name: email-agent

# Own container and image for this project (AGENTS.md §9). Not shared with any
# other project.

services:
  email-agent:
    build:
      context: .
      args:
        VERSION: ${EMAIL_AGENT_VERSION:-dev}
        COMMIT: ${EMAIL_AGENT_COMMIT:-unknown}
        BUILD_TIME: ${EMAIL_AGENT_BUILD_TIME:-}
    image: email-agent:${EMAIL_AGENT_TAG:-latest}
    container_name: email-agent
    restart: unless-stopped

    # Posture: keep the service on the internal network only. Caddy on .35
    # proxies to this port. Publishing is required for that hop.
    ports:
      - "${EMAIL_AGENT_PORT:-8790}:8790"

    environment:
      EMAIL_AGENT_ENV: ${EMAIL_AGENT_ENV:-production}
      EMAIL_AGENT_ADDR: ":8790"
      EMAIL_AGENT_DB_PATH: /data/email_agent.db
      EMAIL_AGENT_LOG_LEVEL: ${EMAIL_AGENT_LOG_LEVEL:-info}
      EMAIL_AGENT_PUBLIC_BASE_URL: ${EMAIL_AGENT_PUBLIC_BASE_URL:-https://mail.lab.audasmedia.com.au}
      # Secrets: names only here. Values are supplied by the host environment
      # (see ~/.config/environment.d/10-secrets.conf) or a gitignored .env file,
      # and are never committed.
      EMAIL_AGENT_SESSION_SECRET: ${EMAIL_AGENT_SESSION_SECRET:-}
      EMAIL_AGENT_PASSWORD: ${EMAIL_AGENT_PASSWORD:-}
      # Gmail IMAP + app password (AGENTS.md §8/§9). The dialer forces IPv4.
      GMAIL_USER: ${GMAIL_USER:-}
      GMAIL_APP_PASSWORD: ${GMAIL_APP_PASSWORD:-}
      EMAIL_AGENT_IMAP_HOST: ${EMAIL_AGENT_IMAP_HOST:-imap.gmail.com}
      EMAIL_AGENT_IMAP_PORT: ${EMAIL_AGENT_IMAP_PORT:-993}
      EMAIL_AGENT_IMAP_LOOKBACK_DAYS: ${EMAIL_AGENT_IMAP_LOOKBACK_DAYS:-14}
      EMAIL_AGENT_IMAP_MAX_MESSAGES: ${EMAIL_AGENT_IMAP_MAX_MESSAGES:-100}
      # SMTP submission (Phase 5). Forced to IPv4 in the dialer.
      EMAIL_AGENT_SMTP_HOST: ${EMAIL_AGENT_SMTP_HOST:-smtp.gmail.com}
      EMAIL_AGENT_SMTP_PORT: ${EMAIL_AGENT_SMTP_PORT:-587}
      JEV_BASE_URL: ${JEV_BASE_URL:-}
      JEV_API_KEY: ${JEV_API_KEY:-}
      JEV_MODEL: ${JEV_MODEL:-jev-latest}
      EMAIL_AGENT_CLASSIFY_CONCURRENCY: ${EMAIL_AGENT_CLASSIFY_CONCURRENCY:-4}
      EMAIL_AGENT_CLASSIFY_MAX_MESSAGES: ${EMAIL_AGENT_CLASSIFY_MAX_MESSAGES:-200}
      OMNIROUTE_BASE_URL: ${OMNIROUTE_BASE_URL:-}
      OMNIROUTE_API_KEY: ${OMNIROUTE_API_KEY:-}
      OMNIROUTE_MODEL: ${OMNIROUTE_MODEL:-auto/best-chat}
      # Phase 7 (FR-12): the Hub contract. HUB_TOKEN is the shared bearer token
      # the Hub sends; /capabilities and /ask refuse an unsigned request.
      HUB_TOKEN: ${HUB_TOKEN:-}
      HUB_BASE_URL: ${HUB_BASE_URL:-http://192.168.20.13:8788}
      HUB_NOTIFY_TIMEOUT: ${HUB_NOTIFY_TIMEOUT:-5s}
      # Phase 7 (FR-10): daily summary delivery through the house Apprise API
      # on .35. Set APPRISE_KEY (stored config) or APPRISE_URLS (stateless),
      # and EMAIL_AGENT_SUMMARY_TO for the recipient.
      APPRISE_URL: ${APPRISE_URL:-http://192.168.20.35:8210}
      APPRISE_KEY: ${APPRISE_KEY:-}
      APPRISE_URLS: ${APPRISE_URLS:-}
      APPRISE_TOKEN: ${APPRISE_TOKEN:-}
      EMAIL_AGENT_SUMMARY_TO: ${EMAIL_AGENT_SUMMARY_TO:-samuelrolfe@gmail.com}

    volumes:
      - email_agent_data:/data

    healthcheck:
      test: ["CMD", "/usr/local/bin/email-agent", "-healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 5s

volumes:
  email_agent_data: