docker-compose.prod.yml

# Production stack: agent app behind a Caddy reverse proxy with automatic HTTPS.
#
#   docker compose -f docker-compose.prod.yml up -d
#
# Caddy obtains + renews a Let's Encrypt certificate automatically for the
# domain set in DOMAIN (see .env). The agent app is NOT published to the host —
# only Caddy is reachable from the internet (ports 80/443).
services:
  agent:
    build: .
    image: starter-agent:latest
    expose:
      - "8000"            # internal only; reachable by Caddy, not the host
    environment:
      - API_KEY=${API_KEY}                          # require auth (set in .env)
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}          # optional real model
      - OPENAI_BASE_URL=${OPENAI_BASE_URL:-https://api.openai.com/v1}
      - AGENT_MODEL=${AGENT_MODEL:-gpt-4o-mini}
      - RAG_DIR=/data/chroma
    volumes:
      - agent-data:/data
    restart: unless-stopped
    # No host healthcheck curl needed here, but keep it for orchestration:
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8000/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

  caddy:
    image: caddy:2-alpine
    ports:
      - "80:80"
      - "443:443"
    environment:
      - DOMAIN=${DOMAIN}
      - ACME_EMAIL=${ACME_EMAIL}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data       # persisted certificates (survives restarts)
      - caddy-config:/config
    depends_on:
      - agent
    restart: unless-stopped

volumes:
  agent-data:
  caddy-data:
  caddy-config: