services:

  # ─── Claude Max API Proxy ───────────────────────────────
  proxy:
    image: node:22-alpine
    container_name: aria-proxy
    command: >-
      sh -c "npm install -g @anthropic-ai/claude-code claude-max-api-proxy &&
      DIST=$(find /usr/local/lib -path '*/claude-max-api-proxy/dist' -type d | head -1) &&
      sed -i 's/startServer({ port })/startServer({ port, host: process.env.HOST || \"127.0.0.1\" })/' $$DIST/server/standalone.js &&
      sed -i 's/if (model\.includes/if ((model||\"claude-sonnet-4\").includes/g' $$DIST/adapter/cli-to-openai.js &&
      claude-max-api"
    volumes:
      - ~/.config/claude:/root/.config/claude       # Claude CLI Auth (rw fuer Login via Diagnostic)
    environment:
      - HOST=0.0.0.0
    restart: unless-stopped
    networks:
      - aria-net

  # ─── OpenClaw (ARIA Gehirn) ─────────────────────────────
  aria:
    image: ghcr.io/openclaw/openclaw:latest
    container_name: aria-core
    privileged: true                               # ARIAs Wohnung — sie hat die Schlüssel
    depends_on:
      - proxy
    ports:
      - "3001:3001"                                # Diagnostic Web-UI (laeuft im shared network)
    environment:
      - CANVAS_HOST=127.0.0.1
      - OPENCLAW_GATEWAY_TOKEN=${ARIA_AUTH_TOKEN}
      - OPENAI_API_KEY=not-needed
      - OPENAI_BASE_URL=http://proxy:3456/v1
      - ANTHROPIC_API_KEY=not-needed
      - ANTHROPIC_BASE_URL=http://proxy:3456
      - DEFAULT_MODEL=claude-sonnet-4-6
      - RATE_LIMIT_PER_USER=30
      - DISPLAY=:0
    volumes:
      - ./aria-data/brain:/workspace/memory        # Gedächtnis
      - ./aria-data/skills:/workspace/skills       # Skills
      - ./aria-data/config/AGENT.md:/workspace/AGENT.md
      - ./aria-data/config/USER.md:/workspace/USER.md
      - ./aria-data/config/openclaw.env:/workspace/.env
      - /tmp/.X11-unix:/tmp/.X11-unix
      - /var/run/docker.sock:/var/run/docker.sock  # VM von innen verwalten
    restart: unless-stopped
    networks:
      - aria-net

  # ─── ARIA Voice Bridge ──────────────────────────────────
  bridge:
    build: ./bridge
    container_name: aria-bridge
    depends_on:
      - aria
    network_mode: "service:aria"                   # Teilt Netzwerk mit aria-core → localhost:18789 erreichbar
    volumes:
      - ./aria-data/voices:/voices:ro              # TTS Stimmen
      - ./aria-data/config/aria.env:/config/aria.env
      # Audio-Zugriff
      - /run/user/1000/pulse:/run/user/1000/pulse
      - /dev/snd:/dev/snd
    devices:
      - /dev/snd
    environment:
      - PULSE_SERVER=unix:/run/user/1000/pulse/native
      - ARIA_AUTH_TOKEN=${ARIA_AUTH_TOKEN:-}
      - RVS_HOST=${RVS_HOST:-}
      - RVS_PORT=${RVS_PORT:-443}
      - RVS_TLS=${RVS_TLS:-true}
      - RVS_TLS_FALLBACK=${RVS_TLS_FALLBACK:-true}
      - RVS_TOKEN=${RVS_TOKEN:-}
    restart: unless-stopped

  # ─── Diagnostic (Selbstcheck-UI) ──────────────────────
  diagnostic:
    build: ./diagnostic
    container_name: aria-diagnostic
    depends_on:
      - aria
    network_mode: "service:aria"                   # Teilt Netzwerk mit aria-core → localhost:18789
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - ARIA_AUTH_TOKEN=${ARIA_AUTH_TOKEN:-}
      - PROXY_URL=http://proxy:3456
      - RVS_HOST=${RVS_HOST:-}
      - RVS_PORT=${RVS_PORT:-443}
      - RVS_TLS=${RVS_TLS:-true}
      - RVS_TLS_FALLBACK=${RVS_TLS_FALLBACK:-true}
      - RVS_TOKEN=${RVS_TOKEN:-}
    restart: unless-stopped

networks:
  aria-net:
    driver: bridge