version: '3.8'

services:
  reddit-bot:
    build: .
    container_name: reddit-bot
    restart: unless-stopped
    dns:
      - 1.1.1.1
      - 8.8.8.8
    # Persist the database, browser session, and Matrix credentials in a
    # named docker volume — a `./data` bind mount gets wiped on every Dokploy
    # redeploy because the deploy dir is rebuilt, which loses the cookies and
    # the captured Matrix token and triggers the slow re-login + token-sniff
    # path on every restart.
    volumes:
      - reddit_bot_data:/app/data
    # The dashboard goes through Traefik. noVNC must bypass the upstream
    # proxy because it strips WebSocket Upgrade requests needed by websockify.
    # Restrict host port 16080 with the host firewall; VNC_PASSWORD still
    # authenticates the VNC session.
    ports:
      - "16080:6080"
    expose:
      - "3000"   # Web dashboard
    environment:
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
      # Required whenever the web dashboard is enabled; never commit its value.
      - WEB_DASHBOARD_TOKEN=${WEB_DASHBOARD_TOKEN}
      - REDDIT_USERNAME=${REDDIT_USERNAME}
      - REDDIT_PASSWORD=${REDDIT_PASSWORD}
      # Chromium runs headed under Xvfb so a human can complete login over noVNC.
      - BROWSER_HEADLESS=false
      # Required to lock down the VNC endpoint.
      - VNC_PASSWORD=${VNC_PASSWORD}
      # Direct noVNC URL, e.g. http://<dokploy-host>:16080. It must not go
      # through the WebSocket-stripping reverse proxy.
      - NOVNC_PUBLIC_URL=${NOVNC_PUBLIC_URL}

volumes:
  reddit_bot_data: