# Azure VM：只跑 heicode 容器；PostgreSQL / Redis 使用 Azure 托管实例。
# 代码更新：在 VM 上对完整 heicode 仓库 git pull，勿用 scp 同步源码（见仓库根 CLAUDE.md）。
# 容器产生的数据（/data 上传与持久文件、/app/logs）绑定到 VM 本地磁盘，避免仅用匿名卷导致难备份或重建丢失。
#
# 1. 在 VM 上准备目录（示例）
#    export HEICODE_DATA_ROOT=/var/lib/heicode/heicode
#    sudo mkdir -p "$HEICODE_DATA_ROOT"/{data,logs}
#    sudo chown -R "$USER":"$USER" "$HEICODE_DATA_ROOT"
#
# 2. 在本目录放置 .env（勿提交仓库），至少包含由运维注入的：
#    SQL_DSN=postgresql://...@heicode.postgres.database.azure.com:5432/heicode?sslmode=require
#    REDIS_CONN_STRING=rediss://:...@heicode.redis.cache.windows.net:6380
#    SESSION_SECRET=...
#    AZURE_KEY_VAULT_URL=https://<vault-name>.vault.azure.net
#    （以及项目要求的其它密钥，见官方 heicode 文档）
#
# 3. 构建 Heicode 定制镜像时与本地 override 一致：
#    docker compose -f docker-compose.azure-vm.yml -f docker-compose.override.yml --env-file .env up -d --build
# 4. 构建完成后删除悬空旧镜像层：sudo docker image prune -f
#
# 若只用上游镜像、无 override，可去掉第二个 -f 文件，并把下方 image 改为 calciumion/heicode:latest。

version: '3.4'

services:
  heicode:
    image: ${IMAGE_TAG:-heicode-manager:local}
    build:
      context: .
      dockerfile: Dockerfile
    container_name: heicode
    restart: always
    command: --log-dir /app/logs
    ports:
      - "3000:3000"
    volumes:
      - ${HEICODE_DATA_ROOT}/data:/data
      - ${HEICODE_DATA_ROOT}/logs:/app/logs
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      - TZ=Asia/Shanghai
      - ERROR_LOG_ENABLED=true
      - BATCH_UPDATE_ENABLED=true
      - NODE_NAME=heicode-node-1
      # 默认与 docs/integration/Heicode-登录接口对接文档.md §2.1 一致；覆盖仅用于非标准网关。
      - HEICODE_AUTH_BASE_URL=${HEICODE_AUTH_BASE_URL:-https://apimtaiji.azure-api.net/api/mcp}
      # Agent 登录后 JIT 同步：邮箱命中以下白名单则自动提权
      - HEICODE_ROOT_EMAILS=${HEICODE_ROOT_EMAILS:-}
      - HEICODE_ADMIN_EMAILS=${HEICODE_ADMIN_EMAILS:-}
      # Long-lived resource credentials are written to Azure Key Vault via
      # the VM managed identity. No static secret-store token is required.
      - AZURE_KEY_VAULT_URL=${AZURE_KEY_VAULT_URL:-}
      - AZURE_CLIENT_ID=${AZURE_CLIENT_ID:-}
      # Agent Manager Runtime: use the current production IP directly.
      # The public domain is not used until DNS/HTTPS is fixed.
      - AGENT_RUNTIME_ENABLED=${AGENT_RUNTIME_ENABLED:-false}
      - AGENT_RUNTIME_BASE_URL=${AGENT_RUNTIME_BASE_URL:-http://20.212.121.126}
      - AGENT_RUNTIME_CREATE_PATH=${AGENT_RUNTIME_CREATE_PATH:-/api/agent/deployments}
      - AGENT_RUNTIME_HEALTH_PATH=${AGENT_RUNTIME_HEALTH_PATH:-/api/agent/health}
      - AGENT_RUNTIME_STOP_PATH=${AGENT_RUNTIME_STOP_PATH:-/api/agent/deployments/{deployment_id}/stop}
      - AGENT_RUNTIME_SERVICE_TOKEN=${AGENT_RUNTIME_SERVICE_TOKEN:-}
      - AGENT_RUNTIME_CALLBACK_SIGNING_SECRET_REF=${AGENT_RUNTIME_CALLBACK_SIGNING_SECRET_REF:-}
      # agent_swarm (product: HeiCode Swarm) Runtime — separate from the single
      # template-agent Runtime (AM). Currently DEFERRED/disabled (SWARM_RUNTIME_ENABLED=false):
      # HM does not orchestrate swarm; pending agent_swarm runtime-contract.md freeze (agent_swarm#2).
      # See docs/integration/heicode-swarm-deferred.md.
      - SWARM_RUNTIME_ENABLED=${SWARM_RUNTIME_ENABLED:-false}
      - SWARM_RUNTIME_BASE_URL=${SWARM_RUNTIME_BASE_URL:-}
      - SWARM_RUNTIME_CREATE_PATH=${SWARM_RUNTIME_CREATE_PATH:-/api/swarms}
      - SWARM_RUNTIME_HEALTH_PATH=${SWARM_RUNTIME_HEALTH_PATH:-/api/agent/health}
      - SWARM_RUNTIME_STOP_PATH=${SWARM_RUNTIME_STOP_PATH:-/api/swarms/{swarm_id}/stop}
      - SWARM_RUNTIME_APPROVAL_DECISION_PATH=${SWARM_RUNTIME_APPROVAL_DECISION_PATH:-/api/swarms/{swarm_id}/approvals/{approval_id}}
      - SWARM_RUNTIME_SERVICE_TOKEN=${SWARM_RUNTIME_SERVICE_TOKEN:-}
    networks:
      - heicode-network
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:3000/api/status | grep -o '\"success\":\\s*true' || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

networks:
  heicode-network:
    driver: bridge