docker-compose.yml

services:
  # Code Quality MCP Server (Rust)
  mcp-code-quality:
    build:
      context: .
      dockerfile: docker/mcp-code-quality.Dockerfile
      args:
        USER_ID: ${USER_ID:-1000}
        GROUP_ID: ${GROUP_ID:-1000}
    ports:
      - "8010:8010"
    volumes:
      - ./:/app:ro  # Read-only mount for security
      - /tmp:/tmp   # For temporary files
    environment:
      - RUST_LOG=info
      - MCP_CODE_QUALITY_ALLOWED_PATHS=/app,/workspace,/home
      - MCP_CODE_QUALITY_RATE_LIMIT=true
    networks:
      - mcp-network
    command: ["mcp-code-quality", "--mode", "standalone", "--port", "8010", "--allowed-paths", "/app,/workspace,/home"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8010/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    profiles:
      - services

  # Content Creation MCP Server (Rust)
  mcp-content-creation:
    build:
      context: .
      dockerfile: docker/mcp-content.Dockerfile
      args:
        USER_ID: ${USER_ID:-1000}
        GROUP_ID: ${GROUP_ID:-1000}
    ports:
      - "8011:8011"
    volumes:
      - ./outputs/mcp-content:/output  # Bind mount to local outputs directory
      - .:/app:ro                      # Mount repo root read-only for input files
    environment:
      - RUST_LOG=info
      - MCP_OUTPUT_DIR=/output
      - MCP_PROJECT_ROOT=/app
      - MCP_HOST_PROJECT_ROOT=${PWD}
    networks:
      - mcp-network
    command: ["mcp-content-creation", "--mode", "standalone", "--port", "8011", "--output-dir", "/output", "--project-root", "/app"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8011/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    profiles:
      - services

  # Meme Generator MCP Server (Rust)
  mcp-meme-generator:
    build:
      context: .
      dockerfile: docker/mcp-meme.Dockerfile
      args:
        USER_ID: ${USER_ID:-1000}
        GROUP_ID: ${GROUP_ID:-1000}
    ports:
      - "8016:8016"
    volumes:
      - ./outputs/mcp-memes:/output  # Bind mount to local outputs directory
    environment:
      - RUST_LOG=info
    networks:
      - mcp-network
    command: ["mcp-meme-generator", "--mode", "standalone", "--port", "8016", "--templates", "/app/templates", "--output", "/output"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8016/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    profiles:
      - services

  # GitHub Board MCP Server (Rust)
  mcp-github-board:
    build:
      context: .
      dockerfile: docker/mcp-github-board.Dockerfile
      args:
        USER_ID: ${USER_ID:-1000}
        GROUP_ID: ${GROUP_ID:-1000}
    ports:
      - "8022:8022"
    volumes:
      - ./:/app:ro  # Read-only mount for security
      - /tmp:/tmp   # For temporary files
    environment:
      - RUST_LOG=info
      - GITHUB_TOKEN=${GITHUB_TOKEN}
      - GITHUB_REPOSITORY=${GITHUB_REPOSITORY}
      - GITHUB_PROJECT_NUMBER=${GITHUB_PROJECT_NUMBER:-1}
    networks:
      - mcp-network
    command: ["mcp-github-board", "--mode", "standalone", "--port", "8022"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8022/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - services

  # Video Editor MCP Server
  mcp-video-editor:
    build:
      context: .
      dockerfile: docker/mcp-video-editor.Dockerfile
    # Note: user directive removed - entrypoint handles user switching after permission setup
    ports:
      - "8019:8019"
    volumes:
      - ./:/app:ro
      - ./outputs/video-editor:/output  # Output directory for rendered videos
      - video-editor-cache:/cache  # Named volume for transcripts and analysis cache
    environment:
      - PYTHONUNBUFFERED=1
      - PORT=8019
      - MCP_VIDEO_OUTPUT_DIR=/output
      - MCP_VIDEO_CACHE_DIR=/cache
      - WHISPER_MODEL=${WHISPER_MODEL:-medium}
      - WHISPER_DEVICE=${WHISPER_DEVICE:-cuda}
      - DIART_DEVICE=${DIART_DEVICE:-cuda}
      - HUGGINGFACE_TOKEN=${HUGGINGFACE_TOKEN}
      - ENABLE_GPU=${ENABLE_GPU:-true}
      # GPU device selection for multi-GPU systems
      # IMPORTANT: GPU_DEVICE should be set to a single device index (e.g., 0, 1, 2)
      # Do NOT set GPU_DEVICE to "all" when using count: 1 in deploy.resources.reservations
      # If you need all GPUs, remove the count: 1 constraint and set GPU_DEVICE=all
      - NVIDIA_VISIBLE_DEVICES=${GPU_DEVICE:-0}
      - CUDA_VISIBLE_DEVICES=${GPU_DEVICE:-0}
    networks:
      - mcp-network
    command: ["mcp-video-editor", "--mode", "standalone", "--port", "8019"]
    restart: unless-stopped
    # GPU support for AI models and video encoding
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8019/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    profiles:
      - services
      - gpu

  # ElevenLabs Speech MCP Server (Rust)
  mcp-elevenlabs-speech:
    build:
      context: .
      dockerfile: docker/elevenlabs.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    ports:
      - "8018:8018"
    volumes:
      - ./outputs/elevenlabs_speech:/output  # Bind mount to local outputs directory
    environment:
      - RUST_LOG=info
      - PORT=8018  # Note: If you change this port, also update the healthcheck below
      - MCP_OUTPUT_DIR=/output
      - ELEVENLABS_API_KEY=${ELEVENLABS_API_KEY}
      - ELEVENLABS_DEFAULT_MODEL=${ELEVENLABS_DEFAULT_MODEL:-eleven_multilingual_v2}
      - ELEVENLABS_DEFAULT_VOICE=${ELEVENLABS_DEFAULT_VOICE:-Rachel}
    networks:
      - mcp-network
    command: ["mcp-elevenlabs-speech", "--mode", "http", "--port", "8018"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8018/health"]  # Must match PORT above
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - services

  # Blender MCP Server
  mcp-blender:
    build:
      context: .
      dockerfile: docker/blender-mcp.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    ports:
      - "8017:8017"
    volumes:
      - ./outputs/blender/projects:/app/projects
      - ./outputs/blender/assets:/app/assets
      - ./outputs/blender/renders:/app/outputs
      - ./outputs/blender/templates:/app/templates
    environment:
      - PYTHONUNBUFFERED=1
    networks:
      - mcp-network
    # GPU support (optional - uncomment if GPU available)
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: 1
    #           capabilities: [gpu]
    #     # Optional resource limits to prevent excessive consumption
    #     limits:
    #       cpus: '4.0'
    #       memory: 8G
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8017/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    profiles:
      - services
      - gpu

  # Gaea2 MCP Server (Windows host required for full functionality)
  # Gaea2 MCP Server (Rust)
  # Note: CLI automation requires Windows host with Gaea2 installed at GAEA2_PATH
  #       Container provides project creation, validation, and template generation
  mcp-gaea2:
    build:
      context: .
      dockerfile: docker/mcp-gaea2.Dockerfile
    ports:
      - "8007:8007"
    volumes:
      - ./outputs/mcp-gaea2:/output/gaea2  # Bind mount for generated projects
    environment:
      - RUST_LOG=info
      - MCP_OUTPUT_DIR=/output/gaea2
    networks:
      - mcp-network
    # Command args only - ENTRYPOINT provides the binary
    command: ["--mode", "standalone", "--port", "8007", "--output-dir", "/output/gaea2"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8007/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    profiles:
      - services

  # Sleeper Agent Detection - Evaluation Mode (CPU)
  sleeper-eval-cpu:
    build:
      context: .
      dockerfile: docker/sleeper-evaluation-cpu.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./:/app:ro
      - ./evaluation_results:/results  # Evaluation results and reports
      - sleeper-models-cache:/models  # Model cache
      - sleeper-eval-db:/db  # SQLite database
    environment:
      - PYTHONUNBUFFERED=1
      - SLEEPER_CPU_MODE=true
      - DEVICE=cpu
    networks:
      - mcp-network
    # Default: Run CLI test for validation.
    # To run API server instead: docker compose run --rm sleeper-eval-cpu uvicorn sleeper_agents.api.main:app --host 0.0.0.0 --port 8022
    command: ["python", "-m", "sleeper_agents.cli", "test", "--cpu"]
    profiles:
      - evaluation
      - eval-cpu

  # Sleeper Agent Detection - Evaluation Mode (GPU)
  sleeper-eval-gpu:
    build:
      context: .
      dockerfile: docker/sleeper-evaluation.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./:/app:ro
      - ./evaluation_results:/results
      - sleeper-models-cache:/models
      - sleeper-eval-db:/db
    environment:
      - PYTHONUNBUFFERED=1
      - SLEEPER_CPU_MODE=false
      - CUDA_VISIBLE_DEVICES=0
      - NVIDIA_VISIBLE_DEVICES=all
      - DEVICE=cuda
    networks:
      - mcp-network
    # Default: Run model evaluation.
    # To run API server instead: docker compose run --rm sleeper-eval-gpu uvicorn sleeper_agents.api.main:app --host 0.0.0.0 --port 8022
    command: ["python", "-m", "sleeper_agents.cli", "evaluate", "--gpu"]
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]
    runtime: nvidia
    profiles:
      - evaluation-gpu
      - eval-gpu

  # Sleeper Detection Dashboard
  sleeper-dashboard:
    build:
      context: ./packages/sleeper_agents/dashboard
      dockerfile: Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    ports:
      - "8501:8501"
    volumes:
      - ./packages/sleeper_agents/dashboard:/home/dashboard/app:ro
      - ./evaluation_results:/home/dashboard/app/evaluation_results
      - sleeper-eval-db:/home/dashboard/app/db  # Share database with evaluation services
    environment:
      - DATABASE_PATH=/home/dashboard/app/db/evaluation_results.db
      - DASHBOARD_ADMIN_PASSWORD=${DASHBOARD_ADMIN_PASSWORD}
      - PYTHONUNBUFFERED=1
      - STREAMLIT_SERVER_HEADLESS=true
      - STREAMLIT_SERVER_PORT=8501
      - STREAMLIT_SERVER_ADDRESS=0.0.0.0
    networks:
      - mcp-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8501/_stcore/health"]
      interval: 30s
      timeout: 10s
      start_period: 30s
      retries: 3
    profiles:
      - dashboard
      - evaluation

  # Gemini MCP Server
  mcp-gemini:
    build:
      context: .
      dockerfile: docker/mcp-gemini.Dockerfile
      args:
        USER_ID: "${USER_ID:-1000}"
        GROUP_ID: "${GROUP_ID:-1000}"
    ports:
      - "8012:8012"
    volumes:
      - ~/.gemini:/home/geminiuser/.gemini  # Mount host Gemini credentials directory
      - ./:/workspace:ro  # Mount workspace for file access (read-only)
    environment:
      - PYTHONUNBUFFERED=1
      # Pass API key from .env file (CLI will use this over corrupted token file)
      - GEMINI_API_KEY=${GOOGLE_API_KEY:-}
      # Explicitly unset GOOGLE_API_KEY to avoid Vertex API confusion
      - GOOGLE_API_KEY=
      - GEMINI_TIMEOUT=${GEMINI_TIMEOUT:-300}
      - GEMINI_USE_CONTAINER=false  # Disable nested containerization
      - HOME=/home/geminiuser  # Set home directory for .gemini access
    networks:
      - mcp-network
    command: ["mcp-gemini", "--mode", "standalone", "--port", "8012"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8012/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    profiles:
      - services

  # Virtual Character MCP Server (Rust - Middleware only - VRChat runs on remote Windows)
  # This is the middleware that bridges AI agents to virtual platforms.
  # For VRChat: Connects to Windows machine at VRCHAT_REMOTE_HOST (default 192.168.0.152)
  mcp-virtual-character:
    build:
      context: .
      dockerfile: docker/mcp-virtual-character.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    ports:
      - "8025:8025"
    environment:
      - VIRTUAL_CHARACTER_HOST=${VRCHAT_REMOTE_HOST:-127.0.0.1}
      - VIRTUAL_CHARACTER_OSC_IN=9000
      - VIRTUAL_CHARACTER_OSC_OUT=9001
    networks:
      - mcp-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8025/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    profiles:
      - services

  # AI Toolkit (Web UI and MCP Server)
  mcp-ai-toolkit:
    build:
      context: .
      dockerfile: docker/ai-toolkit.Dockerfile
    runtime: nvidia
    ports:
      - "8675:8675"   # Web UI (Next.js app)
      - "8020:8020"   # MCP Server (changed from 8012 to avoid conflict with mcp-gemini)
    volumes:
      - ./:/workspace/repo:ro
      - ai-toolkit-datasets:/ai-toolkit/datasets
      - ai-toolkit-outputs:/ai-toolkit/outputs
      - ai-toolkit-configs:/ai-toolkit/configs
      - ai-toolkit-logs:/workspace/logs
    environment:
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=compute,utility,graphics
      - PYTHONUNBUFFERED=1
      - AI_TOOLKIT_PATH=/ai-toolkit
    networks:
      - mcp-network
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
    restart: unless-stopped
    # Healthcheck defined in Dockerfile
    profiles:
      - ai-services
      - gpu

  # ComfyUI (Web UI and MCP Server)
  mcp-comfyui:
    build:
      context: .
      # Use COMFYUI_DOCKERFILE env var for architecture-specific builds (arm64 vs x86_64)
      dockerfile: ${COMFYUI_DOCKERFILE:-docker/comfyui.Dockerfile}
    runtime: nvidia
    user: "${USER_ID}:${GROUP_ID}"
    ports:
      - "8188:8188"   # Web UI
      - "8013:8013"   # MCP Server
    volumes:
      - ./:/workspace/repo:ro
      # Model directories - persist between container restarts
      - ./comfyui/models/checkpoints:/comfyui/models/checkpoints
      - ./comfyui/models/clip:/comfyui/models/clip
      - ./comfyui/models/clip_vision:/comfyui/models/clip_vision
      - ./comfyui/models/controlnet:/comfyui/models/controlnet
      - ./comfyui/models/diffusers:/comfyui/models/diffusers
      - ./comfyui/models/embeddings:/comfyui/models/embeddings
      - ./comfyui/models/gligen:/comfyui/models/gligen
      - ./comfyui/models/hypernetworks:/comfyui/models/hypernetworks
      - ./comfyui/models/loras:/comfyui/models/loras
      - ./comfyui/models/style_models:/comfyui/models/style_models
      - ./comfyui/models/unet:/comfyui/models/unet
      - ./comfyui/models/upscale_models:/comfyui/models/upscale_models
      - ./comfyui/models/vae:/comfyui/models/vae
      - ./comfyui/models/vae_approx:/comfyui/models/vae_approx
      - ./comfyui/models/text_encoders:/comfyui/models/text_encoders
      - ./comfyui/models/diffusion_models:/comfyui/models/diffusion_models
      # Output and input directories
      - ./comfyui/output:/comfyui/output
      - ./comfyui/input:/comfyui/input
    environment:
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=compute,utility,graphics
      - PYTHONUNBUFFERED=1
      - COMFYUI_PATH=/comfyui
    networks:
      - mcp-network
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
    restart: unless-stopped
    # Healthcheck defined in Dockerfile
    profiles:
      - ai-services
      - gpu


  # OpenCode MCP Server (Rust)
  mcp-opencode:
    build:
      context: .
      dockerfile: docker/mcp-opencode.Dockerfile
      args:
        USER_ID: ${USER_ID:-1000}
        GROUP_ID: ${GROUP_ID:-1000}
    ports:
      - "8014:8014"
    volumes:
      - ./:/app:ro
    environment:
      - PORT=8014
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
      - OPENCODE_ENABLED=${OPENCODE_ENABLED:-true}
      - OPENCODE_MODEL=${OPENCODE_MODEL:-qwen/qwen-2.5-coder-32b-instruct}
    networks:
      - mcp-network
    command: ["mcp-opencode", "--mode", "standalone", "--port", "8014"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8014/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - services

  # Crush MCP Server (Rust)
  mcp-crush:
    build:
      context: .
      dockerfile: docker/mcp-crush.Dockerfile
      args:
        USER_ID: ${USER_ID:-1000}
        GROUP_ID: ${GROUP_ID:-1000}
    ports:
      - "8015:8015"
    volumes:
      - ./:/app:ro
    environment:
      - PORT=8015
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
      - CRUSH_ENABLED=${CRUSH_ENABLED:-true}
    networks:
      - mcp-network
    command: ["mcp-crush", "--mode", "standalone", "--port", "8015"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8015/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - services

  # Codex MCP Server (Rust) -- DISABLED
  # SECURITY: OpenAI/Codex has been disabled. OpenAI is partnering with governments
  # that conduct mass surveillance and enable autonomous weapons. This makes
  # any OpenAI product a security risk for pipelines handling proprietary code.
  # Use Anthropic models instead. To re-enable, remove the 'codex-disabled' profile.
  # NOTE: Builds gh-validator and mcp-codex from source inline (multi-stage build)
  mcp-codex:
    build:
      context: .
      dockerfile: docker/codex.Dockerfile
      args:
        MODE: mcp
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    ports:
      - "8021:8021"
    volumes:
      - ./:/workspace:ro  # Read-only mount for security
      # Read-write is required for Codex to manage session files and history.
      # The auth token itself is protected by the host's file permissions.
      - ~/.codex:/home/user/.codex:rw
    environment:
      - MODE=mcp
      - PORT=8021
      - CODEX_ENABLED=${CODEX_ENABLED:-true}
      - CODEX_AUTH_PATH=/home/user/.codex/auth.json
      - CODEX_BYPASS_SANDBOX=${CODEX_BYPASS_SANDBOX:-false}  # Default to sandboxed
    networks:
      - mcp-network
    command: ["mcp-codex", "--mode", "standalone", "--port", "8021"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8021/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - codex-disabled  # Was 'services' -- disabled for security reasons

  # AI Agents container for GitHub automation
  ai-agents:
    build:
      context: .
      dockerfile: docker/ai-agents.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./:/workspace
    environment:
      - PYTHONUNBUFFERED=1
      - GITHUB_REPOSITORY=${GITHUB_REPOSITORY}
      - ENABLE_AGENTS=${ENABLE_AGENTS:-false}
      - CONTAINER=ai-agents
    # Secrets are mounted as volumes at runtime - see workflows
    working_dir: /workspace
    networks:
      - mcp-network
    # Default to interactive mode for development
    # Override with docker compose run for specific agent commands
    command: ["/bin/bash"]
    tty: true
    stdin_open: true
    profiles:
      - agents

  # OpenRouter Agents container (OpenCode, Crush)
  # NOTE: Requires mcp-opencode and mcp-crush images to be built first
  # NOTE: Builds gh-validator from source inline (multi-stage build)
  openrouter-agents:
    build:
      context: .
      dockerfile: docker/openrouter-agents.Dockerfile
      args:
        OPENCODE_IMAGE: template-repo-mcp-opencode:latest
        CRUSH_IMAGE: template-repo-mcp-crush:latest
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./:/workspace
      # SECURITY: Use environment variables for credentials instead of mounting host directories
      # This prevents exposing host filesystem paths to the container
      # API keys should be passed via OPENROUTER_API_KEY environment variable
    environment:
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
      - GITHUB_REPOSITORY=${GITHUB_REPOSITORY}
      - CONTAINER=openrouter-agents
    working_dir: /workspace
    networks:
      - mcp-network
    command: ["/bin/bash"]
    tty: true
    stdin_open: true
    profiles:
      - agents
      - openrouter

  # Codex Agent container (OpenAI Codex) -- DISABLED
  # SECURITY: OpenAI/Codex has been disabled. See mcp-codex comment above for details.
  # NOTE: Builds gh-validator from source inline (multi-stage build)
  codex-agent:
    build:
      context: .
      dockerfile: docker/codex.Dockerfile
      args:
        MODE: agent
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./:/workspace
      # Mount Codex auth from host (needs write access for history/config)
      # User must authenticate on host first with: codex auth
      - ~/.codex:/home/user/.codex:rw
    environment:
      - MODE=agent
      - NODE_ENV=production
      - GITHUB_REPOSITORY=${GITHUB_REPOSITORY}
      - CONTAINER=codex-agent
    working_dir: /workspace
    networks:
      - mcp-network
    command: ["/bin/bash"]
    tty: true
    stdin_open: true
    profiles:
      - codex-disabled  # Was 'agents'/'codex' -- disabled for security reasons

  # Hardened Agent container with wrapper-only CLI access
  # Real git/gh binaries are permission-restricted; only wrappers are available.
  # No package managers, curl, or wget to prevent installing bypass tools.
  hardened-agent:
    build:
      context: .
      dockerfile: docker/hardened-agent.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./:/workspace
    working_dir: /workspace
    read_only: true
    tmpfs:
      - /tmp:size=100M
    environment:
      - GITHUB_REPOSITORY=${GITHUB_REPOSITORY}
      - CONTAINER=hardened-agent
    networks:
      - mcp-network
    command: ["/bin/bash"]
    tty: true
    stdin_open: true
    profiles:
      - agents
      - hardened

  # TeXLive container for building LaTeX documents
  # Multi-arch support (amd64 and arm64)
  texlive:
    build:
      context: .
      dockerfile: docker/texlive.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./:/data
    working_dir: /data
    command: ["pdflatex", "--version"]
    profiles:
      - ci
      - docs

  # Python CI container for running tests and linting
  # NOTE: Builds gh-validator from source inline (multi-stage build)
  python-ci:
    build:
      context: .
      dockerfile: docker/python-ci.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./:/app
      - ~/.cache/pre-commit:/home/user/.cache/pre-commit
      - ~/.cache/uv:/home/user/.cache/uv  # Cache uv downloads for faster installs
    environment:
      - PYTHONUNBUFFERED=1
      - CI=true
      - SKIP_SLOW_TESTS=${SKIP_SLOW_TESTS:-false}
      - PRE_COMMIT_HOME=/home/user/.cache/pre-commit
      - UV_CACHE_DIR=/home/user/.cache/uv  # Match volume mount path for non-root user
    working_dir: /app
    networks:
      - mcp-network
    command: ["/bin/bash"]
    stdin_open: true
    tty: true
    profiles:
      - ci

  # Rust CI container for Rust workspace projects
  # Cargo registry/git cache persisted via named volume to avoid re-downloading
  # dependencies on every CI run (~30s saving per workspace invocation)
  rust-ci:
    build:
      context: .
      dockerfile: docker/rust-ci.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - .:/app
      - cargo-registry-cache:/tmp/cargo
    environment:
      - CARGO_HOME=/tmp/cargo  # World-writable, works with any USER_ID
      - RUSTUP_HOME=/usr/local/rustup  # Read-only, pre-installed in image
      - CARGO_INCREMENTAL=1
      - CI=true
    working_dir: /app
    networks:
      - mcp-network
    command: ["/bin/bash"]
    stdin_open: true
    tty: true
    profiles:
      - ci

  # Rust CI with nightly toolchain for advanced testing (Miri, Loom, cross-compile)
  rust-ci-nightly:
    build:
      context: .
      dockerfile: docker/rust-ci-nightly.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - .:/app
      - cargo-registry-cache:/tmp/cargo
    environment:
      - CARGO_HOME=/tmp/cargo  # World-writable, works with any USER_ID
      - RUSTUP_HOME=/usr/local/rustup  # Read-only, pre-installed in image
      - CARGO_INCREMENTAL=1
      - CI=true
    working_dir: /app
    networks:
      - mcp-network
    command: ["/bin/bash"]
    stdin_open: true
    tty: true
    profiles:
      - ci

  # Terraform/Terragrunt CI with AWS CLI for infrastructure deployment
  terraform-ci:
    build:
      context: .
      dockerfile: docker/terraform-ci.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - .:/workspace
      - ${HOME}/.aws:/home/ciuser/.aws  # Mount AWS credentials (needs write for SSO cache)
    environment:
      - AWS_REGION=${AWS_REGION:-us-east-1}
      - AWS_PROFILE=${AWS_PROFILE:-default}
      - TF_PLUGIN_CACHE_DIR=/home/ciuser/.terraform.d/plugin-cache
      - TF_IN_AUTOMATION=1
      - CI=true
    working_dir: /workspace/infra/aws
    networks:
      - mcp-network
    command: ["/bin/bash"]
    stdin_open: true
    tty: true
    profiles:
      - ci

  # Optional PostgreSQL for future use
  postgres:
    image: postgres:15-alpine
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-mcp}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-mcp_password}
      - POSTGRES_DB=${POSTGRES_DB:-mcp_db}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    networks:
      - mcp-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-mcp}"]
      interval: 10s
      timeout: 5s
      retries: 5
    profiles:
      - database

  # Optional Redis for caching
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    networks:
      - mcp-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    profiles:
      - cache

  # Corporate Proxy Services
  # Crush Corporate Proxy
  crush-proxy:
    build:
      context: .
      dockerfile: automation/corporate-proxy/crush/docker/Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    ports:
      - "8051:8051"  # Crush proxy port
    volumes:
      - ./:/workspace:rw
      - /tmp:/tmp
    environment:
      - USE_MOCK_API=${USE_MOCK_API:-true}
      - API_MODE=crush
      - PORT=8051
    networks:
      - mcp-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8051/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - proxy
      - crush-proxy

  # OpenCode Corporate Proxy
  opencode-proxy:
    build:
      context: .
      dockerfile: automation/corporate-proxy/opencode/docker/Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    ports:
      - "8052:8052"  # OpenCode proxy port
    volumes:
      - ./:/workspace:rw
      - /tmp:/tmp
    environment:
      - USE_MOCK_API=${USE_MOCK_API:-true}
      - API_MODE=opencode
      - PORT=8052
    networks:
      - mcp-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8052/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - proxy
      - opencode-proxy

  # Gemini Corporate Proxy
  gemini-proxy:
    build:
      context: .
      dockerfile: automation/corporate-proxy/gemini/docker/Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    ports:
      - "8053:8053"  # Gemini proxy port
      - "8050:8050"  # Unified API port for Gemini
    volumes:
      - ./:/workspace:rw
      - /tmp:/tmp
    environment:
      - USE_MOCK_API=${USE_MOCK_API:-true}
      - GEMINI_PROXY_PORT=8053
      - GEMINI_MAX_OUTPUT_SIZE=${GEMINI_MAX_OUTPUT_SIZE:-102400}
      - GEMINI_ALLOW_INSECURE_TLS=${GEMINI_ALLOW_INSECURE_TLS:-false}
      - API_MODE=gemini
    networks:
      - mcp-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8053/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - proxy
      - gemini-proxy

  # ─────────────────────────────────────────────────────────────
  # AgentCore Memory MCP Server
  # ─────────────────────────────────────────────────────────────
  # Multi-provider memory for AI agents
  # Supports: AWS AgentCore (managed) or ChromaDB (self-hosted)

  mcp-agentcore-memory:
    build:
      context: .
      dockerfile: docker/mcp-agentcore-memory.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    # Note: ChromaDB dependency is optional - only needed when MEMORY_PROVIDER=chromadb
    # Start chromadb first with: docker compose --profile memory-chromadb up -d chromadb
    ports:
      - "8023:8023"
    volumes:
      - .:/app:ro
      # Mount AWS credentials for AgentCore provider
      - ${HOME}/.aws:/home/appuser/.aws:ro
    environment:
      - HOME=/home/appuser
      - PYTHONUNBUFFERED=1
      - PYTHONDONTWRITEBYTECODE=1
      - PORT=8023
      # Provider selection: agentcore | chromadb
      - MEMORY_PROVIDER=${MEMORY_PROVIDER:-chromadb}
      # AWS AgentCore settings
      - AWS_REGION=${AWS_REGION:-us-east-1}
      - AWS_PROFILE=${AWS_PROFILE:-}
      - AGENTCORE_MEMORY_ID
      - AGENTCORE_DATA_PLANE_ENDPOINT=${AGENTCORE_DATA_PLANE_ENDPOINT:-}
      # ChromaDB settings (for self-hosted)
      - CHROMADB_HOST=chromadb
      - CHROMADB_PORT=8000
      - CHROMADB_COLLECTION=${CHROMADB_COLLECTION:-agent_memory}
    networks:
      - mcp-network
    command: ["mcp-agentcore-memory", "--mode", "standalone", "--port", "8023"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8023/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - services
      - memory

  # Reaction Search MCP Server (Rust)
  # High-performance semantic search for anime reaction images
  # Rust implementation with fastembed (ONNX-based embeddings)
  mcp-reaction-search:
    build:
      context: ./tools/mcp
      dockerfile: mcp_reaction_search/Dockerfile
    ports:
      - "8024:8024"
    volumes:
      - reaction-search-cache:/home/mcp/.cache
    environment:
      - RUST_LOG=info
    networks:
      - mcp-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8024/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    profiles:
      - services

  # Sprite Sheet MCP Server (Rust)
  mcp-sprite-sheet:
    build:
      context: .
      dockerfile: docker/mcp-sprite-sheet.Dockerfile
      args:
        USER_ID: ${USER_ID:-1000}
        GROUP_ID: ${GROUP_ID:-1000}
    ports:
      - "8027:8027"
    volumes:
      - ./outputs/mcp-sprites:/output
      - /home:/home:ro  # Read-only mount for image imports
    environment:
      - RUST_LOG=info
    networks:
      - mcp-network
    command: ["mcp-sprite-sheet", "--mode", "standalone", "--port", "8027", "--output", "/output"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8027/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    profiles:
      - services

  # Desktop Control MCP Server
  # Cross-platform desktop automation (Linux only in container)
  # IMPORTANT: Requires X11 display access - see docs/README.md
  # NOTE: Uses network_mode: host for X11 access, so 'ports' is not needed
  # Pre-create output dir with correct permissions: mkdir -p outputs/desktop-control
  mcp-desktop-control:
    build:
      context: .
      dockerfile: docker/mcp-desktop-control.Dockerfile
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./:/app:ro
      - ./outputs/desktop-control:/output  # Screenshot output directory
      - /tmp/.X11-unix:/tmp/.X11-unix:ro  # X11 socket
      - ${XAUTHORITY:-~/.Xauthority}:/home/appuser/.Xauthority:ro  # X11 auth
    environment:
      - PYTHONUNBUFFERED=1
      - PYTHONPATH=/app/tools/mcp/mcp_desktop_control:/app  # Prioritize mounted source over installed package
      - PORT=8026
      - DISPLAY=${DISPLAY:-:0}
      - XAUTHORITY=/home/appuser/.Xauthority
      - DESKTOP_CONTROL_OUTPUT_DIR=/output
      - DESKTOP_CONTROL_HOST_PATH=outputs/desktop-control  # Host-relative path for client access
    network_mode: host  # Required for X11 access (incompatible with networks)
    command: ["mcp-desktop-control", "--mode", "standalone", "--port", "8026"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8026/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    profiles:
      - services
      - desktop

  # ChromaDB - Self-hosted vector database for memory
  # Start with: docker compose --profile memory-chromadb up -d
  chromadb:
    image: chromadb/chroma:0.5.23
    ports:
      - "8000:8000"
    volumes:
      - chromadb_data:/chroma/chroma
    environment:
      - ANONYMIZED_TELEMETRY=false
      - IS_PERSISTENT=TRUE
    networks:
      - mcp-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/v1/heartbeat"]
      interval: 30s
      timeout: 10s
      retries: 3
    profiles:
      - memory
      - memory-chromadb

  # All services combined (for development)
  all-services:
    image: busybox
    command: echo "All MCP services are managed individually"
    depends_on:
      - mcp-code-quality
      - mcp-content-creation
      - mcp-gaea2
      - mcp-ai-toolkit
      - mcp-comfyui
      - mcp-crush
      - mcp-opencode
      - mcp-blender
      - mcp-elevenlabs-speech
      - mcp-agentcore-memory
    profiles:
      - all

  # CI runner (for testing)
  ci-runner:
    extends: python-ci
    command: ["bash", "-c", "pytest tests/ -v --cov=. --cov-report=xml"]
    profiles:
      - ci

networks:
  mcp-network:
    driver: bridge

volumes:
  postgres_data: {}
  chromadb_data: {}
  crush-data: {}
  crush-local-data: {}
  crush-cache: {}
  # Video Editor volumes
  video-editor-cache: {}
  # AI Toolkit volumes
  ai-toolkit-datasets: {}
  ai-toolkit-outputs: {}
  ai-toolkit-configs: {}
  ai-toolkit-logs: {}
  # Sleeper Detection Evaluation volumes
  sleeper-models-cache: {}
  sleeper-eval-db: {}
  # Reaction search cache (fastembed model + config)
  reaction-search-cache: {}
  # Rust CI cargo registry/git cache (persisted across container runs)
  cargo-registry-cache: {}

# Secrets are managed at runtime by GitHub Actions or local setup script
# Never commit actual secret files to the repository!