services:
  agentci:
    build:
      context: .
      args:
        CODEX_VERSION: ${CODEX_VERSION:-0.144.6}
        CODEGRAPH_VERSION: ${CODEGRAPH_VERSION:-1.3.1}
        TEA_VERSION: ${TEA_VERSION:-0.14.2}
    restart: unless-stopped
    # Codex applies its own bwrap sandbox inside this otherwise unprivileged container.
    cap_add:
      - SYS_ADMIN
      - SYS_CHROOT
      - SETUID
      - SETGID
      - SYS_PTRACE
      - NET_ADMIN
      - NET_RAW
    security_opt:
      - seccomp=unconfined
      - apparmor=unconfined
    environment:
      AGENTCI_GITEA_URL: ${AGENTCI_GITEA_URL:-http://gitea:3000}
      AGENTCI_BOT_USERNAME: ${AGENTCI_BOT_USERNAME:-agentci}
      AGENTCI_BOT_NAME: ${AGENTCI_BOT_NAME:-Agent CI}
      AGENTCI_BOT_EMAIL: ${AGENTCI_BOT_EMAIL:-agentci@localhost}
      AGENTCI_PLAN_MODEL: ${AGENTCI_PLAN_MODEL:-gpt-5.6-sol}
      AGENTCI_PLAN_REASONING: ${AGENTCI_PLAN_REASONING:-medium}
      AGENTCI_IMPLEMENT_MODEL: ${AGENTCI_IMPLEMENT_MODEL:-gpt-5.6-sol}
      AGENTCI_IMPLEMENT_REASONING: ${AGENTCI_IMPLEMENT_REASONING:-high}
      AGENTCI_RESEARCH_MODEL: ${AGENTCI_RESEARCH_MODEL:-gpt-5.6-luna}
      AGENTCI_RESEARCH_REASONING: ${AGENTCI_RESEARCH_REASONING:-high}
      AGENTCI_CONTEXT7_API_KEY: ${AGENTCI_CONTEXT7_API_KEY:-}
      AGENTCI_PLAN_REVIEW_ROUNDS: ${AGENTCI_PLAN_REVIEW_ROUNDS:-4}
      AGENTCI_IMPLEMENT_REVIEW_ROUNDS: ${AGENTCI_IMPLEMENT_REVIEW_ROUNDS:-3}
      AGENTCI_TURN_TIMEOUT_SECONDS: ${AGENTCI_TURN_TIMEOUT_SECONDS:-3600}
      AGENTCI_INSTALL_SCRIPT_TIMEOUT_SECONDS: ${AGENTCI_INSTALL_SCRIPT_TIMEOUT_SECONDS:-900}
      AGENTCI_INSTALL_SCRIPTS: ${AGENTCI_INSTALL_SCRIPTS:-}
      AGENTCI_PYTHON_VERSION: ${AGENTCI_PYTHON_VERSION:-3.13}
      AGENTCI_DOTNET_CHANNEL: ${AGENTCI_DOTNET_CHANNEL:-10.0}
    secrets:
      - gitea_token
      - webhook_secret
    volumes:
      - agentci_data:/var/lib/agentci
      - codex_home:/var/lib/codex
      - ./install-scripts:/etc/agentci/install-scripts:ro
    expose:
      - "8080"
    networks:
      - gitea

secrets:
  gitea_token:
    file: ./secrets/gitea_token
  webhook_secret:
    file: ./secrets/webhook_secret

volumes:
  agentci_data:
  codex_home:

networks:
  gitea:
    external: true
    name: ${GITEA_NETWORK:-gitea}