docker-compose.yml

networks:
  ingress:
    driver: bridge
  internal:
    driver: bridge
    internal: true

services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    env_file:
      - .env
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:2019/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - ingress
    depends_on:
      - openclaw

  openclaw:
    image: ghcr.io/openclaw/openclaw:latest
    entrypoint: ["sh", "/entrypoint.sh"]
    user: "1000:1000"
    read_only: true
    tmpfs:
      - /tmp
    volumes:
      - openclaw_data:/home/node/.openclaw
      - ./entrypoint.sh:/entrypoint.sh:ro
      - ./scripts/guardrail.py:/home/node/guardrail.py:ro
    env_file:
      - .env
    environment:
      - NODE_OPTIONS=${NODE_OPTIONS:---max-old-space-size=1536}
      - PATH=/home/node/.openclaw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    mem_limit: ${NODE_MEM_LIMIT:-2g}
    cpus: 1.5
    pids_limit: 256
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:18789/', r => process.exit(r.statusCode < 500 ? 0 : 1)).on('error', () => process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    networks:
      - ingress
      - internal
    depends_on:
      - redis

  redis:
    image: redis:7-alpine
    command:
      - redis-server
      - --requirepass
      - ${REDIS_PASSWORD}
      - --bind
      - "0.0.0.0"
      - --protected-mode
      - "yes"
      - --save
      - "60"
      - "1"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    volumes:
      - redis_data:/data
    networks:
      - internal
    mem_limit: 256m
    cpus: 0.5
    pids_limit: 32

  calendar-proxy:
    build: ./services/calendar-proxy
    profiles: [calendar]
    restart: unless-stopped
    networks:
      - ingress
      - internal
    depends_on:
      - redis
    volumes:
      - openclaw_data:/data:rw
    env_file:
      - .env
    environment:
      - GCAL_ALLOWED_CALENDARS=${GCAL_ALLOWED_CALENDARS:-primary}
      - GCAL_MAX_EVENTS_PER_DAY=${GCAL_MAX_EVENTS_PER_DAY:-10}
      - GCAL_MAX_UPDATES_PER_DAY=${GCAL_MAX_UPDATES_PER_DAY:-50}
      - GCAL_MAX_EVENT_HOURS=${GCAL_MAX_EVENT_HOURS:-8}
      - GCAL_MAX_PAST_HOURS=${GCAL_MAX_PAST_HOURS:-1}
      - GCAL_ALLOWED_START_HOUR=${GCAL_ALLOWED_START_HOUR:-8}
      - GCAL_ALLOWED_END_HOUR=${GCAL_ALLOWED_END_HOUR:-20}
      - GCAL_USER_TIMEZONE=${GCAL_USER_TIMEZONE:-UTC}
      - GCAL_WORK_CALENDAR_ID=${GCAL_WORK_CALENDAR_ID:-}
      - GCAL_MAX_RECURRENCE_COUNT=${GCAL_MAX_RECURRENCE_COUNT:-52}
      - GCAL_AUDIT_MAX_MB=${GCAL_AUDIT_MAX_MB:-50}
      - GCAL_DRY_RUN=${GCAL_DRY_RUN:-false}
      - GCAL_HEALTH_CHECK_GOOGLE=${GCAL_HEALTH_CHECK_GOOGLE:-false}
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - TELEGRAM_TOKEN=${TELEGRAM_TOKEN}
      - ALERT_TELEGRAM_CHAT_ID=${ALERT_TELEGRAM_CHAT_ID:-}
      - GCAL_REMINDER_LEAD_TIME_MINUTES=${GCAL_REMINDER_LEAD_TIME_MINUTES:-15}
      - GCAL_REMINDER_POLL_INTERVAL_SECONDS=${GCAL_REMINDER_POLL_INTERVAL_SECONDS:-60}
      - GCAL_DISABLE_REMINDERS=${GCAL_DISABLE_REMINDERS:-false}
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8080/health')"]
      interval: 30s
      timeout: 5s
      retries: 3
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    mem_limit: 256m
    cpus: "0.5"

  mail-proxy:
    build: ./services/mail-proxy
    profiles: [mail]
    restart: unless-stopped
    networks:
      - ingress
      - internal
    depends_on:
      - redis
    volumes:
      - openclaw_data:/data:rw
    env_file:
      - .env
    environment:
      - GMAIL_POLL_INTERVAL_SECONDS=${GMAIL_POLL_INTERVAL_SECONDS:-180}
      - GMAIL_IMPORTANCE_THRESHOLD=${GMAIL_IMPORTANCE_THRESHOLD:-7}
      - GMAIL_MAX_SENDS_PER_DAY=${GMAIL_MAX_SENDS_PER_DAY:-20}
      - GMAIL_POLL_LABEL=${GMAIL_POLL_LABEL:-INBOX}
      - GMAIL_SCORER_MODEL=${GMAIL_SCORER_MODEL:-gpt-4o-mini}
      - GMAIL_AUDIT_LOG_PATH=${GMAIL_AUDIT_LOG_PATH:-/data/gmail-audit.log}
      - GMAIL_AUDIT_MAX_MB=${GMAIL_AUDIT_MAX_MB:-50}
      - GMAIL_HEALTH_CHECK_GOOGLE=${GMAIL_HEALTH_CHECK_GOOGLE:-false}
      - ALERT_TELEGRAM_CHAT_ID=${ALERT_TELEGRAM_CHAT_ID:-}
      - TELEGRAM_TOKEN=${TELEGRAM_TOKEN}
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    mem_limit: 256m
    cpus: "0.5"
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8091/health')"]
      interval: 30s
      timeout: 5s
      retries: 3

  voice-proxy:
    build: ./services/voice-proxy
    restart: unless-stopped
    networks:
      - ingress
      - internal
    depends_on:
      - openclaw
      - redis
    environment:
      - TELEGRAM_TOKEN=${TELEGRAM_TOKEN}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - OPENCLAW_UPSTREAM=http://openclaw:8787
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - VOICE_MAX_FILE_SIZE_MB=${VOICE_MAX_FILE_SIZE_MB:-5}
      - VOICE_RATE_LIMIT_PER_MIN=${VOICE_RATE_LIMIT_PER_MIN:-10}
      - WEBHOOK_SECRET=${WEBHOOK_SECRET:-}
      - TELEGRAM_ALLOWED_USER_IDS=${TELEGRAM_ALLOWED_USER_IDS:-}
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    mem_limit: 256m
    cpus: "0.5"
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8090/_health')"]
      interval: 30s
      timeout: 5s
      retries: 3

volumes:
  openclaw_data:
  redis_data:
  caddy_data:
  caddy_config: