services:
  hub:
    build:
      context: .
      dockerfile: Dockerfile
    image: central-ai-hub:local
    container_name: hub
    restart: unless-stopped
    ports:
      - "8788:8788"
    environment:
      HUB_PORT: "8788"
      HUB_ROUTING_FILE: "/app/routing.md"
      HUB_LOG_PATH: "/tmp/hub.log"
      # Data projects that speak /ask (comma-separated name=url). Empty until a
      # project is ready. The Hub reads each project's /capabilities.
      HUB_PROJECTS: "${HUB_PROJECTS:-}"
      # House TTS. The Hub starts speech and does not wait.
      JERVIS_URL: "${JERVIS_URL:-http://192.168.20.13:8501}"
      # Secrets are never hard-coded. The Hub keys (HUB_TOKEN_*, OMNIROUTE_API_KEY,
      # PAPERCLIP_API_KEY, HUB_PROJECT_<NAME>_TOKEN) come from environment.d. The
      # file is mounted read-only; the Hub reads it when the environment is empty.
      HUB_SECRETS_FILE: "/run/secrets/hub.env"
    volumes:
      # routing.md is human-edited and stays outside the image.
      - "./routing.md:/app/routing.md:ro"
      - "${HOME}/.config/environment.d/10-secrets.conf:/run/secrets/hub.env:ro"
    # The distroless image has no writable path except this tmpfs. The log lives here.
    tmpfs:
      - /tmp
    healthcheck:
      test: ["CMD", "/app/hub", "-healthcheck"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s