docker-compose.yml

# Default `docker compose up` runs the local customer dashboard and its hosted-service clients.
# Team identity, roles, seats, and organization management remain in the private account portal.
#
# NOTE: the `env_file:` object form below (`- path: .env` + `required: false`, which makes
# .env OPTIONAL so a fresh clone with no .env still boots) needs Docker Compose v2.24+
# (Jan 2024). On older Compose, either upgrade, or replace each `env_file:` block with the
# plain list form `env_file: [.env]` and run `touch .env` first — the `environment:` blocks
# already supply every default, so .env is only ever for optional overrides.
services:
  engraphis:
    build: .
    image: engraphis:latest
    # Local customer dashboard on the v2 engine. --no-open: never try to launch a browser in a
    # container. Binds 0.0.0.0 via the ENGRAPHIS_HOST below (explicit here; the image
    # itself no longer bakes a host — its entrypoint defaults to `::` dual-stack).
    command: ["engraphis-dashboard", "--no-open"]
    ports:
      # Keep the zero-token quickstart reachable only from this machine. Do not widen
      # this bind without first setting ENGRAPHIS_API_TOKEN in .env.
      - "127.0.0.1:8700:8700"
    env_file:
      # Optional: a fresh clone has no .env (it's gitignored), and `docker compose up`
      # must still work using the `environment:` block below plus the shell env.
      - path: .env
        required: false
    environment:
      ENGRAPHIS_HOST: 0.0.0.0
      # Docker NAT presents the host browser as a private bridge peer. This exception is
      # safe only because the published host port above is loopback-only.
      ENGRAPHIS_LOCAL_TRUSTED_PEERS: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
      ENGRAPHIS_DB_PATH: /data/engraphis.db
      # Persist the customer-side cloud session and non-authoritative entitlement display
      # cache on the volume. Issuance, trial state, leases, and revocations stay private.
      ENGRAPHIS_STATE_DIR: /data/.engraphis
    volumes:
      - engraphis-data:/data
    restart: unless-stopped

volumes:
  engraphis-data: