docker-compose.yaml

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    command: tunnel --no-autoupdate --loglevel info --url http://caddy
    
  caddy:
    image: caddy:latest
    restart: unless-stopped
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./CDPLite:/srv/cdplite:ro
      - runclawd-auth:/runclawd
    command:
      - sh
      - -c
      - |
        set -eu
        mkdir -p /runclawd
        AUTH_FILE=/runclawd/basic-auth.env
        if [ ! -f "$$AUTH_FILE" ]; then
          PASS="$$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)"
          HASH="$$(caddy hash-password --plaintext "$$PASS")"
          {
            echo "RUNCLAWD_BASIC_AUTH_USER=runclawd"
            echo "RUNCLAWD_BASIC_AUTH_PASSWORD='$$PASS'"
            echo "RUNCLAWD_BASIC_AUTH_HASH='$$HASH'"
          } >"$$AUTH_FILE"
          chmod 600 "$$AUTH_FILE" || true
        fi
        . "$$AUTH_FILE"
        echo "Basic Auth Username: $${RUNCLAWD_BASIC_AUTH_USER}"
        echo "Basic Auth Password: $${RUNCLAWD_BASIC_AUTH_PASSWORD}"
        export RUNCLAWD_BASIC_AUTH_USER RUNCLAWD_BASIC_AUTH_HASH
        exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile

  explorer:
    image: coderaiser/cloudcmd
    restart: unless-stopped
    user: "0:0"
    environment:
      CLOUDCMD_ROOT: /data
      CLOUDCMD_PREFIX: /explorer
    expose:
      - "8000"
    volumes:
      - type: volume
        source: runclawd-data
        target: /data/runclawd
        volume:
          nocopy: true
      - type: volume
        source: browserless-data
        target: /data/browserless
        volume:
          nocopy: true

  browserless:
    hostname: runclawd-browserless
    image: ghcr.io/browserless/chrome:latest
    restart: unless-stopped
    user: "0:0"
    expose:
      - "3000"
    # Important for Chrome rendering stability on small VPS instances
    shm_size: '2gb'
    volumes:
      # Persist userDataDir and browser workspace
      - browserless-data:/usr/src/app/data
    environment:
      # Tuned for 8GB VPS
      - MAX_CONCURRENT_SESSIONS=1
      - MAX_QUEUE_COUNT=4
      - PRE_BOOT_CHROME=true
      - CONNECTION_TIMEOUT=900000

      # Node.js memory cap for Browserless process
      - NODE_OPTIONS=--max-old-space-size=1024

      # Feature flags
      - ENABLE_DEBUGGER=true
      - ENABLE_UI=true
      - WORKSPACE_DIR=/usr/src/app/data/workspace

      - DEFAULT_BLOCK_ADS=true
      - PREBOOT_CHROME=true
      - DEFAULT_HEADLESS=false
      - DEFAULT_STEALTH=true
      - DEFAULT_USER_DATA_DIR=/usr/src/app/data/account_1
      - ALLOW_FILE_PROTOCOL=true
      - DEFAULT_LAUNCH_ARGS=["--disable-blink-features=AutomationControlled"]

      # Optional security token
      # - TOKEN=your_secure_token
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 4G

  docker-proxy:
    image: tecnativa/docker-socket-proxy:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      # Security: Only enable necessary Docker APIs
      POST: 1       # Create containers
      CONTAINERS: 1 # List/manage containers
      IMAGES: 1     # Pull images
      NETWORKS: 1   # Connect to networks
      INFO: 1       # Version check
      VERSION: 1
      EXEC: 1       # Run commands (exec)
      EVENTS: 1     # Listen for events (if needed)

  runclawd:
    image: ${RUNCLAWD_IMAGE:-runclawd:local}
    build:
      context: .
      args:
        - OPENCLAW_BETA=${OPENCLAW_BETA:-false}
    restart: unless-stopped
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    environment:
      DOCKER_HOST: tcp://docker-proxy:2375
      OPENCLAW_ENABLE_WEBHOOK_PROXY: "1"
      PORT: 18789
      NODE_ENV: production
      NODE_OPTIONS: '--max-old-space-size=4096'
      HOME: /data
      TERM: xterm-256color
      # Persistence: Command History
      HISTFILE: /data/.bash_history
      HISTSIZE: 50000
      HISTSAVE: 50000
      HISTCONTROL: ignoreboth
      XDG_CONFIG_HOME: /data/.config
      XDG_DATA_HOME: /data/.local/share
      XDG_CACHE_HOME: /data/.cache
      NPM_CONFIG_CACHE: /data/.npm
      BUN_INSTALL: /data/.bun
      # Map OpenClaw vars
      OPENCLAW_GATEWAY_BIND: lan
      OPENCLAW_GATEWAY_PORT: ${OPENCLAW_GATEWAY_PORT:-18789}
      # Tell the binary where to look for state/config
      OPENCLAW_STATE_DIR: /data/.openclaw
      OPENCLAW_WORKSPACE: /data/openclaw-workspace

      # API Keys injected from .env
      OPENAI_API_KEY: ${OPENAI_API_KEY}
      OPENAI_API_BASE_URL: ${OPENAI_API_BASE_URL}
      MINIMAX_API_KEY: ${MINIMAX_API_KEY}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
      GEMINI_API_KEY: ${GEMINI_API_KEY}
      KIMI_API_KEY: ${KIMI_API_KEY}
      OPENCODE_API_KEY: ${OPENCODE_API_KEY}
      MOONSHOT_API_KEY: ${KIMI_API_KEY}
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN}
      SANDBOX_CONTAINER: ${SANDBOX_CONTAINER:-false}
      
      # Optional integrations
      GOOGLE_MAPS_API_KEY: ${GOOGLE_MAPS_API_KEY}
      NANOBANANA_API_KEY: ${NANOBANANA_API_KEY}
      ELEVENLABS_API_KEY: ${ELEVENLABS_API_KEY}

      # Bootstrap controls
      OPENCLAW_AUTO_BOOTSTRAP: "1"
      OPENCLAW_PRINT_ACCESS: "1"
      GATEWAY_TRUSTED_PROXIES: '*'
      # Fix for EMFILE/Inotify issues in Docker
      CHOKIDAR_USEPOLLING: "true"
      # Deployment & Git
      VERCEL_ORG_ID: ${VERCEL_ORG_ID}
      VERCEL_PROJECT_ID: ${VERCEL_PROJECT_ID}
      VERCEL_TOKEN: ${VERCEL_TOKEN}
      GITHUB_TOKEN: ${GITHUB_TOKEN}
      GITHUB_USERNAME: ${GITHUB_USERNAME}
      GITHUB_EMAIL: ${GITHUB_EMAIL}
      # Optional
      OPENCLAW_BETA: ${OPENCLAW_BETA:-false}

    volumes:
      - runclawd-data:/data

    command: ["bash", "/app/scripts/bootstrap.sh"]
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:18789/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

volumes:
  runclawd-data:
  runclawd-auth:
  browserless-data: