docker-compose.yml

services:
  nginx:
    image: nginx:alpine
    ports:
      - "${HOST_PORT}:80"
    volumes:
      - ./build/nginx.conf.template:/etc/nginx/templates/default.conf.template
      - ./frontend:/usr/share/nginx/html/frontend
    environment:
      - BASE_DOMAIN=${BASE_DOMAIN:-localhost}
      - BASE_PORT=${BASE_PORT:-80}
      - PROTOCOL=${PROTOCOL:-http}
    depends_on:
      - server
    networks:
      xares-aicoder-network:  # External access and server communication
      xares-internal:          # Workspace access when proxy is enabled
        ipv4_address: 172.30.0.4
    restart: unless-stopped

  server:
    image: ${SERVER_IMAGE:-xares-aicoder-server:local}
    build:
      context: ./server
      dockerfile: Dockerfile
    environment:
      - DOCKER_NETWORK=${DOCKER_NETWORK:-xares-aicoder-network}
      - MAX_WORKSPACES_PER_USER=${MAX_WORKSPACES_PER_USER:-5}
      - MAX_CONCURRENT_WORKSPACES=${MAX_CONCURRENT_WORKSPACES:-3}
      - CPU_PER_WORKSPACE=${CPU_PER_WORKSPACE:-1.0}
      - MEMORY_PER_WORKSPACE_MB=${MEMORY_PER_WORKSPACE_MB:-4096}
      - ENABLE_RESOURCE_LIMITS=${ENABLE_RESOURCE_LIMITS:-true}
      - BASE_DOMAIN=${BASE_DOMAIN:-localhost}
      - BASE_PORT=${BASE_PORT:-80}
      - PROTOCOL=${PROTOCOL:-http}
      - ENABLE_GIT_SERVER=${ENABLE_GIT_SERVER:-false}
      - CODESERVER_IMAGE=${CODESERVER_IMAGE:-xares-aicoder-codeserver:latest}
      - ENABLE_GPU=${ENABLE_GPU:-false}
      - SHOW_DISK_USAGE=${SHOW_DISK_USAGE:-false}
      - ENABLE_PROXY=${ENABLE_PROXY:-false}
      - CONTAINER_PIDS_LIMIT=${CONTAINER_PIDS_LIMIT:-512}
      - CONTAINER_MAX_FDS=${CONTAINER_MAX_FDS:-4096}
      - CONTAINER_MAX_FDS_HARD=${CONTAINER_MAX_FDS_HARD:-8192}
      - CONTAINER_MAX_PROCS=${CONTAINER_MAX_PROCS:-512}
      - CONTAINER_MAX_PROCS_HARD=${CONTAINER_MAX_PROCS_HARD:-1024}
      - WORKSPACE_SUDO_ENABLED=${WORKSPACE_SUDO_ENABLED:-false}
      - PROXY_NETWORK=${PROXY_NETWORK:-xaresaicoder_xares-internal}
      - WORKSHOP_GROUP=${WORKSHOP_GROUP:-}
      - WORKSHOP_ADMIN_PASSWORD=${WORKSHOP_ADMIN_PASSWORD:-}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - workspace_data:/app/workspaces
    networks:
      - xares-aicoder-network
    restart: unless-stopped

  forgejo:
    image: codeberg.org/forgejo/forgejo:9
    container_name: xaresaicoder-forgejo
    profiles: ["git-server"]
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - FORGEJO__database__DB_TYPE=sqlite3
      - FORGEJO__database__PATH=/data/gitea/gitea.db
      - FORGEJO__server__DOMAIN=${BASE_DOMAIN:-localhost}
      - FORGEJO__server__SSH_DOMAIN=${BASE_DOMAIN:-localhost}
      - FORGEJO__server__ROOT_URL=${PROTOCOL:-http}://${BASE_DOMAIN:-localhost}:${BASE_PORT:-80}/git/
      - FORGEJO__server__HTTP_PORT=3000
      - FORGEJO__server__SSH_PORT=2222
      - FORGEJO__server__LFS_START_SERVER=true
      - FORGEJO__server__OFFLINE_MODE=true
      - FORGEJO__actions__ENABLED=true
      - FORGEJO__actions__DEFAULT_ACTIONS_URL=https://code.forgejo.org
      - FORGEJO__security__INSTALL_LOCK=true
      - FORGEJO__security__SECRET_KEY=your-secret-key-change-this-in-production
      - FORGEJO__security__INTERNAL_TOKEN=
      - FORGEJO__service__DISABLE_REGISTRATION=true
      - FORGEJO__service__DEFAULT_ALLOW_CREATE_ORGANIZATION=true
      - FORGEJO__log__LEVEL=info
    volumes:
      - forgejo_data:/data
    ports:
      - "2222:22"  # SSH access for git operations
    networks:
      - xares-aicoder-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 90s

  squid-proxy:
    build:
      context: ./squid
      dockerfile: Dockerfile
    container_name: xaresaicoder-squid-proxy
    profiles: ["proxy"]
    volumes:
      - ./squid/certs:/etc/squid/certs:ro
      - squid_logs:/var/log/squid
    ports:
      - "3128:3128"  # HTTP proxy port (for debugging/monitoring)
    networks:
      xares-aicoder-network:  # Internet access
      xares-internal:          # Workspace-facing network
        ipv4_address: 172.30.0.3
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "timeout", "2", "bash", "-c", "</dev/tcp/localhost/3128"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  mitmproxy-logger:
    image: mitmproxy/mitmproxy:latest
    container_name: xaresaicoder-mitmproxy-logger
    profiles: ["proxy"]
    user: root
    volumes:
      - ./mitmproxy/llm-logger.py:/scripts/llm-logger.py:ro
      - mitmproxy_logs:/var/log/mitmproxy
      - ./squid/certs:/certs
    command: >
      sh -c "mkdir -p /var/log/mitmproxy/llm_conversations /var/log/mitmproxy/domains &&
      chmod -R 777 /var/log/mitmproxy &&
      mitmdump
      --mode regular
      --listen-host 0.0.0.0
      --listen-port 8080
      --set confdir=/certs
      --set ssl_insecure=true
      -s /scripts/llm-logger.py"
    networks:
      xares-internal:
        ipv4_address: 172.30.0.5
      xares-aicoder-network:
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "sh", "-c", "curl -sf http://localhost:8080 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  dnsmasq:
    image: andyshinn/dnsmasq:latest
    container_name: xaresaicoder-dnsmasq
    profiles: ["proxy"]
    cap_add:
      - NET_ADMIN
    command: >
      --no-daemon
      --log-queries
      --server=8.8.8.8
      --server=8.8.4.4
      --server=1.1.1.1
    networks:
      xares-internal:
        ipv4_address: ${DNSMASQ_IP:-172.30.0.2}  # Fixed IP for DNS server
    restart: unless-stopped

networks:
  xares-aicoder-network:
    external: true
  xares-internal:
    driver: bridge
    internal: true  # No internet access - forces traffic through proxy
    ipam:
      config:
        - subnet: ${INTERNAL_NETWORK_SUBNET:-172.30.0.0/16}

volumes:
  workspace_data:
  forgejo_data:
  squid_logs:
  mitmproxy_logs: