, so the API's bootstrap shouldn't also try `migrate deploy`.
      BIDWRIGHT_SKIP_BOOTSTRAP_MIGRATIONS: "1"
      EMBEDDING_PROVIDER: "${EMBEDDING_PROVIDER:-local}"
      EMBEDDING_BASE_URL: "http://ollama:11434/v1"
      EMBEDDING_MODEL: "${EMBEDDING_MODEL:-snowflake-arctic-embed}"
      EMBEDDING_DIMENSIONS: "${EMBEDDING_DIMENSIONS:-1024}"
      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
      OPENAI_MODEL: "${OPENAI_MODEL:-gpt-5}"
    volumes:
      - ${BIDWRIGHT_DATA_PATH:-./data/bidwright-api}:/data
      - ${AGENT_HOME_PATH:-/opt/bidwright/data/agent-home}:/data/agent-home
    ports:
      - "${API_PUBLIC_PORT:-3001}:3001"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3001/health >/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s

  web:
    build:
      context: .
      dockerfile: Dockerfile.web
    restart: unless-stopped
    depends_on:
      - api
    environment:
      NEXT_PUBLIC_API_BASE_URL: "${NEXT_PUBLIC_API_BASE_URL:-http://localhost:3001}"
      INTERNAL_API_BASE_URL: "http://api:3001"
    ports:
      - "${WEB_PUBLIC_PORT:-3000}:3000"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000 >/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s

  worker:
    build:
      context: .
      dockerfile: Dockerfile.worker
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
    environment:
      DATABASE_URL: "${DATABASE_URL:-postgresql://bidwright:bidwright@postgres:5432/bidwright}"
      REDIS_URL: "${REDIS_URL:-redis://redis:6379}"
      DATA_DIR: "${DATA_DIR:-/data}"
      API_PORT: "${API_PORT:-3001}"
      EMBEDDING_PROVIDER: "${EMBEDDING_PROVIDER:-local}"
      EMBEDDING_BASE_URL: "http://ollama:11434/v1"
      EMBEDDING_MODEL: "${EMBEDDING_MODEL:-snowflake-arctic-embed}"
      EMBEDDING_DIMENSIONS: "${EMBEDDING_DIMENSIONS:-1024}"
      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
    volumes:
      - ${BIDWRIGHT_DATA_PATH:-./data/bidwright-api}:/data

volumes:
  pgdata:
  redisdata:
  ollama_data: