# OpenClaw custom Docker Compose template for TrueNAS / Dockhand community use
#
# Replace the placeholder values below with paths, ports, timezone, and UID/GID
# values that match your own system before deploying.
#
# Notes:
# - no fixed container_name (let TrueNAS/Dockhand manage container names)
# - use OpenClaw's /healthz endpoint for Docker health checks
# - optional secret/integration env vars come from env_file, not inline environment overrides
#
# Example LAN verification after deploy:
#   curl -i http://<TRUENAS-IP>:<OPENCLAW_PORT>/healthz

services:
  openclaw-gateway:
    image: alpine/openclaw:<OPENCLAW_VERSION>
    user: "<UID>:<GID>"

    env_file:
      - path: /mnt/<POOL>/apps/openclaw/config/.openclaw/custom-app.env
        required: false

    environment:
      HOME: /home/node
      OPENCLAW_HOME: /home/node
      TERM: xterm-256color
      TZ: <YOUR_TIMEZONE>

      OPENCLAW_STATE_DIR: /home/node/.openclaw
      OPENCLAW_CONFIG_PATH: /home/node/.openclaw/openclaw.json
      OPENCLAW_CONFIG_DIR: /home/node/.openclaw
      OPENCLAW_WORKSPACE_DIR: /home/node/.openclaw/workspaces

      OPENCLAW_GATEWAY_PORT: "<OPENCLAW_PORT>"
      OPENCLAW_GATEWAY_BIND: lan

    volumes:
      - type: bind
        source: /mnt/<POOL>/apps/openclaw/config
        target: /home/node

      # Optional: bind-mount your persistent workspaces if you want local files
      # and agent state outside the container. If you do not need persistent or
      # pre-existing workspaces, you can remove this mount and let OpenClaw use
      # the container's internal workspace directory instead.
      - type: bind
        source: /mnt/<POOL>/agents/<PRIMARY_WORKSPACE_NAME>/ws
        target: /home/node/.openclaw/workspaces

      # Optional: bind-mount a shared workspace if you use one. Remove this if
      # you do not use a separate shared workspace on your system.
      - type: bind
        source: /mnt/<POOL>/agents/<SHARED_WORKSPACE_NAME>/ws
        target: /ws

    ports:
      - "<OPENCLAW_PORT>:<OPENCLAW_PORT>"

    cap_drop:
      - NET_RAW
      - NET_ADMIN
    security_opt:
      - no-new-privileges:true
    extra_hosts:
      - "host.docker.internal:host-gateway"

    init: true
    restart: unless-stopped

    command:
      [
        "node",
        "openclaw.mjs",
        "gateway",
        "--allow-unconfigured",
        "--bind",
        "lan",
        "--port",
        "<OPENCLAW_PORT>"
      ]

    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://127.0.0.1:<OPENCLAW_PORT>/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
        ]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 60s