docker-compose.yml

services:
  redis:
    image: redis:7-alpine
    container_name: mcp-redis
    command: ["redis-server", "--save", "", "--appendonly", "no"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 10
    networks:
      - mcp-internal
    restart: unless-stopped

  # MCP Git Proxy - operacje git i cache repozytoriów
  mcp-git-proxy:
    build:
      context: .
      dockerfile: mcp-git-proxy/Dockerfile
    container_name: mcp-git-proxy
    environment:
      - GIT_PROXY_REPO_ROOT=/git-repos
      - GIT_PROXY_CACHE_ROOT=/git-cache
      - GIT_PROXY_ALLOW_MUTATION=${GIT_PROXY_ALLOW_MUTATION:-false}
      - GIT_PROXY_ALLOW_EXECUTE=${GIT_PROXY_ALLOW_EXECUTE:-false}
      - GIT_PROXY_ALLOW_REMOTE_WRITE=${GIT_PROXY_ALLOW_REMOTE_WRITE:-false}
    volumes:
      - git-repo-storage:/git-repos
      - git-cache-storage:/git-cache
      - ./repos:/host-repos:ro
      - ..:/host-semcod:ro
    ports:
      - "${GIT_PROXY_BIND_HOST:-127.0.0.1}:${PORT_GIT_PROXY:-8081}:8080"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=3)"]
      interval: 20s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - mcp-internal

  # gh2mcp Agent - synchronizacja tokenu GitHub (gh CLI -> .env)
  gh2mcp-agent:
    build:
      context: .
      dockerfile: gh2mcp/Dockerfile
    container_name: gh2mcp-agent
    environment:
      - GH2MCP_ENV_FILE=/app/.env
      - GH2MCP_ALLOW_MUTATION=${GH2MCP_ALLOW_MUTATION:-false}
      - GH2MCP_SYNC_ON_START=${GH2MCP_SYNC_ON_START:-false}
      - GH2MCP_SYNC_INTERVAL=${GH2MCP_SYNC_INTERVAL:-0}
      - GH_TOKEN=${GH_TOKEN:-}
      - GITHUB_PAT=${GITHUB_PAT:-}
      - GITHUB_TOKEN=${GITHUB_TOKEN:-}
    volumes:
      - ./.env:/app/.env
      - ${HOME}/.config/gh:/root/.config/gh:ro
    ports:
      - "${GH2MCP_BIND_HOST:-127.0.0.1}:${PORT_GH2MCP:-8079}:8079"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8079/health', timeout=3)"]
      interval: 20s
      timeout: 5s
      retries: 5
    networks:
      - mcp-internal
    restart: unless-stopped

  # MCP Skills Server - analiza kodu i metryki
  mcp-skills:
    build:
      context: ..
      dockerfile: mcp/mcp-skills/Dockerfile
      cache_from:
        - type=local,src=/tmp/docker-cache/mcp-skills
      cache_to:
        - type=local,dest=/tmp/docker-cache/mcp-skills,mode=max
    container_name: mcp-skills-server
    environment:
      - PYTHONUNBUFFERED=1
      - SKILLS_REPO_BASE=/skills-cache
      - GIT_PROXY_URL=http://mcp-git-proxy:8080
      - MCP_SKILLS_TRANSPORT=http
      - MCP_SKILLS_HTTP_HOST=0.0.0.0
      - MCP_SKILLS_HTTP_PORT=8080
      - MCP_SKILLS_ALLOW_SYNC=${MCP_SKILLS_ALLOW_SYNC:-false}
      - MCP_SKILLS_ALLOW_EXECUTE=${MCP_SKILLS_ALLOW_EXECUTE:-false}
      - GITHUB_PAT=${GITHUB_PAT:-}
      - GH_TOKEN=${GH_TOKEN:-}
    volumes:
      - skills-cache:/skills-cache
      - ./mcp-skills/server.py:/app/server.py:ro
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=3)"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped
    depends_on:
      mcp-git-proxy:
        condition: service_healthy
    networks:
      - mcp-internal

  # LLM Agent - workflow git2mcp
  llm-agent:
    build: ./llm-agent
    container_name: llm-agent
    environment:
      - LLM_PROVIDER=${LLM_PROVIDER:-openrouter-lite}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      - LLM_MODEL=${LLM_MODEL:-openrouter/x-ai/grok-code-fast-1}
      - GITHUB_PAT=${GITHUB_PAT:-}
      - GIT_PROXY_URL=http://mcp-git-proxy:8080
    volumes:
      - ./repos:/host-repos:ro
      - ./output:/output
      - skills-cache:/skills-cache
      - ./git2mcp:/app/git2mcp:ro
      - ./llm-agent/agent.py:/app/agent.py:ro
      - ./llm-agent/agent_standalone.py:/app/agent_standalone.py:ro
      - ./llm-agent/agent_git2mcp.py:/app/agent_git2mcp.py:ro
    depends_on:
      - mcp-git-proxy
      - mcp-skills
    networks:
      - mcp-internal
    profiles:
      - agent

