x-restart: &restart
  restart: unless-stopped

services:
  postgres:
    image: postgres:16-alpine
    profiles: [db]
    <<: *restart
    env_file: .env
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:${PORT_POSTGRES:-5432}:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 3s
      retries: 20

  obsidian-headless:
    container_name: beaver-obsidian
    build:
      context: .
      dockerfile: obsidian.Dockerfile
    profiles: [obsidian]
    <<: *restart
    volumes:
      - vault:/vault
      - obsidian-config:/root/.config
    working_dir: /vault

  gateway:
    container_name: beaver-gateway
    build:
      context: https://git.kotikot.com/beaver/beaver-gateway.git#${GATEWAY_REF:-main}
    profiles: [gateway]
    <<: *restart
    depends_on:
      postgres:
        condition: service_healthy
    env_file: .env
    environment:
      CONFIG_PATH: /config/config.py
      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-beaver}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-beaver}
      RAYCAST_CONFIG_PATH: /config/config.json
      # Процесс модели: свой uid, свой HOME (там ~/.claude), белый список env
      # собирает адаптер. В env модели нет DATABASE_URL, POSTGRES_*, *_PAT.
      CLAUDE_RUNNER_USER: beaver-runner
      CLAUDE_HOME: /home/beaver-runner
    ports:
      - "${PORT_MESSAGES:-62990}:62990"  # anthropic
      - "${PORT_MCP:-62991}:62991"  # mcp
      - "${PORT_ADMIN:-62992}:62992"  # admin
      - "${PORT_MARKDOWN:-62993}:62993"  # obsidian companion
      - "${PORT_API:-62994}:62994"  # conversations api + sse
    volumes:
      - ./config.py:/config/config.py:ro
      - ./config.json:/config/config.json:ro
      # §3.7: vault только на чтение, rw - подмонтирования зон агента.
      - vault:/vault:ro
      - type: volume
        source: vault
        target: /vault/мета/бобер
        volume:
          subpath: мета/бобер
      - type: volume
        source: vault
        target: /vault/💬 чаты
        volume:
          subpath: 💬 чаты
      - claude-home:/home/beaver-runner/.claude
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:62990/healthz', timeout=3)"]
      interval: 30s
      timeout: 5s
      start_period: 60s
      retries: 3
    entrypoint:
      - /bin/sh
      - -c
      - |
        set -e
        runner=beaver-runner
        mkdir -p /home/$$runner/.claude
        [ -e /home/$$runner/.claude/.claude.json ] || echo '{}' > /home/$$runner/.claude/.claude.json
        chown -R $$runner /home/$$runner
        for d in "/vault/мета/бобер" "/vault/💬 чаты"; do
          setfacl -R -m "u:$$runner:rwX" -m "d:u:$$runner:rwX" "$$d" \
            || chown -R $$runner "$$d" \
            || echo "warning: cannot grant $$runner write access to $$d"
        done
        exec python -m beaver_gateway

volumes:
  postgres-data:
  vault:
  obsidian-config:
  claude-home: