# ⚠️  AI ENTRYPOINT: READ FIRST
# This is a Sovereign Agent Hub (Engram). Before making any changes, review:
# → docs/PROJECT_INTELLIGENCE.md (governance framework)
#
# Core Mandates (Non-Negotiable):
# 1. Stealth-by-Default — No auto-discovery or auto-expansion without toggles
# 2. Self-Healing Entrypoints — All services auto-regenerate missing configs
# 3. Hardening Wizard — Model transitions require explicit user consent
# 4. Hardware Handshake — Initial provisioning via out-of-band (USB/cable)

services:
  # FastAPI Hub Server
  hub:
    build:
      context: .
      dockerfile: Dockerfile.hub
    container_name: engram-hub
    ports:
      - "8000:8000"
    environment:
      - PYTHONUNBUFFERED=1
      - DATABASE_URL=sqlite:///./engram.db
      - MATRIX_REGISTRATION_SECRET=${MATRIX_REGISTRATION_SECRET}
    volumes:
      - ./src/engram:/app/src/engram
      - ./engram.db:/app/engram.db
      - ./config:/app/config
      - ./entities:/app/entities
      - ./telemetry:/app/telemetry
    networks:
      - engram-mesh
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
    restart: unless-stopped

  # Matrix/Synapse Server — Auto-generates config and uses GPU if available
  synapse:
    image: matrixdotorg/synapse:latest
    container_name: engram-synapse
    ports:
      - "8008:8008"
      - "8448:8448"
    environment:
      - SYNAPSE_SERVER_NAME=engram.local
      - SYNAPSE_REPORT_STATS=no
      - MATRIX_REGISTRATION_SECRET=${MATRIX_REGISTRATION_SECRET}
    volumes:
      - ./matrix:/data
      - ./docker/synapse-entrypoint.sh:/entrypoint.sh:ro
    entrypoint: /entrypoint.sh
    networks:
      - engram-mesh
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8008/_synapse/admin/v1/server_version"]
      interval: 15s
      timeout: 5s
      retries: 3
    restart: unless-stopped
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]

networks:
  engram-mesh:
    driver: bridge
