services:
  openclaw:
    build: .
    restart: unless-stopped
    init: true
    command: ["node", "dist/index.js", "gateway", "--bind", "lan", "--port", "18789"]
    environment:
      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN:?required}
      - OPENCLAW_PUBLIC_ORIGIN=${OPENCLAW_PUBLIC_ORIGIN:?required}
      - OPENCLAW_TRUSTED_PROXIES=${OPENCLAW_TRUSTED_PROXIES:-10.0.0.0/16}
      - HOME=/home/node
      - OPENCLAW_HOME=/home/node
      - OPENCLAW_STATE_DIR=/home/node/.openclaw
      - OPENCLAW_CONFIG_PATH=/home/node/.openclaw/openclaw.json
      - OPENCLAW_CONFIG_DIR=/home/node/.openclaw
      - OPENCLAW_WORKSPACE_DIR=/home/node/.openclaw/workspace
      - OPENCLAW_GATEWAY_PORT=18789
      - TERM=xterm-256color
      - NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache
      - OPENCLAW_NO_RESPAWN=1
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      - TZ=${TZ:-Asia/Ho_Chi_Minh}
      # - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      # - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      # - GEMINI_API_KEY=${GEMINI_API_KEY:-}
      # - XAI_API_KEY=${XAI_API_KEY:-}
      # - GROQ_API_KEY=${GROQ_API_KEY:-}
      # - MISTRAL_API_KEY=${MISTRAL_API_KEY:-}
      # - CEREBRAS_API_KEY=${CEREBRAS_API_KEY:-}
      # - VENICE_API_KEY=${VENICE_API_KEY:-}
      # - MOONSHOT_API_KEY=${MOONSHOT_API_KEY:-}
      # - KIMI_API_KEY=${KIMI_API_KEY:-}
      # - MINIMAX_API_KEY=${MINIMAX_API_KEY:-}
      # - ZAI_API_KEY=${ZAI_API_KEY:-}
      # - AI_GATEWAY_API_KEY=${AI_GATEWAY_API_KEY:-}
      # - OPENCODE_API_KEY=${OPENCODE_API_KEY:-}
      # - SYNTHETIC_API_KEY=${SYNTHETIC_API_KEY:-}
      # - COPILOT_GITHUB_TOKEN=${COPILOT_GITHUB_TOKEN:-}
      # - XIAOMI_API_KEY=${XIAOMI_API_KEY:-}
      # - OLLAMA_API_KEY=${OLLAMA_API_KEY:-}
      # - DEEPGRAM_API_KEY=${DEEPGRAM_API_KEY:-}
      # - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
      # - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
      # - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN:-}
      # - AWS_REGION=${AWS_REGION:-us-east-1}
      # - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
      # - DISCORD_BOT_TOKEN=${DISCORD_BOT_TOKEN:-}
      # - SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN:-}
      # - SLACK_APP_TOKEN=${SLACK_APP_TOKEN:-}
    volumes:
      - openclaw-state:/home/node/.openclaw
      - openclaw-workspace:/home/node/.openclaw/workspace
      - openclaw-secrets:/home/node/.config/openclaw
    cap_drop:
      - NET_RAW
      - NET_ADMIN
    security_opt:
      - no-new-privileges:true
    extra_hosts:
      - host.docker.internal:host-gateway
    healthcheck:
      test: ["CMD", "node", "dist/docker-healthcheck.js"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

volumes:
  openclaw-state:
  openclaw-workspace:
  openclaw-secrets: