docker-compose.example.yml

# PerkOS MiniApp — production compose for app.perkos.xyz on perkos-cloud-02.
# Caddy lives in perkos-knowledge-proxy and reverse_proxy's by container name
# over the shared docker network.

services:
  miniapp:
    build:
      context: .
      dockerfile: deploy/Dockerfile
      args:
        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL}
        NEXT_PUBLIC_PERKOS_CHAT_URL: ${NEXT_PUBLIC_PERKOS_CHAT_URL}
        NEXT_PUBLIC_FIREBASE_API_KEY: ${NEXT_PUBLIC_FIREBASE_API_KEY}
        NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: ${NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN}
        NEXT_PUBLIC_FIREBASE_PROJECT_ID: ${NEXT_PUBLIC_FIREBASE_PROJECT_ID}
        NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: ${NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET}
        NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: ${NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID}
        NEXT_PUBLIC_FIREBASE_APP_ID: ${NEXT_PUBLIC_FIREBASE_APP_ID}
        NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID: ${NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID}
        NEXT_PUBLIC_RECEIPT_ANCHOR_ADDRESS: ${NEXT_PUBLIC_RECEIPT_ANCHOR_ADDRESS:-}
        NEXT_PUBLIC_RECEIPT_ANCHOR_CHAIN_ID: ${NEXT_PUBLIC_RECEIPT_ANCHOR_CHAIN_ID:-}
        NEXT_PUBLIC_ALCHEMY_API_KEY: ${NEXT_PUBLIC_ALCHEMY_API_KEY:-}
        NEXT_PUBLIC_DYNAMIC_ENVIRONMENT_ID: ${NEXT_PUBLIC_DYNAMIC_ENVIRONMENT_ID:-}
    container_name: perkos-miniapp
    restart: unless-stopped
    networks:
      - perkos-knowledge_default
    environment:
      # Server-only secrets (Firebase Admin + LLM keys) read at runtime
      FIREBASE_PROJECT_ID: ${FIREBASE_PROJECT_ID}
      FIREBASE_CLIENT_EMAIL: ${FIREBASE_CLIENT_EMAIL}
      FIREBASE_PRIVATE_KEY: ${FIREBASE_PRIVATE_KEY}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      OPENAI_MODEL: ${OPENAI_MODEL:-gpt-4o-mini}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      ANTHROPIC_MODEL: ${ANTHROPIC_MODEL:-claude-sonnet-4-5}
      # Server-only allowlist (comma-separated 0x… wallets). Bootstraps
      # the gate alongside Firestore /allowlist + config/access.publicMode.
      PERKOS_WHITELIST: ${PERKOS_WHITELIST:-}
      # AWS — used by /api/agents/launch when wizard picks PerkOS infra
      # (ECS Fargate provisioning + Secrets Manager).
      AWS_REGION: ${AWS_REGION:-us-east-1}
      AWS_ACCESS_KEY: ${AWS_ACCESS_KEY:-}
      AWS_SECRET: ${AWS_SECRET:-}
      # PerkOS LLM gateway — admin token used by /api/agents/launch to
      # mint per-agent Bearer keys at provisioning time. Must match
      # ADMIN_TOKEN on the gateway VPS (/opt/Perkos-llm/.env).
      PERKOS_LLM_GATEWAY_URL: ${PERKOS_LLM_GATEWAY_URL:-https://api.llm.perkos.xyz}
      PERKOS_LLM_ADMIN_TOKEN: ${PERKOS_LLM_ADMIN_TOKEN:-}
      # Prometheus metrics — /api/metrics responds when this token is
      # set. The scraper (Grafana Agent / Alloy) presents it as a
      # Bearer header. Without it the route returns 503.
      PERKOS_METRICS_TOKEN: ${PERKOS_METRICS_TOKEN:-}
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]
      interval: 30s
      timeout: 5s
      retries: 3

  # Provisioning worker — separate process that pulls
  # /provision_jobs entries from Firestore, runs the LLM gateway
  # register + ECS provision flow, and writes status + log entries
  # back. Uses the same image as the miniapp service but with a
  # different command. No public port — talks outbound only.
# [retired 2026-05-31: provisioning+curator moved to PerkOS-API]   miniapp-worker:
#     image: perkos-miniapp-miniapp
#     container_name: perkos-miniapp-worker
#     restart: unless-stopped
#     networks:
#       - perkos-knowledge_default
#     depends_on:
#       - miniapp
#     # NOTE: the provisioner worker was retired (it runs in PerkOS-API now).
#     # This retired service is kept commented for reference; the curator is
#     # the only worker the image still ships.
#     command: ["tsx", "/app/app/worker/curator.ts"]
#     environment:
#       FIREBASE_PROJECT_ID: ${FIREBASE_PROJECT_ID}
#       FIREBASE_CLIENT_EMAIL: ${FIREBASE_CLIENT_EMAIL}
#       FIREBASE_PRIVATE_KEY: ${FIREBASE_PRIVATE_KEY}
#       AWS_REGION: ${AWS_REGION:-us-east-1}
#       AWS_ACCESS_KEY: ${AWS_ACCESS_KEY:-}
#       AWS_SECRET: ${AWS_SECRET:-}
#       PERKOS_LLM_GATEWAY_URL: ${PERKOS_LLM_GATEWAY_URL:-https://api.llm.perkos.xyz}
#       PERKOS_LLM_ADMIN_TOKEN: ${PERKOS_LLM_ADMIN_TOKEN:-}
#       # Each worker advertises an id in its log lines + as the
#       # `claimedBy` field on jobs it holds. Defaults to the container
#       # hostname when unset.
#       WORKER_INSTANCE_ID: ${WORKER_INSTANCE_ID:-}
#       # Prometheus metrics endpoint. Bound to 0.0.0.0 inside the
#       # compose network — the host never publishes the port, only the
#       # Grafana Agent / Alloy container reaches it by service name.
#       # Leave PERKOS_METRICS_PORT unset to disable the endpoint.
#       PERKOS_METRICS_PORT: ${PROVISIONER_METRICS_PORT:-9101}
#       PERKOS_METRICS_TOKEN: ${PERKOS_METRICS_TOKEN:-}

#   # Curator worker — periodic loop that auto-hibernates idle ECS
#   # agents. Same image as the miniapp; separate command so it ticks
#   # on its own schedule (default every 15 min). Starts in dry-run mode
#   # — flip PERKOS_CURATOR_DRY_RUN=false ONLY after a few days of
#   # dry-run logs confirm the signal is what you expect.
# [retired 2026-05-31: provisioning+curator moved to PerkOS-API]   miniapp-curator:
#     image: perkos-miniapp-miniapp
#     container_name: perkos-miniapp-curator
#     restart: unless-stopped
#     networks:
#       - perkos-knowledge_default
#     depends_on:
#       - miniapp
#     command: ["tsx", "/app/app/worker/curator.ts"]
#     environment:
#       FIREBASE_PROJECT_ID: ${FIREBASE_PROJECT_ID}
#       FIREBASE_CLIENT_EMAIL: ${FIREBASE_CLIENT_EMAIL}
#       FIREBASE_PRIVATE_KEY: ${FIREBASE_PRIVATE_KEY}
#       AWS_REGION: ${AWS_REGION:-us-east-1}
#       AWS_ACCESS_KEY: ${AWS_ACCESS_KEY:-}
#       AWS_SECRET: ${AWS_SECRET:-}
#       PERKOS_ENV: ${PERKOS_ENV:-prod}
#       # Curator-specific knobs (see app/worker/curator.ts header).
#       PERKOS_CURATOR_ENABLED: ${PERKOS_CURATOR_ENABLED:-true}
#       PERKOS_CURATOR_DRY_RUN: ${PERKOS_CURATOR_DRY_RUN:-true}
#       PERKOS_CURATOR_INTERVAL_MIN: ${PERKOS_CURATOR_INTERVAL_MIN:-15}
#       PERKOS_CURATOR_IDLE_MINUTES: ${PERKOS_CURATOR_IDLE_MINUTES:-60}
#       PERKOS_CURATOR_MAX_PER_TICK: ${PERKOS_CURATOR_MAX_PER_TICK:-10}
#       PERKOS_CURATOR_SKIP_NAMES: ${PERKOS_CURATOR_SKIP_NAMES:-perkos-assistant}
#       PERKOS_CURATOR_MIN_AGE_MINUTES: ${PERKOS_CURATOR_MIN_AGE_MINUTES:-15}
#       WORKER_INSTANCE_ID: ${CURATOR_INSTANCE_ID:-}
#       # Curator's metrics endpoint — same auth pattern as the
#       # provisioner. Different port so both can run on the same
#       # internal network.
#       PERKOS_METRICS_PORT: ${CURATOR_METRICS_PORT:-9102}
#       PERKOS_METRICS_TOKEN: ${PERKOS_METRICS_TOKEN:-}

networks:
  perkos-knowledge_default:
    external: true