docker-compose.yml

services:
  db:
    image: pgvector/pgvector:pg16
    environment:
      POSTGRES_USER: statewave
      POSTGRES_PASSWORD: statewave
      POSTGRES_DB: statewave
    ports:
      - "${STATEWAVE_DB_HOST_PORT:-5432}:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U statewave"]
      interval: 2s
      timeout: 5s
      retries: 10

  api:
    # Default to the published multi-arch image — `docker compose up -d` works
    # without a local checkout. Pin a version with STATEWAVE_VERSION=1.3.0.
    # Contributors who want to rebuild locally: `docker compose build api`
    # rebuilds from the Dockerfile in this repo and tags the same name.
    image: statewavedev/statewave:${STATEWAVE_VERSION:-latest}
    build: .
    ports:
      - "${STATEWAVE_API_HOST_PORT:-8100}:8100"
    # Load STATEWAVE_LITELLM_*, STATEWAVE_API_KEY, etc. from the host's .env.
    # `.dockerignore` keeps .env OUT of the image — env_file injects values
    # at runtime so the docker-compose `environment:` block below remains
    # the single source of truth for connection-level wiring (DB URL, debug).
    env_file:
      - path: .env
        required: false
    environment:
      # Override anything from .env that would point at host networking —
      # inside the compose network, the database is reachable as `db`.
      STATEWAVE_DATABASE_URL: postgresql+asyncpg://statewave:statewave@db:5432/statewave
      STATEWAVE_DEBUG: "true"
      # Auto-bootstrap the Statewave Support docs pack on first start so
      # the docs-grounded persona in statewave-web answers from real
      # content out of the box. Idempotent — re-runs are no-ops once the
      # subject is populated. Set to "false" to skip.
      STATEWAVE_BOOTSTRAP_DOCS_PACK: "true"
      STATEWAVE_DOCS_PATH: /docs
    volumes:
      # Read-only mount of the sibling statewave-docs checkout. The
      # bootstrap script reads the markdown corpus from here. If the
      # sibling repo isn't checked out, this resolves to an empty dir
      # and start.sh's bootstrap step silently skips.
      - ../statewave-docs:/docs:ro
    depends_on:
      db:
        condition: service_healthy

  admin:
    # Statewave admin console — operator UI for browsing subjects, episodes,
    # memories, starter packs. `docker compose up -d` brings it up alongside
    # the API; reach it at http://localhost:8080.
    #
    # Optional: a contributor who doesn't want the admin running locally can
    # start just the core stack with `docker compose up -d api db`.
    image: statewavedev/statewave-admin:${STATEWAVE_ADMIN_VERSION:-latest}
    ports:
      - "${STATEWAVE_ADMIN_HOST_PORT:-8080}:8080"
    environment:
      # Talks to the api over the compose network — both containers see each
      # other by service name. The browser hits the admin's own server, which
      # proxies API calls server-side, so this URL never leaves the compose
      # network.
      STATEWAVE_API_URL: http://api:8100
      # Reads STATEWAVE_API_KEY from your environment / .env, falling back to
      # a local dev placeholder so a fresh `docker compose up -d` works with
      # no setup (the api runs STATEWAVE_DEBUG=true and accepts any
      # X-API-Key value). Set STATEWAVE_API_KEY to a real key in production.
      STATEWAVE_API_KEY: ${STATEWAVE_API_KEY:-dev-local-placeholder}
      NODE_ENV: production
      # Operator-console auth. The admin requires either a configured password
      # OR an explicit auth-disabled flag. We default to disabled here for the
      # same reason the api defaults to STATEWAVE_DEBUG=true: a fresh
      # `docker compose up -d` should work without you having to invent a
      # password first.
      #
      # Production: override by setting ADMIN_AUTH_DISABLED= (empty) AND
      # supplying ADMIN_PASSWORD + ADMIN_SESSION_SECRET via your env or .env
      # file. The two operator-console-side variables flow through unchanged
      # — there is no fallback if both are absent and ADMIN_AUTH_DISABLED is
      # also empty, which is what surfaces the "Admin is not configured"
      # screen.
      ADMIN_AUTH_DISABLED: ${ADMIN_AUTH_DISABLED:-true}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
      ADMIN_SESSION_SECRET: ${ADMIN_SESSION_SECRET:-}
    depends_on:
      api:
        condition: service_started

volumes:
  pgdata: