docker-compose.yml

services:
  opencode:
    build:
      context: .
      dockerfile: Dockerfile.opencode
    restart: unless-stopped
    environment:
      # basic auth for the opencode API (web service injects it server-side)
      OPENCODE_SERVER_USERNAME: opencode
      OPENCODE_SERVER_PASSWORD: ${OPENCODE_SERVER_PASSWORD:?set in .env}
      # provider keys — add the ones you use
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
    volumes:
      # your code lives here; pick folders from the web UI under /projects/...
      - ${PROJECTS_DIR:-./projects}:/projects
      # persistent opencode state: sessions, auth, logs, config
      - opencode-data:/home/node/.local/share/opencode
      - opencode-state:/home/node/.local/state/opencode
      - opencode-config:/home/node/.config/opencode
    networks: [internal]
    # deliberately NOT exposed publicly — only the web service reaches it

  web:
    build: .
    restart: unless-stopped
    environment:
      NUXT_OPENCODE_URL: http://opencode:4096
      NUXT_OPENCODE_USERNAME: opencode
      NUXT_OPENCODE_PASSWORD: ${OPENCODE_SERVER_PASSWORD:?set in .env}
    depends_on: [opencode]
    networks: [internal, proxy]
    # Uncomment to use without Traefik:
    # ports:
    #   - "3000:3000"
    labels:
      - traefik.enable=true
      - traefik.docker.network=proxy
      - traefik.http.routers.opencode-web.rule=Host(`${WEB_DOMAIN:-opencode.localhost}`)
      - traefik.http.routers.opencode-web.entrypoints=websecure
      - traefik.http.routers.opencode-web.tls=true
      # protect the whole app (pages, API proxy and SSE stream) with tinyauth.
      # the middleware must exist in your Traefik config, e.g.:
      #   traefik.http.middlewares.tinyauth.forwardauth.address=http://tinyauth:3000/api/auth/traefik
      - traefik.http.routers.opencode-web.middlewares=tinyauth@docker
      - traefik.http.services.opencode-web.loadbalancer.server.port=3000
      # SSE: disable response buffering so events flush immediately
      - traefik.http.services.opencode-web.loadbalancer.responseforwarding.flushinterval=100ms

volumes:
  opencode-data:
  opencode-state:
  opencode-config:

networks:
  internal:
  proxy:
    external: true