docker-compose.yml

services:
  h-cli-core:
    build:
      context: .
      dockerfile: core/Dockerfile
      args:
        - CORE_BASE_IMAGE=${CORE_BASE_IMAGE:-debian:12-slim}
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-core
    hostname: h-cli${ENV_TAG:+-}${ENV_TAG}-core
    volumes:
      - ${SSH_KEYS_DIR:-./ssh-keys}:/tmp/ssh-keys-staging:ro
      - ./skills:/app/skills:ro
      - ./logs/core:/var/log/hcli/core
      - ./logs/memory:/var/log/hcli/memory
      - ./logs/sessions:/var/log/hcli/sessions:ro
      - ./data:/app/data
    environment:
      - MCP_SERVER_PORT=8083
      - MCP_SERVER_HOST=0.0.0.0
      - LOG_DIR=/var/log/hcli
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
      - NETBOX_URL=${NETBOX_URL:-}
      - NETBOX_API_TOKEN=${NETBOX_API_TOKEN:-}
      - GRAFANA_URL=${GRAFANA_URL:-}
      - GRAFANA_API_TOKEN=${GRAFANA_API_TOKEN:-}
      - GRAFANA_INTERNAL_URL=${GRAFANA_INTERNAL_URL:-}
      - GRAFANA_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-}
      - EVE_NG_URL=${EVE_NG_URL:-}
      - EVE_NG_USERNAME=${EVE_NG_USERNAME:-}
      - EVE_NG_PASSWORD=${EVE_NG_PASSWORD:-}
      - LAMBDAAPI=${LAMBDAAPI:-}
      - SUDO_COMMANDS=${SUDO_COMMANDS:-nmap,tcpdump,traceroute,mtr,ping,ss,ip,iptables}
      - QDRANT_HOST=h-cli${ENV_TAG:+-}${ENV_TAG}-qdrant
      - QDRANT_PORT=6333
      - QDRANT_API_KEY=${QDRANT_API_KEY:-}
      - QDRANT_COLLECTION=${QDRANT_COLLECTION:-hcli_memory}
      - QDRANT_COLLECTIONS=${QDRANT_COLLECTIONS:-}
      - TIMESCALE_URL=${TIMESCALE_URL:-}
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
    cap_add:
      - NET_RAW
      - NET_ADMIN
    shm_size: 1g
    healthcheck:
      test: ["CMD-SHELL", "curl -sf --max-time 2 http://localhost:8083/sse >/dev/null 2>&1; rc=$$?; [ $$rc -eq 0 ] || [ $$rc -eq 28 ]"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - h-network-backend
    restart: unless-stopped

  h-cli-timescaledb:
    profiles: ["monitor"]
    image: timescale/timescaledb:2.25.1-pg16
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-timescaledb
    hostname: h-cli${ENV_TAG:+-}${ENV_TAG}-timescaledb
    environment:
      - POSTGRES_USER=hcli
      - POSTGRES_PASSWORD=${TIMESCALE_PASSWORD}
      - POSTGRES_DB=hcli_metrics
    volumes:
      - ./data/timescaledb:/home/postgres/pgdata/data
      - ./monitor/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U hcli -d hcli_metrics"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - h-network-backend
    restart: unless-stopped

  h-cli-grafana-renderer:
    profiles: ["monitor"]
    image: grafana/grafana-image-renderer:v5.6.0
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-grafana-renderer
    hostname: h-cli${ENV_TAG:+-}${ENV_TAG}-grafana-renderer
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo -e \"GET /render/version HTTP/1.0\\r\\n\\r\\n\" > /dev/tcp/localhost/8081'"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - h-network-backend
    restart: unless-stopped

  h-cli-grafana:
    profiles: ["monitor"]
    image: grafana/grafana:11.5.2
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-grafana
    hostname: h-cli${ENV_TAG:+-}${ENV_TAG}-grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GF_SERVER_HTTP_PORT=3000
      - GF_RENDERING_SERVER_URL=http://h-cli${ENV_TAG:+-}${ENV_TAG}-grafana-renderer:8081/render
      - GF_RENDERING_CALLBACK_URL=http://h-cli${ENV_TAG:+-}${ENV_TAG}-grafana:3000/
      - TIMESCALE_PASSWORD=${TIMESCALE_PASSWORD}
    ports:
      - "2405:3000"
    volumes:
      - ./data/grafana:/var/lib/grafana
      - ./monitor/datasource.yml:/etc/grafana/provisioning/datasources/datasource.yml:ro
      - ./monitor/dashboard.yml:/etc/grafana/provisioning/dashboards/dashboard.yml:ro
      - ./monitor/dashboards:/etc/grafana/provisioning/dashboards/files:ro
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:3000/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
    depends_on:
      h-cli-timescaledb:
        condition: service_healthy
    networks:
      - h-network-backend
      - h-network-frontend
    restart: unless-stopped

  h-cli-qdrant:
    profiles: ["vectordb"]
    image: qdrant/qdrant:v1.13.2
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-qdrant
    hostname: h-cli${ENV_TAG:+-}${ENV_TAG}-qdrant
    environment:
      - QDRANT__SERVICE__API_KEY=${QDRANT_API_KEY}
    volumes:
      - ./data/qdrant:/qdrant/storage
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo -e \"GET /healthz HTTP/1.0\\r\\napi-key: $$QDRANT__SERVICE__API_KEY\\r\\n\\r\\n\" > /dev/tcp/localhost/6333'"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - h-network-backend
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-redis
    hostname: redis
    command: sh -c 'printf "requirepass %s\nmaxmemory 2gb\nmaxmemory-policy allkeys-lru\nsave 900 1\nsave 300 10\nappendonly yes\n" "$$REDIS_PASSWORD" > /tmp/redis.conf && redis-server /tmp/redis.conf'
    environment:
      - REDIS_PASSWORD=${REDIS_PASSWORD}
    volumes:
      - ./data/redis:/data
    healthcheck:
      test: ["CMD", "sh", "-c", "redis-cli --no-auth-warning -a \"$REDIS_PASSWORD\" ping"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - h-network-frontend
      - h-network-backend
    restart: unless-stopped

  telegram-bot:
    profiles: ["telegram"]
    build:
      context: .
      dockerfile: interfaces/telegram-bot/Dockerfile
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-telegram
    hostname: telegram-bot
    volumes:
      - ./logs/telegram:/var/log/hcli/telegram
      - ./logs/sessions:/var/log/hcli/sessions
      - ./logs/media:/var/log/hcli/media
      - ./skills:/app/skills:ro
    environment:
      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
      - ALLOWED_CHATS=${ALLOWED_CHATS}
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - MAX_CONCURRENT_TASKS=${MAX_CONCURRENT_TASKS:-3}
      - TASK_TIMEOUT=${TASK_TIMEOUT:-600}
      - ACTIVITY_CMD_MAX_LEN=${ACTIVITY_CMD_MAX_LEN:-150}
      - RESULT_HMAC_KEY=${RESULT_HMAC_KEY}
      - CHAT_NAMES=${CHAT_NAMES:-}
      - GRAFANA_INTERNAL_URL=${GRAFANA_INTERNAL_URL:-}
      - GRAFANA_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-}
      - GRAFANA_URL=${GRAFANA_URL:-}
      - GRAFANA_API_TOKEN=${GRAFANA_API_TOKEN:-}
      - LOG_DIR=/var/log/hcli
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /run
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import redis; redis.from_url('$$REDIS_URL').ping()\""]
      interval: 30s
      timeout: 5s
      retries: 3
    depends_on:
      - redis
    networks:
      - h-network-frontend
    restart: unless-stopped

  web-ui:
    profiles: ["web"]
    build:
      context: .
      dockerfile: interfaces/web/Dockerfile
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-web
    hostname: web-ui
    volumes:
      - ./logs/web:/var/log/hcli/web
      - ./logs/sessions:/var/log/hcli/sessions
      - ./skills:/app/skills:ro
      - ./ssl:/app/ssl:ro
    environment:
      - WEB_USERNAME=${WEB_USERNAME}
      - WEB_PASSWORD=${WEB_PASSWORD}
      - WEB_USERS=${WEB_USERS:-}
      - WEB_PORT=${WEB_PORT:-8443}
      - WEB_SSL=${WEB_SSL:-true}
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - MAX_CONCURRENT_TASKS=${MAX_CONCURRENT_TASKS:-3}
      - TASK_TIMEOUT=${TASK_TIMEOUT:-600}
      - ACTIVITY_CMD_MAX_LEN=${ACTIVITY_CMD_MAX_LEN:-150}
      - RESULT_HMAC_KEY=${RESULT_HMAC_KEY}
      - CHAT_NAMES=${WEB_CHAT_NAMES:-}
      - GRAFANA_INTERNAL_URL=${GRAFANA_INTERNAL_URL:-}
      - GRAFANA_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-}
      - GRAFANA_URL=${GRAFANA_URL:-}
      - GRAFANA_API_TOKEN=${GRAFANA_API_TOKEN:-}
      - LOG_DIR=/var/log/hcli
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
    ports:
      - "${WEB_PORT:-8443}:${WEB_PORT:-8443}"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /run
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import redis; redis.from_url('$$REDIS_URL').ping()\""]
      interval: 30s
      timeout: 5s
      retries: 3
    depends_on:
      - redis
    networks:
      - h-network-frontend
    restart: unless-stopped

  discord-bot:
    profiles: ["discord"]
    build:
      context: .
      dockerfile: interfaces/discord-bot/Dockerfile
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-discord
    hostname: discord-bot
    volumes:
      - ./logs/discord:/var/log/hcli/discord
      - ./logs/sessions:/var/log/hcli/sessions
      - ./skills:/app/skills:ro
    environment:
      - DISCORD_BOT_TOKEN=${DISCORD_BOT_TOKEN}
      - ALLOWED_USERS=${DISCORD_ALLOWED_USERS}
      - ALLOWED_ROLES=${DISCORD_ALLOWED_ROLES:-}
      - DISCORD_GUILD_IDS=${DISCORD_GUILD_IDS:-}
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - MAX_CONCURRENT_TASKS=${MAX_CONCURRENT_TASKS:-3}
      - TASK_TIMEOUT=${TASK_TIMEOUT:-600}
      - ACTIVITY_CMD_MAX_LEN=${ACTIVITY_CMD_MAX_LEN:-150}
      - RESULT_HMAC_KEY=${RESULT_HMAC_KEY}
      - CHAT_NAMES=${DISCORD_CHAT_NAMES:-}
      - GRAFANA_INTERNAL_URL=${GRAFANA_INTERNAL_URL:-}
      - GRAFANA_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-}
      - GRAFANA_URL=${GRAFANA_URL:-}
      - GRAFANA_API_TOKEN=${GRAFANA_API_TOKEN:-}
      - LOG_DIR=/var/log/hcli
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /run
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import redis; redis.from_url('$$REDIS_URL').ping()\""]
      interval: 30s
      timeout: 5s
      retries: 3
    depends_on:
      - redis
    networks:
      - h-network-frontend
    restart: unless-stopped

  slack-bot:
    profiles: ["slack"]
    build:
      context: .
      dockerfile: interfaces/slack-bot/Dockerfile
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-slack
    hostname: slack-bot
    volumes:
      - ./logs/slack:/var/log/hcli/slack
      - ./logs/sessions:/var/log/hcli/sessions
      - ./skills:/app/skills:ro
    environment:
      - SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN}
      - SLACK_APP_TOKEN=${SLACK_APP_TOKEN}
      - ALLOWED_USERS=${SLACK_ALLOWED_USERS}
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - MAX_CONCURRENT_TASKS=${MAX_CONCURRENT_TASKS:-3}
      - TASK_TIMEOUT=${TASK_TIMEOUT:-600}
      - ACTIVITY_CMD_MAX_LEN=${ACTIVITY_CMD_MAX_LEN:-150}
      - RESULT_HMAC_KEY=${RESULT_HMAC_KEY}
      - CHAT_NAMES=${SLACK_CHAT_NAMES:-}
      - GRAFANA_INTERNAL_URL=${GRAFANA_INTERNAL_URL:-}
      - GRAFANA_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-}
      - GRAFANA_URL=${GRAFANA_URL:-}
      - GRAFANA_API_TOKEN=${GRAFANA_API_TOKEN:-}
      - LOG_DIR=/var/log/hcli
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /run
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import redis; redis.from_url('$$REDIS_URL').ping()\""]
      interval: 30s
      timeout: 5s
      retries: 3
    depends_on:
      - redis
    networks:
      - h-network-frontend
    restart: unless-stopped

  claude-code:
    build:
      context: .
      dockerfile: llm/claude-code/Dockerfile
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-claude
    hostname: claude-code
    environment:
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
      - SESSION_TTL=${SESSION_TTL:-14400}
      - HISTORY_TTL=${HISTORY_TTL:-86400}
      - RESULT_HMAC_KEY=${RESULT_HMAC_KEY}
      - MAIN_MODEL=${MAIN_MODEL:-opus}
      - FAST_MODEL=${FAST_MODEL:-haiku}
      - GATE_CHECK=${GATE_CHECK:-true}
      - GATE_MODEL=${GATE_MODEL:-haiku}
      - GATE_BASE_URL=${GATE_BASE_URL:-}
      - GATE_AUTH_TOKEN=${GATE_AUTH_TOKEN:-}
      - GATE_API_KEY=${GATE_API_KEY:-}
      - ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN:-}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - ANTHROPIC_BASE_URL=${ANTHROPIC_BASE_URL:-}
      - BLOCKED_PATTERNS=${BLOCKED_PATTERNS:-}
      - BLOCKED_PATTERNS_FILE=${BLOCKED_PATTERNS_FILE:-/app/blocked-patterns.txt}
      - CHAT_NAMES=${CHAT_NAMES:-}
      - CORE_SSE_URL=http://h-cli${ENV_TAG:+-}${ENV_TAG}-core:8083/sse
      - MEMORY_SSE_URL=http://h-cli${ENV_TAG:+-}${ENV_TAG}-core:8084/sse
      - TIMESCALE_URL=${TIMESCALE_URL:-}
      - LOG_DIR=/var/log/hcli
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
    volumes:
      - ./claude-auth:/tmp/claude-staging:ro
      - ./llm/blocked-patterns.txt:/app/blocked-patterns.txt:ro
      - ./skills:/app/skills:ro
      - ./logs/claude:/var/log/hcli/claude
      - ./logs/firewall:/var/log/hcli/firewall
      - ./logs/memory-proxy:/var/log/hcli/memory-proxy
      - ./logs/sessions:/var/log/hcli/sessions
      - ./logs/sessions:/app/sessions:ro
      - ./data:/app/data:ro
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "bash", "-c", "[ -f /tmp/heartbeat ] && [ $(( $(date +%s) - $(stat -c %Y /tmp/heartbeat) )) -lt 60 ]"]
      interval: 30s
      timeout: 5s
      retries: 3
    depends_on:
      redis:
        condition: service_started
      h-cli-core:
        condition: service_started
      h-cli-timescaledb:
        condition: service_healthy
        required: false
    networks:
      - h-network-frontend
      - h-network-backend
    restart: unless-stopped

  cve-check:
    profiles: ["tools"]
    build:
      context: .
      dockerfile: security/cve-check/Dockerfile
    container_name: h-cli${ENV_TAG:+-}${ENV_TAG}-cve-check
    hostname: cve-check
    environment:
      - NVD_API_KEY=${NVD_API_KEY:-}
      - CVE_CHECK_MODEL=${CVE_CHECK_MODEL:-sonnet}
      - ANTHROPIC_BASE_URL=${CVE_CHECK_BASE_URL:-}
      - ANTHROPIC_API_KEY=${CVE_CHECK_API_KEY:-}
    volumes:
      - ./llm/blocked-patterns.txt:/app/blocked-patterns.txt:ro
      - ./skills:/app/skills:ro
      - ./data:/app/data
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "pgrep -f cve-check.py > /dev/null"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - h-network-frontend

networks:
  h-network-frontend:
    name: h-network${ENV_TAG:+-}${ENV_TAG}-frontend
    driver: bridge
  h-network-backend:
    name: h-network${ENV_TAG:+-}${ENV_TAG}-backend
    driver: bridge