version: "3.8"

services:
  openclaw-gateway:
    image: ${OPENCLAW_IMAGE:-registry.lan/openclaw:latest}
    environment:
      HOME: /home/node
      TERM: xterm-256color
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
      MOONSHOT_API_KEY: ${MOONSHOT_API_KEY}
      OPENCLAW_CONFIG_DIR: /data/config
      GOG_CONFIG_DIR: /data/gog
      GOOGLE_APPLICATION_CREDENTIALS: /data/secrets/google-credentials.json
      GOG_ACCOUNT: ${GOG_ACCOUNT:-}
    volumes:
      - openclaw-config:/home/node/.openclaw
      - openclaw-workspace:/home/node/.openclaw/workspace
      # Mount configs and secrets from host (not baked into image)
      - ./config:/data/config:ro
      - ./secrets:/data/secrets:ro
      # gog OAuth tokens persist here
      - gog-data:/data/gog
    ports:
      - target: 18789
        published: ${OPENCLAW_GATEWAY_PORT:-18789}
        protocol: tcp
        mode: host
      - target: 18790
        published: ${OPENCLAW_BRIDGE_PORT:-18790}
        protocol: tcp
        mode: host
    init: true
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.hostname == tpi-n1
    networks:
      - dokploy-network
    # Add Gitea SSH access (if needed for git operations)
    extra_hosts:
      - "gitea.bendtstudio.com:192.168.2.130"
    command:
      [
        "node",
        "dist/index.js",
        "gateway",
        "--bind",
        "${OPENCLAW_GATEWAY_BIND:-lan}",
        "--port",
        "18789",
      ]

volumes:
  openclaw-config:
  openclaw-workspace:
  gog-data:

networks:
  dokploy-network:
    external: true