# Nexus / Praxis / Hexis — the three sibling services Maven coordinates.
# One container each, built from the sibling repos (siblings of the Maven repo
# on the same mount). HTTP is published to 127.0.0.1 so the host nginx can
# reverse-proxy the *.subdomains; container-to-container (Maven → sibling) goes
# over the shared `ecosystem` network by service name, no host round-trip.
#
#   docker compose -f deploy/ecosystem/docker-compose.yml up -d --build
#
# Maven's own compose joins this same network (add `ecosystem` as an external
# network there) to reach nexus:9740 / praxis:8989 / hexis:9741 directly.
#
# NO RELEASE PINNING (Vikunja #354): each `build:` below points at a sibling
# WORKING TREE, so `up --build` ships whatever is checked out there, including
# uncommitted edits. Before bringing this up, check what you are about to
# deploy:
#
#   for r in nexus praxis hexis; do git -C ../../../$r status --short; \
#     git -C ../../../$r log -1 --oneline; done
#
# The host nginx that fronts these is deploy/ecosystem/nginx.conf — it binds
# the wg and LAN addresses only, with allow/deny. Keep it that way: none of
# these containers has auth of its own.
name: ecosystem

services:
  nexus:
    build: ../../../nexus
    restart: unless-stopped
    ports: ["127.0.0.1:9740:9740"]      # host nginx → nexus.<domain>
    volumes:
      - nexus-data:/data
      - sockets:/run/ecosystem           # nexus.sock, shared with Maven
    networks: [ecosystem]

  praxis:
    build: ../../../praxis
    restart: unless-stopped
    ports: ["127.0.0.1:8989:8989"]      # host nginx → praxis.<domain>
    volumes:
      - praxis-data:/data
    networks: [ecosystem]

  hexis:
    build: ../../../hexis
    restart: unless-stopped
    ports: ["127.0.0.1:9741:9741"]      # host nginx → hexis.<domain>  (MCP moved off hexis.*)
    environment:
      # hexis fronts the workspace MCP; point at wherever it listens on the
      # host/network. Empty ⇒ workspace provider disabled (systemd-only).
      - WORKSPACE_MCP_URL=${WORKSPACE_MCP_URL:-http://192.168.1.104:9930}
    volumes:
      - hexis-data:/data
      - sockets:/run/ecosystem
      # required when WORKSPACE_MCP_URL is set — hexisd fatals without it.
      - ../../../hexis/etc/workspace-allowlist.yaml:/data/workspace-allowlist.yaml:ro
    networks: [ecosystem]

volumes:
  nexus-data:
  praxis-data:
  hexis-data:
  sockets:

networks:
  ecosystem:
    name: ecosystem      # stable name so Maven's compose can reference it as external