# ThothII — deploy embedded nel portale omics_portal (PRODUZIONE).
# core + frontend sulla rete esterna del portale (omics_portal_omics_network,
# creata da Compose col prefisso project). Alias thothii-core/thothii-frontend
# per il DNS usato dagli upstream nginx del portale.
# NESSUNA porta host esposta: il backend è invisibile dall'esterno.
#
# Prereq: devono esistere entrambe le reti esterne: il portale crea
# omics_portal_omics_network e lo stack vLLM crea localllm_default.
# Avvia il portale con:
#   cd /home/chirone/omics_portal && docker compose up -d
# Poi: docker compose up -d --build
name: thothii

services:
  core:
    build:
      context: .
      dockerfile: docker/core.Dockerfile
    image: thothii-core:local
    env_file:
      - path: deploy/thothii.env
        required: false
    environment:
      HOST: 0.0.0.0
      PORT: "8787"
      THT_HARNESS_DIR: /app/harness
      THT_BIN: /opt/venv/bin/tht
      SETTINGS_FILE: /data/settings/settings.json
      THT_CONFIG: /app/harness/workspaces/local.yaml   # configPath di default per i route tht senza workspace esplicito
      THT_MODEL_API_KEY_FILE: /data/secrets/model_api_key   # provider key per buildPiChildEnv (codex)
      THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
      THT_WORKSPACE_GIT_BRANCH: ${THT_WORKSPACE_GIT_BRANCH:-main}
      THT_WORKSPACE_INSTALLATION_ID: ${THT_WORKSPACE_INSTALLATION_ID:-server}
      THT_WORKSPACE_GIT_AUTHOR_NAME: ${THT_WORKSPACE_GIT_AUTHOR_NAME:-Thoth Workspace Registry}
      THT_WORKSPACE_GIT_AUTHOR_EMAIL: ${THT_WORKSPACE_GIT_AUTHOR_EMAIL:-thoth-workspace-registry@localhost}
      THT_WORKSPACE_SECRET_ROOTS: /run/secrets
      GIT_CONFIG_COUNT: "2"
      GIT_CONFIG_KEY_0: credential.helper
      GIT_CONFIG_VALUE_0: store --file=/run/secrets/workspace-registry-git-credentials
      GIT_CONFIG_KEY_1: http.sslCAInfo
      GIT_CONFIG_VALUE_1: /run/secrets/workspace-registry-git-ca
      GIT_SSH_COMMAND: ssh -i /run/secrets/workspace-registry-git-ssh-key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/run/secrets/workspace-registry-git-known-hosts
      AUTH_MODE: ${AUTH_MODE:-none}
      MAX_PI_PROCESSES: ${MAX_PI_PROCESSES:-4}
    extra_hosts:
      - "host.docker.internal:host-gateway"   # Supabase :5438 + Ollama :11434 sull'host
    volumes:
      - /home/chirone/thothii-data:/data
      - workspace-registry:/data/workspace-registry
      - /home/chirone/thothii-data/pi-config:/home/thoth/.pi
      - ${PI_AUTH_FILE:?set PI_AUTH_FILE}:/home/thoth/.pi/agent/auth.json:ro
      - /home/chirone/chirone/etl/docs/evidence:/data/evidence:ro
      - ${THT_WORKSPACE_GIT_CREDENTIALS_FILE:-/dev/null}:/run/secrets/workspace-registry-git-credentials:ro
      - ${THT_WORKSPACE_GIT_CA_FILE:-/etc/ssl/certs/ca-certificates.crt}:/run/secrets/workspace-registry-git-ca:ro
      - ${THT_WORKSPACE_GIT_SSH_KEY_FILE:-/dev/null}:/run/secrets/workspace-registry-git-ssh-key:ro
      - ${THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE:-/dev/null}:/run/secrets/workspace-registry-git-known-hosts:ro
    restart: unless-stopped
    networks:
      omics_portal_omics_network:
        aliases: ["thothii-core"]
      localllm_default: {}

  frontend:
    build:
      context: .
      dockerfile: docker/frontend.Dockerfile
      args:
        VITE_BASE: /datamart-builder/assets/
        VITE_BACKEND_URL: /datamart-builder/api
    image: thothii-frontend:local
    restart: unless-stopped
    networks:
      omics_portal_omics_network:
        aliases: ["thothii-frontend"]

networks:
  omics_portal_omics_network:
    external: true
  localllm_default:
    external: true

volumes:
  workspace-registry: