services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: memind_orchestrator
      POSTGRES_USER: memind_orchestrator
      POSTGRES_PASSWORD: ${ORCHESTRATOR_POSTGRES_PASSWORD:?set ORCHESTRATOR_POSTGRES_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U memind_orchestrator -d memind_orchestrator"]
      interval: 5s
      timeout: 3s
      retries: 20
    volumes:
      - orchestrator_postgres_data:/var/lib/postgresql/data
    networks:
      - orchestrator_internal

  orchestrator:
    image: memind/workflow-orchestrator:local
    build:
      context: ../../services/orchestrator
      dockerfile: Dockerfile
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      MEMIND_ORCHESTRATOR_HOST: 0.0.0.0
      MEMIND_ORCHESTRATOR_PORT: 8093
      MEMIND_ORCHESTRATOR_CHECKPOINT_MODE: postgres
      MEMIND_ORCHESTRATOR_DATABASE_URL: postgresql://memind_orchestrator:${ORCHESTRATOR_POSTGRES_PASSWORD}@postgres:5432/memind_orchestrator
      MEMIND_ORCHESTRATOR_DATABASE_SCHEMA: memind_orchestrator
      MEMIND_ORCHESTRATOR_SERVICE_TOKEN: ${MEMIND_ORCHESTRATOR_SERVICE_TOKEN:?set MEMIND_ORCHESTRATOR_SERVICE_TOKEN}
      MEMIND_ORCHESTRATOR_WORKER_TOKEN: ${MEMIND_ORCHESTRATOR_WORKER_TOKEN:-local-worker-disabled}
      MEMIND_ORCHESTRATOR_EXECUTION_ENABLED: ${MEMIND_ORCHESTRATOR_EXECUTION_ENABLED:-0}
      MEMIND_ORCHESTRATOR_ENABLED_EXECUTORS: ${MEMIND_ORCHESTRATOR_ENABLED_EXECUTORS:-}
      MEMIND_ORCHESTRATOR_TENANT_ALLOWLIST: ${MEMIND_ORCHESTRATOR_TENANT_ALLOWLIST:-}
      MEMIND_ORCHESTRATOR_USER_ALLOWLIST: ${MEMIND_ORCHESTRATOR_USER_ALLOWLIST:-}
      MEMIND_ORCHESTRATOR_WORKSPACE_KIND_ALLOWLIST: ${MEMIND_ORCHESTRATOR_WORKSPACE_KIND_ALLOWLIST:-workspace-alias}
      MEMIND_ORCHESTRATOR_MAX_GLOBAL_ACTIVE: ${MEMIND_ORCHESTRATOR_MAX_GLOBAL_ACTIVE:-20}
      MEMIND_ORCHESTRATOR_MAX_TENANT_ACTIVE: ${MEMIND_ORCHESTRATOR_MAX_TENANT_ACTIVE:-5}
      MEMIND_ORCHESTRATOR_MAX_USER_ACTIVE: ${MEMIND_ORCHESTRATOR_MAX_USER_ACTIVE:-2}
      MEMIND_ORCHESTRATOR_MAX_TENANT_PER_MINUTE: ${MEMIND_ORCHESTRATOR_MAX_TENANT_PER_MINUTE:-30}
      MEMIND_ORCHESTRATOR_MAX_USER_PER_MINUTE: ${MEMIND_ORCHESTRATOR_MAX_USER_PER_MINUTE:-10}
    ports:
      - "127.0.0.1:${MEMIND_ORCHESTRATOR_PORT:-8093}:8093"
    networks:
      - orchestrator_internal
      - orchestrator_edge

  worker-goosed:
    profiles: ["goosed-worker"]
    image: memind/workflow-orchestrator:local
    restart: unless-stopped
    command: ["node", "worker.mjs"]
    # Image HEALTHCHECK probes orchestrator :8093; worker has no HTTP listener.
    healthcheck:
      disable: true
    depends_on:
      orchestrator:
        condition: service_started
    environment:
      MEMIND_ORCHESTRATOR_URL: http://orchestrator:8093
      MEMIND_ORCHESTRATOR_SERVICE_TOKEN: ${MEMIND_ORCHESTRATOR_SERVICE_TOKEN:?set MEMIND_ORCHESTRATOR_SERVICE_TOKEN}
      MEMIND_ORCHESTRATOR_WORKER_TOKEN: ${MEMIND_ORCHESTRATOR_WORKER_TOKEN:-local-worker-disabled}
      MEMIND_EXECUTOR_WORKER_ID: ${MEMIND_EXECUTOR_GOOSED_WORKER_ID:-colima-goosed-1}
      MEMIND_EXECUTOR_GOOSED_URL: ${MEMIND_EXECUTOR_GOOSED_URL:-https://host.docker.internal:18006}
      MEMIND_EXECUTOR_GOOSED_TOKEN: ${MEMIND_EXECUTOR_GOOSED_TOKEN:-}
      MEMIND_EXECUTOR_GOOSED_PROVIDER: ${MEMIND_EXECUTOR_GOOSED_PROVIDER:-}
      MEMIND_EXECUTOR_GOOSED_MODEL: ${MEMIND_EXECUTOR_GOOSED_MODEL:-}
      MEMIND_EXECUTOR_ALLOW_REMOTE_GOOSED: "1"
      MEMIND_EXECUTOR_GOOSED_TLS_INSECURE: ${MEMIND_EXECUTOR_GOOSED_TLS_INSECURE:-1}
      MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON: ${MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON:-{}}
      MEMIND_EXECUTOR_POLL_MS: ${MEMIND_EXECUTOR_POLL_MS:-1000}
      MEMIND_EXECUTOR_HEARTBEAT_MS: ${MEMIND_EXECUTOR_HEARTBEAT_MS:-10000}
      MEMIND_EXECUTOR_LEASE_MS: ${MEMIND_EXECUTOR_LEASE_MS:-30000}
    read_only: true
    tmpfs:
      - /tmp:size=64m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    networks:
      - orchestrator_edge

networks:
  orchestrator_internal:
    internal: true
  orchestrator_edge:

volumes:
  orchestrator_postgres_data: