docker-compose.yml

services:
  # Base image shared by web-server and mcp-server
  # This service builds the base image that other services depend on
  base:
    build:
      context: .
      dockerfile: Dockerfile.base
    image: flyfun-base:latest
    # No profiles restriction - base will be built automatically when needed
    # Base image doesn't run as a service, just builds the image

  web-server:
    build:
      context: .
      dockerfile: web/Dockerfile
    image: flyfun-web-server:latest
    container_name: flyfun-web-server
    ports:
      - "${WEB_PORT:-8000}:8000"
    # Load environment variables from .env file
    # This is more standard, maintainable, and secure than listing all variables explicitly
    # Variables in .env are automatically loaded into the container
    env_file:
      - .env
    # Container-specific overrides (paths must be container paths, not host paths)
    # These hard-coded paths override any host paths from .env
    # Other variables (API keys, etc.) still come from .env via env_file
    environment:
      # Database paths (ToolContextSettings)
      - AIRPORTS_DB=/app/data/airports.db
      - RULES_JSON=/app/data/rules.json
      - GA_NOTIFICATIONS_DB=/app/data/ga_notifications.db
      - GA_PERSONA_DB=/app/data_builtin/ga_persona.db
      # Vector DB for RAG (AviationAgentSettings)
      # Note: "chromadb:8000" uses Docker's internal network (service name + container port)
      - VECTOR_DB_URL=http://chromadb:8000
      # Local path fallback (used if VECTOR_DB_URL is not set)
      - VECTOR_DB_PATH=/app/out/rules_vector_db
      - LOG_DIR=/app/logs
      - CONVERSATION_LOG_DIR=/app/logs/conversations
      # Auth (shared with other flyfun services for SSO)
      - ENVIRONMENT=${ENVIRONMENT:-development}
      - JWT_SECRET=${JWT_SECRET:-}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
      - APPLE_CLIENT_ID=${APPLE_CLIENT_ID:-}
      - APPLE_TEAM_ID=${APPLE_TEAM_ID:-}
      - APPLE_KEY_ID=${APPLE_KEY_ID:-}
      - APPLE_PRIVATE_KEY=${APPLE_PRIVATE_KEY:-}
      - APPLE_APP_IDS=${APPLE_APP_IDS:-}
      - DATABASE_URL=${DATABASE_URL:-}
    volumes:
      # Data files (read-only)
      - ${DATA_DIR:-./data}:/app/data:ro
      # Output files (writable) - includes rules_vector_db
      - ${OUTPUT_DIR:-./out}:/app/out:rw
      # Logs (writable)
      - ${LOG_DIR:-./logs}:/app/logs:rw
      - ${CONVERSATION_LOG_DIR:-./logs/conversations}:/app/logs/conversations:rw
      # Tools directory (for building vector DB and other utilities)
      - ${TOOLS_DIR:-./tools}:/app/tools:ro
      # Security config (optional override)
      - ${SECURITY_CONFIG_PATH:-./web/server/security_config.py}:/app/web/server/security_config.py:ro
    restart: unless-stopped
    networks:
      - flyfun-network
      - shared-services
    depends_on:
      chromadb:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import requests; requests.get('http://localhost:8000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  mcp-server:
    build:
      context: .
      dockerfile: mcp_server/Dockerfile
    image: flyfun-mcp-server:latest
    container_name: flyfun-mcp-server
    ports:
      # Expose port for shared infrastructure Caddy server
      # Host port 8002 maps to container port 8000
      - "${MCP_PORT:-8002}:8000"
    # Load environment variables from .env file
    env_file:
      - .env
    # Container-specific overrides (paths must be container paths, not host paths)
    # These hard-coded paths override any host paths from .env
    environment:
      # Database paths (ToolContextSettings)
      - AIRPORTS_DB=/app/data/airports.db
      - RULES_JSON=/app/data/rules.json
      - GA_NOTIFICATIONS_DB=/app/data/ga_notifications.db
      - GA_PERSONA_DB=/app/data/ga_persona.db
      # Vector DB for RAG (AviationAgentSettings)
      # Note: "chromadb:8000" uses Docker's internal network (service name + container port)
      - VECTOR_DB_URL=${VECTOR_DB_URL:-http://chromadb:8000}
      # Local path fallback (used if VECTOR_DB_URL is not set)
      - VECTOR_DB_PATH=/app/out/rules_vector_db
      # Viz payload store: POST payloads to web server, get back short link keys
      - VIZ_API_URL=http://web-server:8000/api/viz
    volumes:
      # Data files (read-only)
      - ${DATA_DIR:-./data}:/app/data:ro
      # Output files (writable) - includes rules_vector_db (for local mode fallback)
      - ${OUTPUT_DIR:-./out}:/app/out:rw
      # Logs (writable)
      - ${LOGS_DIR:-./logs}:/app/logs:rw
    restart: unless-stopped
    networks:
      - flyfun-network
    depends_on:
      - chromadb
    # MCP servers typically use stdio, so no HTTP healthcheck
    # They're usually managed by the MCP client
    # Note: MCP server binds to 0.0.0.0:8000 internally, exposed on host port 8002 for shared Caddy server

  # Caddy is run on a shared infrastructure server, not in this docker-compose
  # Caddyfiles are located at:
  #   - Main: etc/caddy/Caddyfile
  #   - Services: etc/caddy/sites-enabled/*.caddy
  # These should be included in the shared Caddy server's configuration

  chromadb:
    image: chromadb/chroma:1.3.5
    container_name: flyfun-chromadb
    ports:
      # External port mapping: host:container
      # Host port 8001 maps to container port 8000 (for external access/debugging)
      # Internal services use "chromadb:8000" (service name + container port) - no host port conflict
      - "127.0.0.1:${CHROMADB_PORT:-8001}:8000"
    environment:
      - IS_PERSISTENT=TRUE
      - PERSIST_DIRECTORY=/chroma/chroma
      - ANONYMIZED_TELEMETRY=FALSE
      - CHROMA_SERVER_AUTHN_PROVIDER=chromadb.auth.token_authn.TokenAuthenticationServerProvider
      - CHROMA_SERVER_AUTHN_CREDENTIALS=${CHROMADB_AUTH_TOKEN:?CHROMADB_AUTH_TOKEN must be set}
      - CHROMA_SERVER_AUTHN_TOKEN_TRANSPORT_HEADER=X-Chroma-Token
    volumes:
      # Persistent storage for ChromaDB data
      # Using bind mount to host directory for easy access and backup
      # Data persists across container restarts and rebuilds
      - ${CHROMADB_DATA_DIR:-./out/chromadb_data}:/chroma/chroma
    restart: unless-stopped
    networks:
      - flyfun-network
    healthcheck:
      test: [ "CMD", "/bin/bash", "-c", "cat < /dev/null > /dev/tcp/localhost/8000" ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

networks:
  flyfun-network:
    driver: bridge
  shared-services:
    external: true