services:
  worker-aider:
    profiles: ["aider-worker"]
    image: ${MEMIND_AIDER_WORKER_IMAGE:?set a dedicated image containing Node and Aider}
    command: ["node", "/app/worker.mjs"]
    restart: unless-stopped
    environment:
      MEMIND_ORCHESTRATOR_URL: http://orchestrator:8093
      MEMIND_ORCHESTRATOR_SERVICE_TOKEN: ${MEMIND_ORCHESTRATOR_SERVICE_TOKEN:?set service token}
      MEMIND_ORCHESTRATOR_WORKER_TOKEN: ${MEMIND_ORCHESTRATOR_WORKER_TOKEN:?set worker token}
      MEMIND_EXECUTOR_WORKER_ID: aider-1
      MEMIND_EXECUTOR_AIDER_COMMAND: /usr/local/bin/aider
      MEMIND_EXECUTOR_WORKSPACE_ROOT: /workspaces
      MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON: ${MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON:?use container paths below /workspaces}
    volumes:
      - ${MEMIND_EXECUTOR_HOST_WORKSPACE_ROOT:?set isolated host workspace root}:/workspaces:rw
    read_only: true
    tmpfs:
      - /tmp:size=256m
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 256
    mem_limit: 4g
    cpus: 2
    networks: [orchestrator_edge]

  worker-openhands:
    profiles: ["openhands-worker"]
    image: ${MEMIND_OPENHANDS_WORKER_IMAGE:?set a dedicated image containing Node and OpenHands}
    command: ["node", "/app/worker.mjs"]
    restart: unless-stopped
    environment:
      MEMIND_ORCHESTRATOR_URL: http://orchestrator:8093
      MEMIND_ORCHESTRATOR_SERVICE_TOKEN: ${MEMIND_ORCHESTRATOR_SERVICE_TOKEN:?set service token}
      MEMIND_ORCHESTRATOR_WORKER_TOKEN: ${MEMIND_ORCHESTRATOR_WORKER_TOKEN:?set worker token}
      MEMIND_EXECUTOR_WORKER_ID: openhands-1
      MEMIND_EXECUTOR_OPENHANDS_COMMAND: /usr/local/bin/openhands
      MEMIND_EXECUTOR_WORKSPACE_ROOT: /workspaces
      MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON: ${MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON:?use container paths below /workspaces}
    volumes:
      - ${MEMIND_EXECUTOR_HOST_WORKSPACE_ROOT:?set isolated host workspace root}:/workspaces:rw
    read_only: true
    tmpfs:
      - /tmp:size=512m
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 512
    mem_limit: 8g
    cpus: 4
    networks: [orchestrator_edge]

networks:
  orchestrator_edge:
    external: true
    name: orchestrator_orchestrator_edge