services:
  hermes:
    build: .
    restart: unless-stopped
    command: gateway run
    environment:
      - HERMES_DASHBOARD=1
      - HERMES_DASHBOARD_PUBLIC_URL=${HERMES_DASHBOARD_PUBLIC_URL:?required}
      - HERMES_DASHBOARD_BASIC_AUTH_USERNAME=${HERMES_DASHBOARD_USERNAME:-hermes}
      - HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=${HERMES_DASHBOARD_PASSWORD:?required}
      - HERMES_DASHBOARD_BASIC_AUTH_SECRET=${HERMES_DASHBOARD_SECRET:?required}
      - HERMES_UID=1000
      - HERMES_GID=1000
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      - HERMES_WRITE_SAFE_ROOT=/opt/data:/workspace
      - TERMINAL_CWD=/workspace
      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
      - TELEGRAM_ALLOWED_USERS=${TELEGRAM_ALLOWED_USERS:-}
      - TELEGRAM_GROUP_ALLOWED_CHATS=${TELEGRAM_GROUP_ALLOWED_CHATS:-}
      # - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      # - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      # - GOOGLE_API_KEY=${GOOGLE_API_KEY:-}
    volumes:
      - hermes-data:/opt/data
      - hermes-workspace:/workspace
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:9119/api/status"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s

volumes:
  hermes-data:
  hermes-workspace: