docker-compose.yml

# Canvas Learning System - Docker Compose Configuration
# Story 1.1: Project Scaffold & Docker Setup
#
# Usage:
#   docker-compose up -d              # Start all services
#   docker-compose up -d neo4j        # Start Neo4j only
#   docker-compose logs -f            # View logs
#   docker-compose down               # Stop and remove containers
#
# Prerequisites:
#   - Docker Desktop installed
#   - Copy .env.example to .env and set NEO4J_PASSWORD + CANVAS_BASE_PATH

version: '3.8'

services:
  # ═══════════════════════════════════════════════════════════════════════════
  # Neo4j Graph Database
  # ═══════════════════════════════════════════════════════════════════════════
  neo4j:
    image: neo4j:5.26-community
    container_name: canvas-learning-system-neo4j

    environment:
      - NEO4J_AUTH=${NEO4J_USER:-neo4j}/${NEO4J_PASSWORD:-password}
      - NEO4J_PLUGINS=["apoc"]
      - NEO4J_dbms_memory_heap_initial__size=512m
      - NEO4J_dbms_memory_heap_max__size=1G
      - NEO4J_dbms_allow__upgrade=true

    # NOTE: Using 7478/7691 to avoid conflict with existing Neo4j instances (7474/7476/7687/7689)
    ports:
      - "${NEO4J_HTTP_PORT:-7478}:7474"  # HTTP Browser
      - "${NEO4J_BOLT_PORT:-7691}:7687"  # Bolt Protocol

    volumes:
      - ./docker/neo4j/data:/data
      - ./docker/neo4j/logs:/logs
      - ./docker/neo4j/plugins:/plugins

    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:7474"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 40s

    restart: unless-stopped

    networks:
      - canvas-network

  # ═══════════════════════════════════════════════════════════════════════════
  # Neo4j Test Instance - 测试专用，与产品数据完全隔离
  # Port 7692 (Bolt) / 7479 (Browser)
  # ═══════════════════════════════════════════════════════════════════════════
  neo4j-test:
    image: neo4j:5.26-community
    container_name: canvas-learning-system-neo4j-test
    profiles:
      - test
      - dev

    environment:
      - NEO4J_AUTH=${NEO4J_TEST_USER:-neo4j}/${NEO4J_TEST_PASSWORD:-testpassword}
      - NEO4J_PLUGINS=["apoc"]
      - NEO4J_dbms_memory_heap_initial__size=512m
      - NEO4J_dbms_memory_heap_max__size=1G

    ports:
      - "7479:7474"  # HTTP Browser - test instance
      - "7692:7687"  # Bolt Protocol - test connection

    volumes:
      - neo4j-test-data:/data

    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:7474"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s

    restart: unless-stopped

    networks:
      - canvas-network

  # ═══════════════════════════════════════════════════════════════════════════
  # Ollama - Local LLM / Embedding Server
  # Story 1.1 Task 1.2: Ollama service for bge-m3 embeddings
  # ⚠️ Mac: Ollama runs NATIVELY (brew install ollama) for Metal GPU access.
  #    Docker Ollama is Windows/Linux only (NVIDIA GPU passthrough).
  #    On Mac, backend reaches native Ollama via host.docker.internal:11434.
  # ═══════════════════════════════════════════════════════════════════════════
  ollama:
    image: ollama/ollama:latest
    container_name: canvas-learning-system-ollama
    profiles: ["windows"]  # Only start on Windows/Linux with NVIDIA GPU

    environment:
      - OLLAMA_NUM_PARALLEL=1    # V7: explicit single-request (RTX 4060 8GB VRAM budget)
      - OLLAMA_MAX_QUEUE=8       # V7: prevent unbounded queue buildup under burst traffic

    ports:
      - "11434:11434"

    volumes:
      - ./docker/ollama/models:/root/.ollama/models

    healthcheck:
      test: ["CMD", "ollama", "list"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 30s

    restart: unless-stopped

    # GPU passthrough for Ollama (RTX 4060 — Qwen3 8B inference ~37s vs CPU 120s)
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]

    networks:
      - canvas-network

  # ═══════════════════════════════════════════════════════════════════════════
  # FastAPI Backend
  # Story 1.1 Task 1.1: FastAPI service with health check
  # ═══════════════════════════════════════════════════════════════════════════
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: canvas-learning-system-backend

    ports:
      - "${API_PORT:-8001}:8001"

    environment:
      - NEO4J_URI=bolt://neo4j:7687
      - NEO4J_USER=${NEO4J_USER:-neo4j}
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
      - OLLAMA_HOST=${OLLAMA_HOST:-http://host.docker.internal:11434}
      - CANVAS_BASE_PATH=/app/vaults/${ACTIVE_VAULT:-canvas-vault}
      - VAULTS_ROOT=/app/vaults
      - ACTIVE_VAULT=${ACTIVE_VAULT:-canvas-vault}
      - PYTHONPATH=/app:/app/src
      - DEBUG=${DEBUG:-true}
      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:3000,http://127.0.0.1:3000,http://localhost:5173,http://127.0.0.1:5173,http://tauri.localhost,app://obsidian.md}
      # GOOGLE_API_KEY: read from backend/.env via load_dotenv (not from host env)

    volumes:
      - ./backend:/app
      - ./src:/app/src
      - canvas-lancedb:/app/data/lancedb
      - ./data:/app/data
      - "${VAULTS_ROOT:-.}:/app/vaults:${VAULT_MOUNT_MODE:-rw}"

    depends_on:
      neo4j:
        condition: service_healthy
      # ollama: removed — Mac uses native Ollama (host.docker.internal:11434)

    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8001/api/v1/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

    restart: unless-stopped

    networks:
      - canvas-network
      # Story 1.13: cliproxyapi-network only when ENABLE_CLIPROXY=true
      # Uncomment the line below if using CLIProxy API integration:
      # - cliproxyapi-network

  # ═══════════════════════════════════════════════════════════════════════════
  # Claude Dev Container - Automated development pipeline
  # ═══════════════════════════════════════════════════════════════════════════
  claude-dev:
    build:
      context: .
      dockerfile: .devcontainer/Dockerfile.claude
    container_name: claude-dev
    profiles:
      - dev
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - CLAUDE_CONFIG_DIR=/workspace/.claude
      - CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1
      - TERM=tmux-256color
      - NEO4J_TEST_URI=bolt://neo4j-test:7687
    volumes:
      - .:/workspace
    working_dir: /workspace
    stdin_open: true
    tty: true
    cap_add:
      - NET_ADMIN
    networks:
      - canvas-network
    depends_on:
      neo4j-test:
        condition: service_healthy
      ollama:
        condition: service_healthy
    entrypoint: >
      /bin/bash -c "/usr/local/bin/init-firewall.sh &&
      tmux new-session -d -s main &&
      tail -f /dev/null"

# ═══════════════════════════════════════════════════════════════════════════
# Networks
# ═══════════════════════════════════════════════════════════════════════════
networks:
  canvas-network:
    driver: bridge
    name: canvas-learning-network
  # Story 1.13: conditional external network (only needed for CLIProxy integration)
  # cliproxyapi-network:
  #   external: true
  #   name: cliproxyapi_default

volumes:
  canvas-lancedb:
    name: canvas-lancedb-data
  neo4j-test-data:
    name: canvas-neo4j-test-data