# PI WEB + Pi Coding Agent behind Traefik + Authelia (external)
# Deploy: /home/frank/pi.schwenk.online  →  https://pi.schwenk.online
#
# PUID/PGID must match the host user that owns WORKSPACE_HOST_PATH (boka: frank=1002).

services:
  sessiond:
    build:
      context: .
      args:
        PUID: ${PUID:-1002}
        PGID: ${PGID:-1002}
    image: pidevremote-pi:local
    container_name: pi-sessiond
    restart: unless-stopped
    user: "${PUID:-1002}:${PGID:-1002}"
    command: ["pi-web-sessiond"]
    env_file:
      - .env
    environment:
      HOME: /home/pi
      PI_WEB_CONFIG: /etc/pi-web/config.json
      PI_WEB_DATA_DIR: /data/pi-web
      PI_WEB_SESSIOND_SOCKET: /data/pi-web/sessiond.sock
      PI_CODING_AGENT_DIR: /home/pi/.pi/agent
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      CURSOR_API_KEY: ${CURSOR_API_KEY:-}
    volumes:
      - ./data/pi-web:/data/pi-web
      - ./data/pi-agent:/home/pi/.pi/agent
      - ${WORKSPACE_HOST_PATH:-./workspaces}:/workspaces
    networks:
      - internal

  web:
    build:
      context: .
      args:
        PUID: ${PUID:-1002}
        PGID: ${PGID:-1002}
    image: pidevremote-pi:local
    container_name: pi-web
    restart: unless-stopped
    user: "${PUID:-1002}:${PGID:-1002}"
    command: ["pi-web-server"]
    depends_on:
      - sessiond
    env_file:
      - .env
    environment:
      HOME: /home/pi
      PI_WEB_CONFIG: /etc/pi-web/config.json
      PI_WEB_DATA_DIR: /data/pi-web
      PI_WEB_SESSIOND_SOCKET: /data/pi-web/sessiond.sock
      PI_WEB_HOST: "0.0.0.0"
      PI_WEB_PORT: "8504"
      PI_WEB_ALLOWED_HOSTS: pi.schwenk.online
      PI_CODING_AGENT_DIR: /home/pi/.pi/agent
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      CURSOR_API_KEY: ${CURSOR_API_KEY:-}
    volumes:
      - ./data/pi-web:/data/pi-web
      - ./data/pi-agent:/home/pi/.pi/agent
      - ${WORKSPACE_HOST_PATH:-./workspaces}:/workspaces
    expose:
      - "8504"
    networks:
      - internal
      - traefik
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.routers.pi.rule=Host(`pi.schwenk.online`)
      - traefik.http.routers.pi.entrypoints=websecure
      - traefik.http.routers.pi.tls.certresolver=myresolver
      - traefik.http.routers.pi.middlewares=authelia@docker
      - traefik.http.services.pi.loadbalancer.server.port=8504

networks:
  internal:
    driver: bridge
  traefik:
    external: true