services:
  manager:
    build: .
    restart: unless-stopped
    ports:
      - "127.0.0.1:3000:3000"
    environment:
      PORT: 3000
      DOCKER_SOCKET_PATH: /var/run/docker.sock
      MCP_NETWORK_NAME: mcp-net
      DATA_DIR: /repo/data
      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD}
      SESSION_SECRET: ${SESSION_SECRET}
      MASTER_KEY: ${MASTER_KEY}
      CONTAINER_MEMORY_MB: ${CONTAINER_MEMORY_MB:-512}
      CONTAINER_CPUS: ${CONTAINER_CPUS:-1}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data:/repo/data
      # Reuses the host's own SSH key/known_hosts so the manager can `git clone` private
      # repos over ssh:// the same way the host itself already does. Read-only.
      # SSH_DIR must be an absolute path (compose doesn't expand "~").
      - ${SSH_DIR}:/root/.ssh:ro
    networks:
      - mcp-net

networks:
  mcp-net:
    name: mcp-net