docker-compose.yml

# Copyright 2026 Coreframe Systems (Nexus Protocol)
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


services:
  # 🧠 CORE: The Sovereign Execution Node (Monolith)
  nexus-brain:
    build: .
    container_name: nexus-brain
    restart: always
    environment:
      - PHASE_DEV=${PHASE_DEV:-false}
      - NEXUS_ENV=production
      - PYTHONUNBUFFERED=1
    volumes:
      # PERSISTENCE: Maps the internal DB to a host file so data survives restarts
      # WARNING: Ensure 'backend/nexus_vault.db' exists as a file on host before starting
      - ./backend/nexus_vault.db:/app/backend/nexus_vault.db
      - ./logs:/app/logs
    ports:
      # SECURITY: Bind ONLY to localhost (127.0.0.1).
      # Prevents access via Public IP/LAN. Ingress is handled strictly by Cloudflare.
      - "127.0.0.1:8000:8000"
    networks:
      - nexus_net
    healthcheck:
      # SELF-REPAIR: Uses Python directly (No 'curl' dependency required)
      # Checks if the vault summary endpoint is responsive
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/vault_summary/999')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # 🛡️ SENTRY: Secure Cloudflare Ingress (Permanent Path B)
  nexus-ingress:
    image: cloudflare/cloudflared:latest
    container_name: nexus-sentry
    restart: always
    # 'run' uses the TUNNEL_TOKEN variable from the .env file
    command: tunnel --no-autoupdate run
    environment:
      - TUNNEL_TOKEN=${TUNNEL_TOKEN}
    networks:
      - nexus_net
    depends_on:
      nexus-brain:
        condition: service_healthy
    read_only: true
    tmpfs:
      - /tmp

networks:
  nexus_net:
    driver: bridge
    driver_opts:
      # ISOLATION: Prevents containers from seeing other traffic on the host
      com.docker.network.bridge.name: nexus_bridge