docker-compose.yml

services:
    # Interactive runtime container — use with: docker compose run kelvin-host --prompt "..."
    kelvin-host:
        build:
            context: .
            dockerfile: docker/Dockerfile.runtime
        container_name: kelvin-host
        stdin_open: true
        tty: true
        environment:
            KELVIN_HOME: /kelvin
            KELVIN_PLUGIN_HOME: /kelvin/plugins
            KELVIN_TRUST_POLICY_PATH: /kelvin/trusted_publishers.json
            OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
            RUST_LOG: ${RUST_LOG:-info}
        volumes:
            - kelvin-home:/kelvin
        networks:
            - kelvin-network
        depends_on:
            kelvin-init:
                condition: service_completed_successfully

    # Init container — installs required plugins into the shared kelvin-home volume
    # before the gateway starts. Uses KELVIN_MODEL_PROVIDER (default: kelvin.echo).
    # Set KELVIN_MODEL_PROVIDER=kelvin.anthropic and ANTHROPIC_API_KEY to use Anthropic.
    # Set KELVIN_MODEL_PROVIDER=kelvin.ollama and OLLAMA_BASE_URL to use Ollama.
    kelvin-init:
        build:
            context: .
            dockerfile: docker/Dockerfile.runtime
        container_name: kelvin-init
        environment:
            KELVIN_HOME: /kelvin
            KELVIN_PLUGIN_HOME: /kelvin/plugins
            KELVIN_TRUST_POLICY_PATH: /kelvin/trusted_publishers.json
            KELVIN_MODEL_PROVIDER: ${KELVIN_MODEL_PROVIDER:-kelvin.echo}
            ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
            OPENAI_API_KEY: ${OPENAI_API_KEY:-}
            OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
            OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
            BRAVE_API_KEY: ${BRAVE_API_KEY:-}
            EXA_API_KEY: ${EXA_API_KEY:-}
            RUST_LOG: ${RUST_LOG:-info}
        entrypoint: ["/bin/sh", "-c"]
        command:
            - |
              set -e
              mkdir -p /kelvin/plugins
              [ -f /kelvin/trusted_publishers.json ] || \
                printf '{"require_signature":false,"publishers":[]}' > /kelvin/trusted_publishers.json
              /usr/local/bin/kelvin plugin install "${KELVIN_MODEL_PROVIDER:-kelvin.echo}"
              /usr/local/bin/kelvin plugin install kelvin.cli
              for d in /opt/kelvin/plugins-builtin/*/; do
                [ -f "$${d}plugin.json" ] && /usr/local/bin/kelvin plugin install --from-dir "$$d" --force
              done
        volumes:
            - kelvin-home:/kelvin
        networks:
            - kelvin-network

    # WebSocket gateway — long-running service for agent channel ingress
    kelvin-gateway:
        build:
            context: .
            dockerfile: docker/Dockerfile.gateway
        container_name: kelvin-gateway
        environment:
            KELVIN_HOME: /kelvin
            KELVIN_PLUGIN_HOME: /kelvin/plugins
            KELVIN_TRUST_POLICY_PATH: /kelvin/trusted_publishers.json
            KELVIN_GATEWAY_TOKEN: ${KELVIN_GATEWAY_TOKEN:?KELVIN_GATEWAY_TOKEN must be set (see .env.example)}
            KELVIN_GATEWAY_INGRESS_BIND: "0.0.0.0:34618"
            ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
            OPENAI_API_KEY: ${OPENAI_API_KEY:-}
            OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
            OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
            BRAVE_API_KEY: ${BRAVE_API_KEY:-}
            EXA_API_KEY: ${EXA_API_KEY:-}
            KELVIN_TELEGRAM_ENABLED: ${KELVIN_TELEGRAM_ENABLED:-false}
            KELVIN_TELEGRAM_BOT_TOKEN: ${KELVIN_TELEGRAM_BOT_TOKEN:-}
            KELVIN_TELEGRAM_WEBHOOK_SECRET_TOKEN: ${KELVIN_TELEGRAM_WEBHOOK_SECRET_TOKEN:-}
            KELVIN_TELEGRAM_PAIRING_ENABLED: ${KELVIN_TELEGRAM_PAIRING_ENABLED:-false}
            KELVIN_TELEGRAM_ALLOW_CHAT_IDS: ${KELVIN_TELEGRAM_ALLOW_CHAT_IDS:-}
            KELVIN_TELEGRAM_ALLOW_SENDER_IDS: ${KELVIN_TELEGRAM_ALLOW_SENDER_IDS:-}
            KELVIN_TELEGRAM_OWNER_CHAT_IDS: ${KELVIN_TELEGRAM_OWNER_CHAT_IDS:-}
            KELVIN_DISCORD_ENABLED: ${KELVIN_DISCORD_ENABLED:-false}
            KELVIN_DISCORD_BOT_TOKEN: ${KELVIN_DISCORD_BOT_TOKEN:-}
            KELVIN_DISCORD_ALLOW_SENDER_IDS: ${KELVIN_DISCORD_ALLOW_SENDER_IDS:-}
            KELVIN_DISCORD_ALLOW_ACCOUNT_IDS: ${KELVIN_DISCORD_ALLOW_ACCOUNT_IDS:-}
            KELVIN_CHANNEL_ROUTING_RULES_JSON: ${KELVIN_CHANNEL_ROUTING_RULES_JSON:-}
            RUST_LOG: ${RUST_LOG:-info}
        command:
            - --bind
            - "0.0.0.0:34617"
            - --workspace
            - /kelvin/workspace
            - --allow-insecure-public-bind
            - "true"
            - --model-provider
            - ${KELVIN_MODEL_PROVIDER:-kelvin.echo}
            - --timeout-ms
            - "${KELVIN_RUN_TIMEOUT_MS:-300000}"
        volumes:
            - kelvin-home:/kelvin
            - kelvin-workspace:/kelvin/workspace
            - ./ctf:/kelvin/ctf:ro
        ports:
            - "127.0.0.1:${KELVIN_GATEWAY_WS_PORT:-34617}:34617"
            - "127.0.0.1:${KELVIN_GATEWAY_INGRESS_PORT:-34618}:34618"
        networks:
            - kelvin-network
        depends_on:
            kelvin-init:
                condition: service_completed_successfully
        restart: unless-stopped

    # Plugin registry — optional HTTP service for plugin discovery
    kelvin-registry:
        build:
            context: .
            dockerfile: docker/Dockerfile.registry
        container_name: kelvin-registry
        environment:
            KELVIN_PLUGIN_REGISTRY_BIND: "0.0.0.0:34619"
            KELVIN_PLUGIN_REGISTRY_INDEX: /opt/kelvin/index.json
            KELVIN_PLUGIN_REGISTRY_TRUST_POLICY: /opt/kelvin/trusted_publishers.json
            RUST_LOG: ${RUST_LOG:-info}
        volumes:
            - ./index.json:/opt/kelvin/index.json:ro
            - ./trusted_publishers.example.json:/opt/kelvin/trusted_publishers.json:ro
        ports:
            - "${KELVIN_PLUGIN_REGISTRY_PORT:-34619}:34619"
        networks:
            - kelvin-network
        restart: unless-stopped
        profiles:
            - registry
            - full

    # TUI client — connects to kelvin-gateway over the internal Docker network
    # Usage: docker compose run --rm kelvin-tui
    # After exiting: docker compose down --remove-orphans
    kelvin-tui:
        build:
            context: .
            dockerfile: docker/Dockerfile.tui
        container_name: kelvin-tui
        init: true
        stdin_open: true
        tty: true
        environment:
            KELVIN_GATEWAY_TOKEN: ${KELVIN_GATEWAY_TOKEN:?KELVIN_GATEWAY_TOKEN must be set (see .env.example)}
        command:
            - --gateway-url
            - "ws://kelvin-gateway:34617"
        networks:
            - kelvin-network
        depends_on:
            - kelvin-gateway
        profiles:
            - tui

    # Test runner — tests execute during docker build, not at container runtime
    # Usage: docker compose build kelvin-test
    # To run quick lane: KELVIN_TEST_LANE=quick docker compose build kelvin-test
    kelvin-test:
        build:
            context: .
            dockerfile: docker/Dockerfile.test
            target: ${KELVIN_TEST_LANE:-full}
        image: kelvin-test:${KELVIN_TEST_LANE:-full}
        profiles:
            - test

volumes:
    kelvin-home:
        driver: local
    kelvin-workspace:
        driver: local

networks:
    kelvin-network:
        driver: bridge