docker-compose.yml

services:
  gluetun:
    image: qmcgaw/gluetun:v3.40
    container_name: opencode2-vpn
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - "127.0.0.1:${OPENCODE_HTTP_PROXY_PORT:-8888}:8888/tcp"
      - "127.0.0.1:${OPENCODE_SERVER_PORT:-4096}:4096/tcp"
    environment:
      VPN_SERVICE_PROVIDER: protonvpn
      VPN_TYPE: wireguard
      WIREGUARD_PRIVATE_KEY: ${WIREGUARD_PRIVATE_KEY:?Set WIREGUARD_PRIVATE_KEY in .env}
      SERVER_COUNTRIES: United States
      HTTPPROXY: "on"
      HTTPPROXY_LOG: "off"
      TZ: ${TZ:-UTC}
    volumes:
      - gluetun-data:/gluetun
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:9999"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s
    restart: unless-stopped

  opencode:
    build:
      context: .
      args:
        OPENCODE_VERSION: ${OPENCODE_VERSION:-beta}
    container_name: opencode2
    network_mode: service:gluetun
    depends_on:
      gluetun:
        condition: service_healthy
    stdin_open: true
    tty: true
    working_dir: /repo
    command: ["serve", "--hostname", "0.0.0.0", "--port", "4096"]
    environment:
      TZ: ${TZ:-UTC}
      # Provider credentials are read by OpenCode from the environment.
      OPENCODE_API_KEY: ${OPENCODE_API_KEY:-}
      OPENCODE_SERVER_PASSWORD: ${OPENCODE_SERVER_PASSWORD:?Set OPENCODE_SERVER_PASSWORD in .env}
    volumes:
      - ./opencode.jsonc:/root/.config/opencode/opencode.jsonc:ro
      - ${HOME}/.agents:/root/.agents:ro
      - opencode-data:/root/.local/share/opencode
      - ..:/repo
    restart: "no"

volumes:
  gluetun-data:
  opencode-data: