# Dev environment: `docker compose up` builds the app with hot reload (air) and
# mounts your host repositories in (AGENT.md §1.6). Because the app operates on
# repos that live on the host, the roots are mounted read-write.

services:
  app:
    build:
      context: .
      target: dev
    env_file: .env
    environment:
      # Bind all interfaces INSIDE the container so the published port reaches
      # it; the `ports` mapping below still keeps it localhost-only on the HOST.
      - LISTEN_ADDR=0.0.0.0:8080
      # HTTPS for the MCP connector (Claude Desktop only accepts https URLs).
      # Certs are generated on the host with mkcert (see README/.env.example)
      # and mounted read-only below.
      - HTTPS_ADDR=0.0.0.0:8443
      - TLS_CERT_FILE=/app/certs/localhost.pem
      - TLS_KEY_FILE=/app/certs/localhost-key.pem
      # The single projects root inside the container (each subdirectory is a
      # project). The host folder is REPOS_HOST_PATH in .env, mounted here.
      - PROJECTS_ROOT=/repos
      # Config store (forges + tokens, git identity) on the PRIVATE volume below —
      # not bind-mounted into the project, no network port (§1.3).
      - GITMANAGER_DB=/data/gitmanager.db
    ports:
      - "127.0.0.1:8080:8080"
      - "127.0.0.1:8443:8443"
    volumes:
      # Source, for hot reload.
      - .:/app
      # Cache the Go module + build cache across restarts.
      - gomod:/go/pkg/mod
      # Config store — a PRIVATE named volume, deliberately NOT bind-mounted to
      # the host project and NOT exposed on any port, so the credentials it holds
      # are only reachable by the app inside the container (§1.3).
      - gmdata:/data
      # Your repositories. Set REPOS_HOST_PATH in .env (or your shell) to the
      # host folder that holds them; defaults to ./repos next to this file.
      - "${REPOS_HOST_PATH:-./repos}:/repos"
      # --- Optional: let git authenticate to remotes from inside the container.
      # Uncomment ONE approach and adjust for your host (AGENT.md §1.6, §11):
      #   SSH agent socket (Linux/macOS):
      # - "${SSH_AUTH_SOCK}:/ssh-agent"
      #   or mounted keys (read-only):
      # - "${HOME}/.ssh:/root/.ssh:ro"
    # environment for the SSH-agent option:
    # environment:
    #   - SSH_AUTH_SOCK=/ssh-agent

volumes:
  gomod:
  gmdata: