name: devbox

services:
  # Owns the network namespace shared by browser and paseo, so the container is
  # itself a tailnet node: every port agents listen on (dev servers) is
  # reachable from the tailnet at http://devbox:<port>.
  tailscale:
    image: tailscale/tailscale:latest
    container_name: devbox-tailscale
    hostname: devbox
    restart: unless-stopped
    environment:
      TS_HOSTNAME: devbox
      TS_STATE_DIR: /var/lib/tailscale
      # Only needed for the first login; the node key is kept in the state dir.
      TS_AUTHKEY: ${TS_AUTHKEY:-}
      TS_USERSPACE: "false"
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
    volumes:
      - ${DATA_DIR:?}/tailscale:/var/lib/tailscale
    # Chromium and paseo share this network, so their ports are published here.
    ports:
      - 127.0.0.1:6767:6767
      - ${TAILSCALE_IP:?}:6767:6767
      - 127.0.0.1:6901:6901
      - ${TAILSCALE_IP:?}:6901:6901

  browser:
    image: lscr.io/linuxserver/chromium@sha256:f2d4b8b284918d8d65e10921e2fc84c57fd7edbc15345ddb3c024f0949f0031c
    container_name: devbox-browser
    restart: unless-stopped
    shm_size: 1gb
    network_mode: service:tailscale
    depends_on:
      - tailscale
    environment:
      PUID: 1000
      PGID: 1000
      TZ: ${TZ:-UTC}
      LC_ALL: en_US.UTF-8
      CUSTOM_USER: devbox
      PASSWORD: ${BROWSER_PASSWORD:?}
      # Keep the desktop off 3000/3001 so agents' dev servers can use them.
      CUSTOM_PORT: 6900
      CUSTOM_HTTPS_PORT: 6901
      # Chrome only binds CDP to localhost; paseo shares this network namespace.
      CHROME_CLI: --remote-debugging-port=9222 --user-data-dir=/config/chromium-cdp
      # The image launches Chromium once; without its watchdog, a closed window
      # or a desktop teardown leaves agents with no CDP until the next restart.
      RESTART_APP: "true"
    volumes:
      - ${DATA_DIR:?}/browser-config:/config
      - ./browser/cont-init.d:/custom-cont-init.d:ro

  paseo:
    build:
      context: .
      dockerfile: image/Dockerfile
    image: devbox:latest
    container_name: paseo
    restart: unless-stopped
    network_mode: service:tailscale
    depends_on:
      - tailscale
      - browser
    environment:
      PASEO_PASSWORD: ${PASEO_PASSWORD:?}
      # Clients use the hosted app (app.paseo.sh) instead of the bundled web UI.
      PASEO_WEB_UI_ENABLED: "false"
      TZ: ${TZ:-UTC}
      # paseo terminals start $SHELL (falling back to /bin/sh). The login shell in
      # /etc/passwd stays bash, which agents use for their own commands.
      SHELL: /usr/bin/fish
      # agent-browser drives the shared Chromium by default instead of launching
      # its own; the image ships no browser.
      AGENT_BROWSER_CDP: "9222"
      # gog keeps OAuth tokens in its encrypted file keyring under the persistent
      # home; there is no Secret Service here. The disabled bus stops the keyring
      # library from trying to spawn a session bus.
      GOG_KEYRING_BACKEND: file
      GOG_KEYRING_PASSWORD: ${GOG_KEYRING_PASSWORD:-}
      DBUS_SESSION_BUS_ADDRESS: "disabled:"
      DEVBOX_GIT_NAME: ${DEVBOX_GIT_NAME:-}
      DEVBOX_GIT_EMAIL: ${DEVBOX_GIT_EMAIL:-}
    volumes:
      - ${DATA_DIR:?}/paseo-home:/home/paseo