docker-compose.yml

services:
  terrence:
    image: ghcr.io/essinghigh-org/terrence:latest
    init: true
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
    build:
      context: .
      args:
        BUILD_VERSION: ${BUILD_VERSION:-0.0.0}
        BUILD_SHA: ${BUILD_SHA:-unknown}
    ports:
      - "3000:3000"
      # System API is bound to loopback by the app (SYSTEM_API_HOST=127.0.0.1
      # default). Publish only on the loopback interface so its administrative
      # surface (diagnostics, support bundles) is never exposed to the LAN.
      - "127.0.0.1:8443:8443"
    volumes:
      - terrence-storage:/app/backend/storage
    environment:
      - PORT=3000
      - SYSTEM_API_PORT=8443
      # The System API binds container loopback by default, which Docker port
      # forwarding cannot reach (issue #283: the container's eth0 address is
      # where forwarded traffic lands). Bind all container interfaces and keep
      # the host-side publish on 127.0.0.1 (see ports above) so the
      # administrative surface stays off the LAN.
      - SYSTEM_API_HOST=0.0.0.0
      - STORAGE_DIR=/app/backend/storage
      # The run sandbox is FAIL-CLOSED by default: TERRENCE_RUN_SANDBOX unset
      # means "sandbox required" (Landlock, Linux >= 5.13). Hosts that cannot
      # provide Landlock must opt out explicitly via the documented override:
      #   docker compose -f docker-compose.yml -f docker-compose.unsandboxed.yml up -d
      # Running IaC without isolation lets provider code execute with the
      # backend service identity.
      - NODE_ENV=production
      - GITHUB_WEBHOOK_SECRET=${GITHUB_WEBHOOK_SECRET:-}
      # Pass through bootstrap secrets when set in the shell (issue #282):
      # the README quick start runs ADMIN_PASSWORD="..." docker compose up,
      # and Compose only forwards listed keys. Empty values are treated as
      # unset by the app's readEnv helper.
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
      - ENCRYPTION_PASSWORD=${ENCRYPTION_PASSWORD:-}
    # Sane resource limits for a self-hosted instance. Terraform plans and
    # applies can be memory-hungry, so size mem_limit for your largest
    # expected configuration and leave headroom for the worker. cpus is a
    # hard cap on the number of host CPUs available to the container
    # (Compose v2 cpu_limit semantics; not a relative share — use cpu_shares
    # for relative weighting). Omit or raise both for large configurations.
    mem_limit: 4g
    cpus: "2.0"
    # Grace above the drain budget: 2s draining write plus 5s HTTP stop plus
    # 6s drain grace before WAL checkpoint (see Operations: drain mode).
    stop_grace_period: 30s
    # No healthcheck override: the image's own Bun-based HEALTHCHECK (Dockerfile)
    # is authoritative. The image ships curl, wget, git, and unzip alongside
    # the runtime for VCS fetches and diagnostics.


volumes:
  terrence-storage: