networks:
  nginx-bridge:
    external: true            # ALWAYS external; see AGENTS.md §5

services:
  agentchat:
    image: git.gbrown.org/gib/agentchat:latest
    container_name: agentchat
    hostname: agentchat
    domainname: agentchat.gbrown.org
    networks: ['nginx-bridge']
    ports:
      # Loopback only: lets this host's own agent reach the hub at
      # http://127.0.0.1:8080 without going through NPM - the LAN access
      # list there blocks the VPS's public IP. Unreachable from elsewhere.
      - '127.0.0.1:8080:8080'
    environment:
      - TZ=America/New_York
      - AGENTCHAT_DB=/data/agentchat.db
    volumes:
      - ./data:/data:z        # lowercase :z — watchtower recreates DROP the relabel flag, and :Z-category files would lock the new container out (learned 2026-08-13); :z keeps them accessible
    labels: ['com.centurylinklabs.watchtower.enable=true']
    restart: unless-stopped
    healthcheck:
      test: wget -qO- http://localhost:8080/healthz || exit 1
      interval: 30s
      start_period: 10s