docker-compose.yml

services:
  nginx:
    image: nginx:alpine
    restart: unless-stopped
    ports:
      # Only this computer by default: on shared Wi-Fi, other devices can't reach the app. Set WINDRUSH_BIND=0.0.0.0
      # in .env to open it to your network (e.g. your phone on home Wi-Fi).
      - "${WINDRUSH_BIND:-127.0.0.1}:80:80"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on: [frontend, api]

  frontend:
    build: ./frontend
    restart: unless-stopped
    expose: ["3000"]
    environment:
      - NEXT_PUBLIC_API_URL=/api
      - HOSTNAME=0.0.0.0

  api:
    build: ./api
    # Comes back after a reboot or a Docker restart, so scheduled collections and autopilot runs keep going.
    restart: unless-stopped
    expose: ["8000"]
    environment:
      - GROQ_API_KEY=${GROQ_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - ANTHROPIC_MODEL=${ANTHROPIC_MODEL:-claude-sonnet-4-6}
      - AZURE_OPENAI_ENDPOINT=${AZURE_OPENAI_ENDPOINT:-}
      - AZURE_OPENAI_API_KEY=${AZURE_OPENAI_API_KEY:-}
      - AZURE_OPENAI_DEPLOYMENT=${AZURE_OPENAI_DEPLOYMENT:-}
      - AZURE_OPENAI_API_VERSION=${AZURE_OPENAI_API_VERSION:-}
      - AZURE_OPENAI_REASONING_EFFORT=${AZURE_OPENAI_REASONING_EFFORT:-}
      - LLM_BACKEND=${LLM_BACKEND:-groq}
      - OLLAMA_HOST=http://ollama:11434
      - OLLAMA_MODEL=${OLLAMA_MODEL:-qwen3.5:4b}
      - EMBEDDING_MODEL=nomic-embed-text
      - ECONOMIC_INDEX_PATH=/data/economic_index.json
      - TASK_PENETRATION_PATH=/data/task_penetration.csv
      - ADZUNA_APP_ID=${ADZUNA_APP_ID}
      - ADZUNA_API_KEY=${ADZUNA_API_KEY}
      - BRAVE_SEARCH_API_KEY=${BRAVE_SEARCH_API_KEY:-}
      - SPONSOR_REGISTER_REFRESH=${SPONSOR_REGISTER_REFRESH:-1}
      - JOB_ATTRIBUTES_LLM=${JOB_ATTRIBUTES_LLM:-}
      # Collect jobs for every user's target titles every N hours; 0 turns it off.
      - JOB_COLLECT_HOURS=${JOB_COLLECT_HOURS:-6}
      # Gmail tracking (read-only): an OAuth client from Google Cloud. Leave unset to keep it off.
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
      - GOOGLE_REDIRECT_URI=${GOOGLE_REDIRECT_URI:-http://localhost/api/gmail/callback}
      # Optional: lifts GitHub's 60-requests-an-hour limit when reading your repositories for profile suggestions.
      - GITHUB_TOKEN=${GITHUB_TOKEN:-}
      # Quoted: an unquoted ": " inside the message would make YAML read the item as a mapping.
      - "JWT_SECRET=${JWT_SECRET:?JWT_SECRET must be set in .env (generate with: openssl rand -hex 32)}"
      - "CREDENTIALS_KEY=${CREDENTIALS_KEY:?CREDENTIALS_KEY must be set in .env (see .env.example)}"
      - APP_DATA_PATH=/appdata
      # browser-use telemetry / cloud sync default to ON and would send each run's task prompt
      # (the applicant's personal data), actions and visited URLs to browser-use. Keep them off.
      - ANONYMIZED_TELEMETRY=false
      - BROWSER_USE_CLOUD_SYNC=false
    volumes:
      - economic_data:/data:ro
      - app_data:/appdata
    depends_on:
      - ollama

  ollama:
    image: ollama/ollama:latest
    restart: unless-stopped
    volumes:
      - ollama_data:/root/.ollama
    expose: ["11434"]
    environment:
      - OLLAMA_KEEP_ALIVE=24h
    # If you have an NVIDIA GPU, uncomment the following lines to enable hardware acceleration:
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]

volumes:
  economic_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ./data
  app_data:
  ollama_data: