docker-compose.yml

# docker-compose.yml - Garbanzo
#
# Quick start:
#   1. cp .env.example .env && edit .env with shared API keys
#   2. set COMPOSE_PROFILES in .env, for example: discord or discord,whatsapp,monitoring
#   3. docker compose up -d
#
# Bot auth, SQLite data, vectors, and dashboards persist in named volumes,
# so they survive container rebuilds and restarts.

services:
  qdrant:
    image: qdrant/qdrant:latest
    profiles: ["discord", "whatsapp", "telegram", "matrix"]
    restart: unless-stopped
    environment:
      - QDRANT__SERVICE__HTTP_PORT=${QDRANT_PORT:-6333}
    volumes:
      - qdrant_data:/qdrant/storage
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/127.0.0.1/$${QDRANT__SERVICE__HTTP_PORT:-6333}' || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3

  discord:
    image: ghcr.io/jjhickman/garbanzo:${APP_VERSION:-latest}
    container_name: garbanzo-discord
    profiles: ["discord"]
    restart: unless-stopped
    env_file:
      - path: .env
        required: true
      - path: .env.discord
        required: false
    environment:
      - NODE_ENV=production
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - GARBANZO_VERSION=${APP_VERSION:-latest}
      - MESSAGING_PLATFORM=discord
      - HEALTH_PORT=${DISCORD_HEALTH_PORT:-3002}
      - HEALTH_BIND_HOST=0.0.0.0
      # Operator overrides from root .env win; default targets the compose service
      - QDRANT_URL=${QDRANT_URL:-http://qdrant:${QDRANT_PORT:-6333}}
    ports:
      - "127.0.0.1:${DISCORD_HEALTH_PORT:-3002}:${DISCORD_HEALTH_PORT:-3002}"
    volumes:
      - discord_data:/app/data
      - ./config/discord-channels.json:/app/config/discord-channels.json:ro
      - ./config/bridge-map.json:/app/config/bridge-map.json:ro
    deploy:
      resources:
        limits:
          memory: 1G
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      - qdrant

  whatsapp:
    image: ghcr.io/jjhickman/garbanzo:${APP_VERSION:-latest}
    container_name: garbanzo-whatsapp
    profiles: ["whatsapp"]
    restart: unless-stopped
    env_file:
      - path: .env
        required: true
      - path: .env.whatsapp
        required: false
    environment:
      - NODE_ENV=production
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - GARBANZO_VERSION=${APP_VERSION:-latest}
      - MESSAGING_PLATFORM=whatsapp
      - HEALTH_PORT=${WHATSAPP_HEALTH_PORT:-3001}
      - HEALTH_BIND_HOST=0.0.0.0
      # Operator overrides from root .env win; default targets the compose service
      - QDRANT_URL=${QDRANT_URL:-http://qdrant:${QDRANT_PORT:-6333}}
    ports:
      - "0.0.0.0:${WHATSAPP_HEALTH_PORT:-3001}:${WHATSAPP_HEALTH_PORT:-3001}"
    volumes:
      - baileys_auth:/app/baileys_auth
      - garbanzo_data:/app/data
      - ./config/groups.json:/app/config/groups.json:ro
      - ./config/bridge-map.json:/app/config/bridge-map.json:ro
      # Optional: mount local voice models (Piper TTS)
      # Uncomment if you have Piper voice models on the host:
      # - ./data/voices:/app/data/voices:ro
    deploy:
      resources:
        limits:
          memory: 1G
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      - qdrant

  telegram:
    image: ghcr.io/jjhickman/garbanzo:${APP_VERSION:-latest}
    container_name: garbanzo-telegram
    profiles: ["telegram"]
    restart: unless-stopped
    env_file:
      - path: .env
        required: true
      - path: .env.telegram
        required: false
    environment:
      - NODE_ENV=production
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - GARBANZO_VERSION=${APP_VERSION:-latest}
      - MESSAGING_PLATFORM=telegram
      - HEALTH_PORT=${TELEGRAM_HEALTH_PORT:-3005}
      - HEALTH_BIND_HOST=0.0.0.0
      # Operator overrides from root .env win; default targets the compose service
      - QDRANT_URL=${QDRANT_URL:-http://qdrant:${QDRANT_PORT:-6333}}
    ports:
      - "127.0.0.1:${TELEGRAM_HEALTH_PORT:-3005}:${TELEGRAM_HEALTH_PORT:-3005}"
    volumes:
      - telegram_data:/app/data
      - ./config/telegram-chats.json:/app/config/telegram-chats.json:ro
      - ./config/bridge-map.json:/app/config/bridge-map.json:ro
    deploy:
      resources:
        limits:
          memory: 1G
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      - qdrant

  matrix:
    image: ghcr.io/jjhickman/garbanzo:${APP_VERSION:-latest}
    container_name: garbanzo-matrix
    profiles: ["matrix"]
    restart: unless-stopped
    env_file:
      - path: .env
        required: true
      - path: .env.matrix
        required: false
    environment:
      - NODE_ENV=production
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - GARBANZO_VERSION=${APP_VERSION:-latest}
      - MESSAGING_PLATFORM=matrix
      - HEALTH_PORT=${MATRIX_HEALTH_PORT:-3004}
      - HEALTH_BIND_HOST=0.0.0.0
      # Operator overrides from root .env win; default targets the compose service
      - QDRANT_URL=${QDRANT_URL:-http://qdrant:${QDRANT_PORT:-6333}}
    ports:
      - "127.0.0.1:${MATRIX_HEALTH_PORT:-3004}:${MATRIX_HEALTH_PORT:-3004}"
    volumes:
      # data volume also carries data/matrix-sync.json (the sync token)
      - matrix_data:/app/data
      - ./config/matrix-rooms.json:/app/config/matrix-rooms.json:ro
      - ./config/bridge-map.json:/app/config/bridge-map.json:ro
    deploy:
      resources:
        limits:
          memory: 1G
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      - qdrant

  # Optional monitoring stack (Prometheus + Grafana), sized for a Pi-class host.
  # Enable by including monitoring in COMPOSE_PROFILES.
  # One-time setup: set MONITORING_TOKEN and METRICS_ENABLED=true in .env.
  prometheus:
    image: prom/prometheus:v3.4.1
    container_name: garbanzo-prometheus
    profiles: ["monitoring"]
    restart: unless-stopped
    environment:
      # Interpolated from .env - the same pinned token that guards /metrics.
      - PROM_BEARER_TOKEN=${MONITORING_TOKEN:-}
      - DISCORD_HEALTH_PORT=${DISCORD_HEALTH_PORT:-3002}
      - WHATSAPP_HEALTH_PORT=${WHATSAPP_HEALTH_PORT:-3001}
      - TELEGRAM_HEALTH_PORT=${TELEGRAM_HEALTH_PORT:-3005}
      - MATRIX_HEALTH_PORT=${MATRIX_HEALTH_PORT:-3004}
      - PROMETHEUS_PORT=${PROMETHEUS_PORT:-9090}
    # Materialize the scrape token and render the prometheus.yml template from
    # env-var placeholders. prom/prometheus has no envsubst and mounts the
    # template read-only, so sed writes the rendered config to the data volume.
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        if [ -z "$$PROM_BEARER_TOKEN" ]; then
          echo "MONITORING_TOKEN must be set in .env to enable monitoring (it authenticates /metrics scrapes)" >&2
          exit 1
        fi
        printf '%s' "$$PROM_BEARER_TOKEN" > /prometheus/token
        discord_port="$${DISCORD_HEALTH_PORT}"
        whatsapp_port="$${WHATSAPP_HEALTH_PORT}"
        telegram_port="$${TELEGRAM_HEALTH_PORT}"
        matrix_port="$${MATRIX_HEALTH_PORT}"
        prometheus_port="$${PROMETHEUS_PORT}"
        sed \
          -e "s|\$${DISCORD_HEALTH_PORT:-3002}|$${discord_port}|g" \
          -e "s|\$${WHATSAPP_HEALTH_PORT:-3001}|$${whatsapp_port}|g" \
          -e "s|\$${TELEGRAM_HEALTH_PORT:-3005}|$${telegram_port}|g" \
          -e "s|\$${MATRIX_HEALTH_PORT:-3004}|$${matrix_port}|g" \
          -e "s|\$${PROMETHEUS_PORT:-9090}|$${prometheus_port}|g" \
          /etc/prometheus/prometheus.yml > /prometheus/prometheus.yml
        exec /bin/prometheus --config.file=/prometheus/prometheus.yml --web.listen-address=0.0.0.0:"$$prometheus_port" --storage.tsdb.retention.time=30d
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prom_data:/prometheus
    ports:
      - "127.0.0.1:${PROMETHEUS_PORT:-9090}:${PROMETHEUS_PORT:-9090}"
    mem_limit: 300m

  grafana:
    image: grafana/grafana-oss:11.6.0
    container_name: garbanzo-grafana
    profiles: ["monitoring"]
    restart: unless-stopped
    environment:
      # Anyone on your LAN can VIEW dashboards; editing needs the admin login.
      - GF_AUTH_ANONYMOUS_ENABLED=true
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Viewer
      - GRAFANA_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-}
      - MONITORING_TOKEN=${MONITORING_TOKEN:-}
      - GF_SERVER_HTTP_PORT=${GRAFANA_PORT:-3000}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_ANALYTICS_REPORTING_ENABLED=false
    # Admin password: GRAFANA_ADMIN_PASSWORD if set, else MONITORING_TOKEN.
    # Refuses to start when neither is set; enforced here (not via ${VAR:?})
    # so plain `docker compose up` without the monitoring profile keeps working.
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        PASSWORD="$${GRAFANA_ADMIN_PASSWORD:-$$MONITORING_TOKEN}"
        if [ -z "$$PASSWORD" ]; then
          echo "Set MONITORING_TOKEN (or GRAFANA_ADMIN_PASSWORD) in .env to enable monitoring - it becomes the Grafana admin login" >&2
          exit 1
        fi
        export GF_SECURITY_ADMIN_PASSWORD="$$PASSWORD"
        exec /run.sh
    volumes:
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - grafana_data:/var/lib/grafana
    # LAN-reachable by design: dashboards are meant to be viewed from other
    # devices. Anonymous access is read-only; restrict with an iptables
    # DOCKER-USER allowlist or bind to 127.0.0.1 + reverse proxy if needed.
    ports:
      - "0.0.0.0:${GRAFANA_PORT:-3000}:${GRAFANA_PORT:-3000}"
    mem_limit: 300m
    depends_on:
      - prometheus

  # Optional message broker for cross-instance bridging (v3). Enable by
  # including broker in COMPOSE_PROFILES and setting BRIDGE_BROKER_PASSWORD.
  rabbitmq:
    image: rabbitmq:4-management-alpine
    container_name: garbanzo-rabbitmq
    profiles: ["broker"]
    restart: unless-stopped
    environment:
      - RABBITMQ_DEFAULT_USER=${BRIDGE_BROKER_USER:-garbanzo}
      - RABBITMQ_DEFAULT_PASS=${BRIDGE_BROKER_PASSWORD:-}
      - RABBITMQ_MGMT_PORT=${RABBITMQ_MGMT_PORT:-15672}
    # Refuses to start when BRIDGE_BROKER_PASSWORD is unset; enforced here
    # (not via ${VAR:?}) so plain `docker compose up` without the broker
    # profile keeps working.
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        if [ -z "$$RABBITMQ_DEFAULT_PASS" ]; then
          echo "Set BRIDGE_BROKER_PASSWORD in .env to enable the broker profile" >&2
          exit 1
        fi
        printf 'management.tcp.port = %s\n' "$$RABBITMQ_MGMT_PORT" > /etc/rabbitmq/conf.d/10-management-port.conf
        exec docker-entrypoint.sh rabbitmq-server
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    # Management UI is localhost-only; the AMQP port (5672) is reachable only
    # over the compose network, never published to the host.
    ports:
      - "127.0.0.1:${RABBITMQ_MGMT_PORT:-15672}:${RABBITMQ_MGMT_PORT:-15672}"
    mem_limit: 400m

volumes:
  baileys_auth:
    name: garbanzo-bot-auth
  garbanzo_data:
    name: garbanzo-bot-data
  discord_data:
    name: garbanzo-bot-remy-data
  telegram_data:
    name: garbanzo-bot-telegram-data
  matrix_data:
    name: garbanzo-bot-matrix-data
  qdrant_data:
    name: garbanzo-bot-qdrant
  prom_data:
    name: garbanzo-bot-prometheus
  grafana_data:
    name: garbanzo-bot-grafana
  rabbitmq_data:
    name: garbanzo-bot-rabbitmq