compose.yml

# Local/dev compose for the same proxy/app path as prod (:10100 /healthz).
# Production (digest + Tailscale bind) stays in deploy/container/compose.example.yml
# and is started by deploy/container/opencodex-proxy.service — do not point this
# file at the live place lock.
#
#   cp .env.example .env
#   mkdir -p deploy/container/.secrets .tmp/opencodex-state
#   umask 077 && python3 -c 'import secrets; print(secrets.token_hex(16))' > deploy/container/.secrets/api-token
#   docker compose up -d --build
#   bash scripts/healthz-smoke.sh
services:
  opencodex:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VCS_REF: ${OPENCODEX_GIT_SHA:-dev}
        VERSION: ${OPENCODEX_VERSION:-1.5.1}
    restart: unless-stopped
    read_only: true
    environment:
      OPENCODEX_HOME: /var/lib/opencodex
      OPENCODEX_BIND_HOST: 0.0.0.0
      OPENCODEX_HEALTH_HOST: 127.0.0.1
      OPENCODEX_HEALTH_PORT: "10100"
      OPENCODEX_API_AUTH_TOKEN_FILE: /run/secrets/opencodex_api_token
      OPENCODEX_GIT_SHA: ${OPENCODEX_GIT_SHA:-dev}
      CF_ACCESS_TEAM_DOMAIN: ${CF_ACCESS_TEAM_DOMAIN:-}
      CF_ACCESS_AUD: ${CF_ACCESS_AUD:-}
      CF_ACCESS_ALLOWED_HOSTS: ${CF_ACCESS_ALLOWED_HOSTS:-}
      OIDC_ISSUER: ${OIDC_ISSUER:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
      OIDC_CLIENT_SECRET_FILE: ${OIDC_CLIENT_SECRET_FILE:-}
      OIDC_ALLOWED_HOSTS: ${OIDC_ALLOWED_HOSTS:-}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-http://127.0.0.1:10100/oauth/callback}
    secrets:
      - opencodex_api_token
    volumes:
      - ${OPENCODEX_STATE_DIR:-./.tmp/opencodex-state}:/var/lib/opencodex
    tmpfs:
      - /tmp:rw,nosuid,nodev,noexec,size=256m,uid=1000,gid=1000
    ports:
      - "127.0.0.1:10100:10100"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 512
    stop_grace_period: 30s
    healthcheck:
      test: ["CMD", "bun", "run", "scripts/container-health.ts"]
      interval: 15s
      timeout: 5s
      retries: 4
      start_period: 20s

secrets:
  opencodex_api_token:
    file: ${OPENCODEX_API_TOKEN_FILE:?path to runtime token file}