  # MCP Gateway - publiczny shim OpenAI-compatible (auth, multi-tenant)
  mcp-gateway:
    build:
      context: .
      dockerfile: mcp-gateway/Dockerfile
    container_name: mcp-gateway
    environment:
      - GIT_PROXY_URL=http://mcp-git-proxy:8080
      - SKILLS_URL=http://mcp-skills:8080
      - GH2MCP_URL=http://gh2mcp-agent:8079
      - MCP_ASYNC_ENABLED=${MCP_ASYNC_ENABLED:-true}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379/0}
      - RQ_QUEUE_NAME=${RQ_QUEUE_NAME:-mcp-jobs}
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      - LLM_MODEL=${LLM_MODEL:-openrouter/x-ai/grok-code-fast-1}
      - GITHUB_PAT=${GITHUB_PAT:-}
      - GITHUB_TOKEN=${GITHUB_TOKEN:-}
      - GITHUB_API_URL=${GITHUB_API_URL:-https://api.github.com}
      - MCP_TENANTS_DIR=/app/tenants
      - MCP_AUDIT_LOG=/audit/audit.jsonl
    volumes:
      - ./mcp-gateway/tenants:/app/tenants:ro
      - ./.env:/app/.env
      - audit-storage:/audit
    ports:
      - "${MCP_GATEWAY_BIND_HOST:-127.0.0.1}:${PORT_GATEWAY:-9000}:9000"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:9000/health', timeout=3)"]
      interval: 20s
      timeout: 5s
      retries: 5
    depends_on:
      redis:
        condition: service_healthy
      mcp-git-proxy:
        condition: service_healthy
      mcp-skills:
        condition: service_healthy
      gh2mcp-agent:
        condition: service_healthy
    networks:
      - mcp-internal
      - mcp-public
    restart: unless-stopped

  mcp-gateway-worker:
    build:
      context: .
      dockerfile: mcp-gateway/Dockerfile
    container_name: mcp-gateway-worker
    command: ["python", "worker.py"]
    environment:
      - GIT_PROXY_URL=http://mcp-git-proxy:8080
      - SKILLS_URL=http://mcp-skills:8080
      - GH2MCP_URL=http://gh2mcp-agent:8079
      - MCP_ASYNC_ENABLED=${MCP_ASYNC_ENABLED:-true}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379/0}
      - RQ_QUEUE_NAME=${RQ_QUEUE_NAME:-mcp-jobs}
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      - LLM_MODEL=${LLM_MODEL:-openrouter/x-ai/grok-code-fast-1}
      - GITHUB_PAT=${GITHUB_PAT:-}
      - GITHUB_TOKEN=${GITHUB_TOKEN:-}
      - GITHUB_API_URL=${GITHUB_API_URL:-https://api.github.com}
      - MCP_TENANTS_DIR=/app/tenants
      - MCP_AUDIT_LOG=/audit/audit.jsonl
    volumes:
      - ./mcp-gateway/tenants:/app/tenants:ro
      - ./.env:/app/.env
      - audit-storage:/audit
    depends_on:
      redis:
        condition: service_healthy
      mcp-git-proxy:
        condition: service_healthy
      mcp-skills:
        condition: service_healthy
      gh2mcp-agent:
        condition: service_healthy
    networks:
      - mcp-internal
    restart: unless-stopped

  # MCP WebUI - testowy panel dla skills i diff
  mcp-webui:
    build:
      context: .
      dockerfile: mcp-webui/Dockerfile
    container_name: mcp-webui
    environment:
      - GATEWAY_URL=http://mcp-gateway:9000
      - GIT_PROXY_URL=http://mcp-git-proxy:8080
      - WEBUI_API_KEY=${WEBUI_API_KEY:-sk-mcp-default-dev-key}
      - GH2MCP_URL=http://gh2mcp-agent:8079
      - MCP_WEBUI_ALLOW_SECRET_WRITE=${MCP_WEBUI_ALLOW_SECRET_WRITE:-false}
      - MCP_WEBUI_ALLOW_MUTATION=${MCP_WEBUI_ALLOW_MUTATION:-false}
      - MCP_WEBUI_ALLOW_EXECUTE=${MCP_WEBUI_ALLOW_EXECUTE:-false}
    volumes:
      - ./.env:/app/.env
    ports:
      - "${MCP_WEBUI_BIND_HOST:-127.0.0.1}:${PORT_WEBUI:-8092}:8090"
    depends_on:
      mcp-gateway:
        condition: service_healthy
      mcp-git-proxy:
        condition: service_healthy
      gh2mcp-agent:
        condition: service_healthy
    networks:
      - mcp-internal
      - mcp-public
    restart: unless-stopped

  # MCP Docs - dokumentacja projektu i playbooki chat
  mcp-docs:
    build:
      context: .
      dockerfile: mcp-docs/Dockerfile
    container_name: mcp-docs
    environment:
      - PORT_OPENWEBUI=${PORT_OPENWEBUI:-3000}
      - OPENWEBUI_URL=${OPENWEBUI_URL:-http://localhost:3000/}
    ports:
      - "${PORT_DOCS:-8093}:8090"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8090/health', timeout=3)"]
      interval: 20s
      timeout: 5s
      retries: 5
    networks:
      - mcp-public
    restart: unless-stopped

  # OpenWebUI - frontend dla użytkowników końcowych (OpenAI-compat klient)
  openwebui:
    image: ${OPENWEBUI_IMAGE:-ghcr.io/open-webui/open-webui:v0.11.0@sha256:72c0ba641ba75e7aa52655cb242570906ececd09b1140fb736483038a22b3228}
    container_name: openwebui
    environment:
      - OPENAI_API_BASE_URL=http://mcp-gateway:9000/v1
      - OPENAI_API_KEY=${WEBUI_API_KEY:-sk-mcp-default-dev-key}
      - WEBUI_AUTH=${OPENWEBUI_AUTH:-True}
      - ENABLE_SIGNUP=${OPENWEBUI_ENABLE_SIGNUP:-False}
      - ENABLE_FORWARD_USER_INFO_HEADERS=True
      - FORWARD_USER_INFO_HEADER_JWT=X-OpenWebUI-User-Jwt
      - FORWARD_USER_INFO_HEADER_JWT_EXPIRES_SECONDS=300
      # Renderowanie Markdown / artefaktów
      - ENABLE_MERMAID=${ENABLE_MERMAID:-true}
      - ENABLE_LATEX=${ENABLE_LATEX:-true}
      - ENABLE_CODE_EXECUTION=${ENABLE_CODE_EXECUTION:-false}
      - ENABLE_ARTIFACTS=${ENABLE_ARTIFACTS:-true}
      - COLLAPSE_CODE_BLOCKS=${COLLAPSE_CODE_BLOCKS:-false}
      # UI
      - DEFAULT_LOCALE=${DEFAULT_LOCALE:-pl-PL}
      - SHOW_ADMIN_DETAILS=${SHOW_ADMIN_DETAILS:-false}
    volumes:
      - openwebui-data:/app/backend/data
      - ${OPENWEBUI_MCP_JWT_SECRET_FILE:-./.secrets/openwebui-mcp-jwt.secret}:/run/secrets/openwebui-mcp-jwt:ro
      - ${OPENWEBUI_MCP_BEARER_SECRET_FILE:-./.secrets/openwebui-mcp-bearer.secret}:/run/secrets/openwebui-mcp-bearer:ro
      - ${OPENWEBUI_SESSION_SECRET_FILE:-./.secrets/openwebui-session.secret}:/run/secrets/openwebui-session:ro
    command:
      - bash
      - -lc
      - export WEBUI_SECRET_KEY="$$(tr -d '\r\n' < /run/secrets/openwebui-session)"; export FORWARD_USER_INFO_HEADER_JWT_SECRET="$$(tr -d '\r\n' < /run/secrets/openwebui-mcp-jwt)"; exec bash start.sh
    ports:
      - "${OPENWEBUI_BIND_HOST:-127.0.0.1}:${PORT_OPENWEBUI:-3000}:8080"
    depends_on:
      mcp-gateway:
        condition: service_healthy
    networks:
      - mcp-public
    restart: unless-stopped
    profiles:
      - openwebui

  # Dashboard - statyczny widok output/
  dashboard:
    build: ./dashboard
    container_name: mcp-dashboard
    environment:
      - DASHBOARD_PORT=8080
    volumes:
      - ./output:/output:ro
      - ./repos:/repos:ro
      - ./dashboard/index.html:/app/index.html:ro
      - ./dashboard/server.py:/app/server.py:ro
    ports:
      - "${PORT_DASHBOARD:-8085}:8080"
    depends_on:
      - mcp-git-proxy
      - mcp-skills
    restart: unless-stopped
    networks:
      - mcp-internal
      - mcp-public

networks:
  mcp-internal:
    driver: bridge
  mcp-public:
    driver: bridge

volumes:
  git-repo-storage:
  git-cache-storage:
  skills-cache:
  audit-storage:
  openwebui-data: