# lvmh daemon + worker builder context. Build worker image first (make worker-image).
services:
  lvmh:
    build:
      context: .
      dockerfile: daemon/Dockerfile
    image: lvmh-daemon:latest
    container_name: lvmh-daemon
    restart: unless-stopped
    ports:
      - "8686:8686"
    environment:
      LVMH_TOKEN: ${LVMH_TOKEN}
      ZAI_RENAUD_API_KEY: ${ZAI_RENAUD_API_KEY}
      # How spawned containers reach the daemon: alias on the shared network.
      LVMH_CONTAINER_LVMH_URL: ws://lvmh:8686/agent/ws
      GITLAB_BASE_URL: https://git.westphal.fr
      # host path of the pi config, so spawned containers can bind auth.json
      # docker.sock bind semantics: bind sources resolve on the HOST, so
      # this must be the HOST path of the pi config (auth.json etc.).
      LVMH_HOST_PI_AGENT_DIR: ${LVMH_PI_AGENT_DIR:-/home/alarm/.dotfiles/pi/agent}
      LVMH_SECRETS_DIR: /zdata/root/lvmh-secrets
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      GEMINI_API_KEY: ${GEMINI_API_KEY:-}
      DEEPSEEK_KEY: ${DEEPSEEK_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - lvmh-data:/data
      - .:/app/build:ro # repo checkout (rsynced by deploy.sh)
        # daemon rebuilds lvmh-worker from /app/build/docker/worker.Dockerfile
      - ./web/dist:/app/web-dist:ro # web UI served from repo checkout
      - ${LVMH_PI_AGENT_DIR:-/home/raph/.dotfiles/pi/agent}:/pi-dotfiles:ro
        # read-only user pi config; POST /api/pi-config/resync bakes it into
        # fresh worker+ops images
    networks:
      lvmh-net:
        aliases: [lvmh]

volumes:
  lvmh-data:

networks:
  lvmh-net:
    name: lvmh-net