# AI VM (10.20.0.12), experiment design 6.1: agent 8080 (/diagnose for the harness), rag-db (pgvector, internal),
# hitl 8081 (Discord gateway bot; /post and /escalate for the agent). Images: selfheal-lab-apps/ai (Cloud Build).
services:
  agent:
    image: asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal-public/ai-agent:${AI_TAG}
    container_name: agent
    restart: always
    env_file: /opt/selfheal/ai.env
    environment:
      RAG_DSN: "postgres://ai:${RAG_DB_PASSWORD}@rag-db:5432/ai?sslmode=disable"
      HITL_URL: http://hitl:8081
      OPENAI_KEY_FILE: /run/secrets/openai-api-key
      ANTHROPIC_KEY_FILE: /run/secrets/anthropic-api-key
      JEV_KEY_FILE: /run/secrets/typesafe-api-key
      K8S_TOKEN_FILE: /run/secrets/k8s-token
      K8S_CA_FILE: /run/secrets/k8s-ca.crt
      PROMPT_DIR: /etc/ai/prompts
      RUNBOOK_DIR: /etc/ai/runbooks
    volumes:
      - /opt/selfheal/ai/secrets:/run/secrets:ro
      - ./prompts:/etc/ai/prompts:ro
      - ./runbooks:/etc/ai/runbooks:ro
    ports:
      - "8080:8080"
    depends_on: [rag-db]
  hitl:
    image: asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal-public/ai-hitl:${AI_TAG}
    container_name: hitl
    restart: always
    env_file: /opt/selfheal/ai.env
    environment:
      RAG_DSN: "postgres://ai:${RAG_DB_PASSWORD}@rag-db:5432/ai?sslmode=disable"
      DISCORD_TOKEN_FILE: /run/secrets/discord-bot-token
    volumes:
      - /opt/selfheal/ai/secrets:/run/secrets:ro
    ports:
      - "127.0.0.1:8081:8081"   # agent reaches hitl on the compose network; host binding only for the local selfcheck
    depends_on: [rag-db]
  rag-db:
    # pgvector 0.8.7 on PostgreSQL 16 (Docker Hub tag checked 2026-10-08); HNSW index up to 2000 dimensions (design 6.4)
    image: pgvector/pgvector:0.8.7-pg16
    container_name: rag-db
    restart: always
    environment:
      POSTGRES_USER: ai
      POSTGRES_PASSWORD: "${RAG_DB_PASSWORD}"
      POSTGRES_DB: ai
    volumes:
      - rag-data:/var/lib/postgresql/data
volumes:
  rag-data: {}