docker-compose.yml

# =============================================================================
# Aegis — Docker Compose (Rebuilt on OpenClaw Core)
# =============================================================================
# 4 services: openclaw-gateway, data-api, postgres, cloudflared
# Zero host port bindings — all access via Cloudflare Tunnel.
#
# Usage:
#   docker compose up -d
#   docker compose logs -f
#   docker compose down
# =============================================================================

services:
  # ---------------------------------------------------------------------------
  # PostgreSQL 16 + pgvector — primary data store
  # ---------------------------------------------------------------------------
  postgres:
    image: pgvector/pgvector:pg16
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-aegis}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      POSTGRES_DB: ${POSTGRES_DB:-aegis}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./infrastructure/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      - data
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-aegis}"]
      interval: 10s
      timeout: 5s
      start_period: 30s
      retries: 5

  # ---------------------------------------------------------------------------
  # Data API — encrypted data persistence (FastAPI)
  # ---------------------------------------------------------------------------
  data-api:
    build:
      context: .
      dockerfile: infrastructure/Dockerfile.data-api
    restart: unless-stopped
    environment:
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-aegis}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-aegis}
      DATA_API_TOKEN: ${DATA_API_TOKEN:?DATA_API_TOKEN is required}
      ENCRYPTION_MASTER_KEY: ${ENCRYPTION_MASTER_KEY:?ENCRYPTION_MASTER_KEY is required}
      PLAID_CLIENT_ID: ${PLAID_CLIENT_ID:-}
      PLAID_SECRET: ${PLAID_SECRET:-}
      PLAID_ENV: ${PLAID_ENV:-sandbox}
      SCHWAB_APP_KEY: ${SCHWAB_APP_KEY:-}
      SCHWAB_APP_SECRET: ${SCHWAB_APP_SECRET:-}
      SCHWAB_CALLBACK_URL: ${SCHWAB_CALLBACK_URL:-}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      AZURE_CLIENT_ID: ${AZURE_CLIENT_ID:-}
      AZURE_CLIENT_SECRET: ${AZURE_CLIENT_SECRET:-}
      AZURE_TENANT_ID: ${AZURE_TENANT_ID:-}
      CANVAS_API_URL: ${CANVAS_API_URL:-https://canvas.drexel.edu/api/v1}
      LINKEDIN_ACCESS_TOKEN: ${LINKEDIN_ACCESS_TOKEN:-}
      X_API_KEY: ${X_API_KEY:-}
      X_API_SECRET: ${X_API_SECRET:-}
      X_BEARER_TOKEN: ${X_BEARER_TOKEN:-}
      X_ACCESS_TOKEN: ${X_ACCESS_TOKEN:-}
      X_ACCESS_TOKEN_SECRET: ${X_ACCESS_TOKEN_SECRET:-}
      GARMIN_EMAIL: ${GARMIN_EMAIL:-}
      GARMIN_PASSWORD: ${GARMIN_PASSWORD:-}
      DAILY_PROTEIN_TARGET_G: ${DAILY_PROTEIN_TARGET_G:-175}
      DAILY_CALORIE_LIMIT: ${DAILY_CALORIE_LIMIT:-1900}
      BLACKBOARD_URL: ${BLACKBOARD_URL:-}
      BLACKBOARD_USERNAME: ${BLACKBOARD_USERNAME:-}
      BLACKBOARD_PASSWORD: ${BLACKBOARD_PASSWORD:-}
      LLM_DAILY_BUDGET_USD: ${LLM_DAILY_BUDGET_USD:-5.00}
      LLM_MONTHLY_BUDGET_USD: ${LLM_MONTHLY_BUDGET_USD:-50.00}
      ENVIRONMENT: ${ENVIRONMENT:-development}
    networks:
      - backend
      - data
    depends_on:
      postgres:
        condition: service_healthy
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://127.0.0.1:8000/health"]
      interval: 15s
      timeout: 10s
      start_period: 30s
      retries: 3

  # ---------------------------------------------------------------------------
  # OpenClaw Gateway — THE CORE (agents, channels, cron, UI, hooks)
  # ---------------------------------------------------------------------------
  openclaw-gateway:
    build:
      context: ./openclaw
      dockerfile: Dockerfile
    restart: unless-stopped
    environment:
      HOME: /home/node
      TERM: xterm-256color
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:?OPENCLAW_GATEWAY_TOKEN is required}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:?ANTHROPIC_API_KEY is required}
      DATA_API_TOKEN: ${DATA_API_TOKEN:?DATA_API_TOKEN is required}
      LLM_DAILY_BUDGET_USD: ${LLM_DAILY_BUDGET_USD:-5.00}
      LLM_MONTHLY_BUDGET_USD: ${LLM_MONTHLY_BUDGET_USD:-50.00}
      BRAVE_API_KEY: ${BRAVE_API_KEY:-}
    volumes:
      - openclaw_data:/home/node/.openclaw
      - ./config/openclaw.json:/home/node/.openclaw/openclaw.seed.json:ro
      - ./config:/home/node/.openclaw/config:ro
      - ./skills:/home/node/.openclaw/skills:ro
      - ./hooks:/home/node/.openclaw/hooks:ro
    networks:
      - frontend
      - backend
    entrypoint:
      [
        "sh", "-c",
        "cp -f /home/node/.openclaw/openclaw.seed.json /home/node/.openclaw/openclaw.json && chown node:node /home/node/.openclaw/openclaw.json 2>/dev/null; chown node:node /home/node/.openclaw 2>/dev/null; exec node dist/index.js gateway --bind lan --port 18789 --allow-unconfigured",
      ]
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - FOWNER
      - SETUID
      - SETGID
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "node -e 'require(\"http\").get(\"http://localhost:18789/health\",(r)=>{process.exit(r.statusCode===200?0:1)}).on(\"error\",()=>process.exit(1))'"]
      interval: 30s
      timeout: 10s
      start_period: 30s
      retries: 3

  # ---------------------------------------------------------------------------
  # Cloudflare Tunnel — zero-trust external access
  # ---------------------------------------------------------------------------
  cloudflared:
    image: cloudflare/cloudflared:2025.2.1
    restart: unless-stopped
    command: tunnel run
    environment:
      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN:-}
    networks:
      - frontend
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    depends_on:
      openclaw-gateway:
        condition: service_healthy

# =============================================================================
# Networks — isolated by function
# =============================================================================
networks:
  frontend:
    driver: bridge
    ipam:
      config:
        - subnet: 172.30.0.0/24

  backend:
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.30.1.0/24

  data:
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.30.2.0/24

# =============================================================================
# Volumes — persistent data
# =============================================================================
volumes:
  postgres_data:
  openclaw_data: