services:
  opencode:
    build:
      context: .
      dockerfile: Dockerfile
    image: local/opencode-sandbox:pinned-20260528
    container_name: opencode
    restart: unless-stopped
    stop_grace_period: 30s
    user: "1000:1000"
    command: ["web", "--hostname", "0.0.0.0", "--port", "4096"]
    env_file:
      - .env
    environment:
      HOME: /home/opencode
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /.local:size=128m,mode=1777
      - /tmp:size=256m,mode=1777,exec
    volumes:
      - ${OPENCODE_HOME_PATH}:/home/opencode:Z
      - ${OPENCODE_CONFIG_PATH}:/home/opencode/.config/opencode:Z
      - ${OPENCODE_WORKSPACE_PATH}:/home/opencode/workspace:Z
    working_dir: /home/opencode/workspace
    networks:
      - proxy
    labels:
      prune.protect: "true"
      traefik.enable: "true"
      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
      traefik.http.routers.opencode.rule: "Host(`${OPENCODE_DOMAIN}`)"
      traefik.http.routers.opencode.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
      traefik.http.routers.opencode.tls: "true"
      traefik.http.routers.opencode.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
      traefik.http.routers.opencode.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_CHAIN}"
      traefik.http.services.opencode.loadbalancer.server.port: "4096"

networks:
  proxy:
    external: true