docker-compose.yml

version: '3.8'

services:
  # OpenClaw Gateway - proxied for users; loopback-exposed for local node pairing
  openclaw:
    image: ghcr.io/openclaw/openclaw:latest
    container_name: openclaw-gateway
    restart: unless-stopped
    networks:
      - openclaw-internal
    environment:
      # OpenClaw configuration
      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
      - OPENCLAW_TRUSTED_PROXIES=${OPENCLAW_TRUSTED_PROXIES:-172.20.0.0/16}
      - OPENCLAW_TAILSCALE_AUTH_ENABLED=false
      # AI provider API keys
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
    volumes:
      - ./openclaw-config:/tmp/openclaw-seed:ro
      - openclaw-home:/home/node/.openclaw
      - openclaw-workspace:/tmp/shared-workspace
      - /c/Users/Ritam Kumarb Kundu:/host-home
    user: root
    entrypoint: ["/bin/sh", "-c", "mkdir -p /home/node/.openclaw /tmp/shared-workspace && chown -R 1000:1000 /home/node/.openclaw /tmp/shared-workspace && su -s /bin/sh node -c 'cp /tmp/openclaw-seed/openclaw.json /home/node/.openclaw/openclaw.json && cp /tmp/openclaw-seed/workspace/*.md /tmp/shared-workspace/ 2>/dev/null; exec node /app/openclaw.mjs gateway --port 18789'"]
    ports:
      - "127.0.0.1:${OPENCLAW_HOST_PORT:-18789}:18789"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:18789/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # AuthSec OpenClaw Proxy - exposed for client connections
  proxy:
    build:
      context: ../..
      dockerfile: Dockerfile.proxy
    # Alternative: use a published image
    # image: ghcr.io/authsec-ai/authsec-openclaw-proxy:latest
    container_name: authsec-openclaw-proxy
    restart: unless-stopped
    networks:
      - openclaw-internal
      - public
    ports:
      - "${PROXY_HTTP_PORT:-8080}:8080"
    environment:
      # Proxy configuration
      - PROXY_PUBLIC_BASE_URL=${PROXY_PUBLIC_BASE_URL}
      - PROXY_LISTEN_ADDR=:8080
      
      # OpenClaw connection
      - OPENCLAW_UPSTREAM_URL=${OPENCLAW_UPSTREAM_URL:-http://openclaw:18789}
      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
      
      # Session security
      - SESSION_HMAC_SECRET=${SESSION_HMAC_SECRET}
      - SESSION_SECURE_COOKIE=${SESSION_SECURE_COOKIE:-false}
      
      # AuthSec configuration
      - AUTHSEC_MODE=${AUTHSEC_MODE:-sdk}
      - AUTHSEC_ISSUER_URL=${AUTHSEC_ISSUER_URL}
      - AUTHSEC_CLIENT_ID=${AUTHSEC_CLIENT_ID}
      - AUTHSEC_CLIENT_SECRET=${AUTHSEC_CLIENT_SECRET}
      - AUTHSEC_AUDIENCE=${AUTHSEC_AUDIENCE:-}
      - AUTHSEC_ADMIN_EMAIL=${AUTHSEC_ADMIN_EMAIL:-}
      - AUTHSEC_JWT_SECRET=${AUTHSEC_JWT_SECRET:-}
      - AUTHSEC_BASE_URL=${AUTHSEC_BASE_URL:-}
      - AUTHSEC_LOGIN_URL=${AUTHSEC_LOGIN_URL:-}
      
      # Multi-tenant configuration (optional)
      - TENANT_ROUTING_MODE=${TENANT_ROUTING_MODE:-host}
      - TENANT_CONFIG_JSON=${TENANT_CONFIG_JSON:-}
      
      # Logging
      - LOG_LEVEL=${LOG_LEVEL:-info}
    volumes:
      - openclaw-workspace:/tmp/shared-workspace
    depends_on:
      openclaw:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8080/healthz"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # Caddy - optional TLS termination for production/secure context
  # Enable by uncommenting this service
  caddy:
    image: caddy:2-alpine
    container_name: authsec-caddy
    restart: unless-stopped
    networks:
      - public
    ports:
      - "${CADDY_HTTP_PORT:-80}:80"
      - "${CADDY_HTTPS_PORT:-443}:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    environment:
      - PROXY_HOST=${PROXY_HOST:-proxy:8080}
      - PUBLIC_DOMAIN=${PUBLIC_DOMAIN:-localhost}
    depends_on:
      - proxy
    profiles:
      - tls  # Only start when explicitly enabled: docker compose --profile tls up
    healthcheck:
      test: ["CMD", "caddy", "version"]
      interval: 30s
      timeout: 10s
      retries: 3

networks:
  # Internal network - only accessible between services
  openclaw-internal:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16
  
  # Public network - exposed to host
  public:
    driver: bridge

volumes:
  openclaw-workspace:
    driver: local
  openclaw-home:
    driver: local
  caddy-data:
    driver: local
  caddy-config:
    driver: local