opencode/docker-compose.yml aktualisiert

opencode/docker-compose.yml

@@ -1,15 +1,72 @@
 services:
-  # --- 1. DATENBANK (PostgreSQL) ---
+  # --- 1. OIDC SECURITY PROXY ---
+  auth_proxy:
+    image: quay.io/oauth2-proxy/oauth2-proxy:latest
+    container_name: ${STACK_NAME:-opencode_20}_oidc_proxy
+    restart: always
+    ports:
+      - "${HOST_PORT:-4180}:4180"
+    environment:
+      - OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180
+      - OAUTH2_PROXY_REDIRECT_URL=https://${DOMAIN_NAME:-localhost}/oauth2/callback
+      - OAUTH2_PROXY_EMAIL_DOMAINS=*
+      - OAUTH2_PROXY_UPSTREAM=http://app:4096
+      - OAUTH2_PROXY_PROVIDER=${OIDC_PROVIDER:-generic}
+      - OAUTH2_PROXY_CLIENT_ID=${OIDC_CLIENT_ID:-fallback_id}
+      - OAUTH2_PROXY_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-fallback_secret}
+      - OAUTH2_PROXY_OIDC_ISSUER_URL=${OIDC_ISSUER_URL:-https://localhost/issuer}
+      - OAUTH2_PROXY_COOKIE_SECRET=${OIDC_COOKIE_SECRET:-Vk5mbU16UnpOSGRDTVZ4T1ZsTmJZazlTZkU5VzBRMD0=}
+      - OAUTH2_PROXY_COOKIE_SECURE=${COOKIE_SECURE_HTTPS:-false}
+    networks:
+      - proxy_network
+      - backend_network
+
+  # --- 2. MULTI-PROJECT OPENCODE SERVER ---
+  app:
+    image: ghcr.io/anomalyco/opencode:${APP_IMAGE_TAG:-2.0.0}
+    container_name: ${STACK_NAME:-opencode_20}_server
+    restart: always
+    # Wir starten den Server im übergeordneten /workspaces Ordner
+    command: opencode serve --port 4096 --hostname 0.0.0.0
+    environment:
+      # Globale Git Identität für alle Commits des Agenten
+      - GIT_USER_NAME=${GIT_USER_NAME:-OpenCode Agent}
+      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-opencode-bot@local.internal}
+      
+      # Das Token wird als Umgebungsvariable bereitgestellt, damit Git-Befehle im Chat autorisiert sind
+      - GITEA_TOKEN=${GITEA_PAT:?error_GITEA_PAT_is_required}
+      - GITHUB_TOKEN=${GITEA_PAT:-}
+      
+      # KI & DB
+      - OPENAI_API_KEY=${OPENAI_KEY:-}
+      - ANTHROPIC_API_KEY=${ANTHROPIC_KEY:-}
+      - DB_HOST=db
+      - DB_USER=${DB_USER:-opencode_user}
+      - DB_PASSWORD=${DB_PASSWORD:-test_password_123_secure}
+      - DB_NAME=${DB_NAME:-opencode_db}
+    volumes:
+      # Ein globaler Ordner auf Ihrem Server, der alle Ihre Git-Projekte enthält
+      - ${HOST_WORKSPACES_ROOT_PATH:-workspaces_data}:/workspaces
+      # MCP-Konfiguration und Einstellungen
+      - ${HOST_CONFIG_PATH:-app_config}:/root/.config/opencode
+    # Der Server startet im Root-Verzeichnis aller Projekte
+    working_dir: /workspaces
+    networks:
+      - backend_network
+    depends_on:
+      db:
+        condition: service_healthy
+
+  # --- 3. DATABASE TIER ---
   db:
     image: postgres:16-alpine
-    container_name: ${STACK_NAME:-opencode_test}_db
+    container_name: ${STACK_NAME:-opencode_20}_db
     restart: always
     environment:
       POSTGRES_USER: ${DB_USER:-opencode_user}
       POSTGRES_PASSWORD: ${DB_PASSWORD:-test_password_123_secure}
       POSTGRES_DB: ${DB_NAME:-opencode_db}
     volumes:
-      # Wenn HOST_DB_VOLUME_PATH leer ist, greift das lokale Named Volume
       - ${HOST_DB_VOLUME_PATH:-db_data}:/var/lib/postgresql/data
     networks:
       - backend_network
@@ -19,42 +76,14 @@ services:
       timeout: 5s
       retries: 5
 
-  # --- 2. OPENCODE AI AGENT (ghcr.io) ---
-  app:
-    image: ghcr.io/anomalyco/opencode:${APP_IMAGE_TAG:-latest}
-    container_name: ${STACK_NAME:-opencode_test}_agent
-    restart: always
-    
-    # WICHTIG für Terminal-Apps (TUI) im Container:
-    stdin_open: true
-    tty: true
-    
-    environment:
-      # AI Provider API Keys (Werden über Portainer injiziert)
-      - OPENAI_API_KEY=${OPENAI_KEY:-}
-      - ANTHROPIC_API_KEY=${ANTHROPIC_KEY:-}
-      - OPENCODE_API_KEY=${OPENCODE_ZEN_KEY:-} # Falls OpenCode Zen genutzt wird
-      
-      # Datenbank-Verbindung für den Agenten
-      - DB_HOST=db
-      - DB_USER=${DB_USER:-opencode_user}
-      - DB_PASSWORD=${DB_PASSWORD:-test_password_123_secure}
-      - DB_NAME=${DB_NAME:-opencode_db}
-    volumes:
-      # Ihr Code-Verzeichnis (Workspace), das der Agent analysieren soll
-      - ${HOST_WORKSPACE_PATH:-workspace_data}:/workspace
-    working_dir: /workspace
-    networks:
-      - backend_network
-    depends_on:
-      db:
-        condition: service_healthy
-
-# Die Named Volumes als automatischer Fallback für die Test-Umgebung
 volumes:
   db_data:
-  workspace_data:
+  workspaces_data:
+  app_config:
 
 networks:
+  proxy_network:
+    driver: bridge
   backend_network:
     driver: bridge
+    internal: true