# asset-engine — control plane over PFI's inference fleet.
#
# FastAPI + HTMX/Shoelace UI. Reads the catalog at services.yaml (baked
# into the image at build time, drift-checked in CI against the copy
# at docs/asset-engine/services.yaml in this repo), routes requests to
# inference hosts (irv-ml1 over WG by default), persists Assets to a
# local SQLite WAL DB, stores generated blobs content-addressed under
# runtime/outputs/.
#
# Image is built on the host from the asset-engine git repo by the
# deploy playbook (`playbooks/deploy-asset-engine.yaml`), which clones
# into /opt/docker/build/asset-engine and runs `docker build -t
# asset-engine:local .` before installing this compose and bringing
# it up. No registry.
#
# Internal tooling — accessed directly on host:port over the LAN, does
# NOT traverse Traefik. State persists under /opt/docker/conf/asset-engine/
# {db,outputs,ssh} on the host — db/outputs are separate bind-mounts so
# outputs/ can move to a bigger volume later without touching DB state;
# ssh/ holds the dedicated keypair used to orchestrate irv-ml1 services.
#
# All tunables live in .env — edit that, not this file.

services:
  asset-engine:
    image: ${ASSET_ENGINE_IMAGE}
    container_name: asset-engine
    restart: unless-stopped
    ports:
      - "${ASSET_ENGINE_BIND:-0.0.0.0}:${ASSET_ENGINE_PORT}:8000"
    environment:
      # App always listens on 8000 internally; host port is the only knob.
      - RUNTIME_DIR=/app/runtime
      - DB_URL=sqlite:////app/runtime/db/asset_engine.db
      - INFERENCE_HOST=${INFERENCE_HOST:-10.100.79.3}
      # OIDC seam is empty in v1; populated in v2 when forward-auth lands.
      - OIDC_ISSUER=${OIDC_ISSUER:-}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
      # Orchestration SSH paths inside the container.
      - SSH_KEY_PATH=/app/runtime/ssh/id_ed25519
      - SSH_KNOWN_HOSTS=/app/runtime/ssh/known_hosts
    volumes:
      - ${ASSET_ENGINE_DB_DIR}:/app/runtime/db
      - ${ASSET_ENGINE_OUTPUTS_DIR}:/app/runtime/outputs
      # Dedicated SSH key for orchestrating irv-ml1 services (up/down).
      # Read-only; key is generated on the host, never crosses the network.
      - ${ASSET_ENGINE_SSH_DIR}:/app/runtime/ssh:ro
    healthcheck:
      test: ["CMD-SHELL", "python -c 'import urllib.request,sys; r=urllib.request.urlopen(\"http://127.0.0.1:8000/health\",timeout=3); sys.exit(0 if r.status==200 else 1)' || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - homepage.group=AI - Gateways & Chat
      - homepage.name=Asset Engine
      - homepage.icon=mdi-tools
      - homepage.description=Control plane over the PFI inference fleet
      - homepage.href=http://10.250.50.70:${ASSET_ENGINE_PORT}