docker-compose.yml

services:
  bulwark:
    build: .
    container_name: bulwark
    ports:
      - "3001:3001"
    environment:
      - MONITOR_PORT=3001
      - MONITOR_USER=${MONITOR_USER:?set MONITOR_USER}
      - MONITOR_PASS=${MONITOR_PASS:?set MONITOR_PASS}
      - DATABASE_URL=postgresql://bulwark:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/bulwark
      - NODE_ENV=production
      - DOCKER_HOST=unix:///var/run/docker.sock
      # AI — Ollama (default local LLM)
      - OLLAMA_BASE_URL=http://ollama:11434
      - OLLAMA_MODEL=${OLLAMA_MODEL:-qwen3:8b}
      # AI keys (BYOK — set in .env or pass at runtime)
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
    depends_on:
      postgres:
        condition: service_healthy
      ollama:
        condition: service_healthy
    volumes:
      - bulwark-data:/app/data
      - /var/run/docker.sock:/var/run/docker.sock
      - ~/.claude/.credentials.json:/home/bulwark/.claude/.credentials.json:ro
      # Mount your app's supabase dir for the migration tool (uncomment and adjust path)
      # - /path/to/your-app/supabase:/admin/supabase:ro
    group_add:
      - "${DOCKER_GID:-0}"  # Docker socket GID (run: stat -c '%g' /var/run/docker.sock)
    restart: unless-stopped
    networks:
      - bulwark-net
      # To manage external databases, add their Docker networks here:
      # - my-app-net
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  ollama:
    image: ollama/ollama:latest
    container_name: bulwark-ollama
    ports:
      - "11434:11434"
    volumes:
      - ollama-models:/root/.ollama
    environment:
      - OLLAMA_HOST=0.0.0.0:11434
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:11434/api/tags"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    restart: unless-stopped
    networks:
      - bulwark-net

  postgres:
    image: postgres:17-alpine
    container_name: bulwark-db
    environment:
      - POSTGRES_USER=bulwark
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
      - POSTGRES_DB=bulwark
    volumes:
      - pg-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U bulwark"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped
    networks:
      - bulwark-net

networks:
  bulwark-net:
    driver: bridge
  # Add external networks for cross-stack DB access:
  # my-app-net:
  #   external: true

volumes:
  bulwark-data:
  pg-data:
  ollama-models: