docker-compose.yml

services:
  nadirclaw:
    image: ghcr.io/eugenio/awsmodelrunner:latest
    build: .
    container_name: nadirclaw
    restart: unless-stopped
    ports:
      # Bind to localhost ONLY — not exposed to the network
      - "127.0.0.1:4000:4000"
    env_file:
      - config/nadirclaw.env
      - "${USERPROFILE:-${HOME}}/.nadirclaw/mantle.env"
    volumes:
      # Mount AWS credentials (read-only)
      - "${USERPROFILE:-${HOME}}/.aws:/root/.aws:ro"
      # Persist NadirClaw logs and SQLite DB between restarts
      - nadirclaw-data:/root/.nadirclaw/data
      # Mount logs to host for Goose usage extension to read
      - "${USERPROFILE:-${HOME}}/.nadirclaw/logs:/root/.nadirclaw/logs"
      # Mount config so changes take effect without rebuilding
      - ./config/nadirclaw.env:/root/.nadirclaw/.env:ro
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/health', timeout=3)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

volumes:
  nadirclaw-data: