docker-compose.yml

services:
  contrack:
    build: .
    container_name: contrack
    ports:
      - "3210:3210"
    volumes:
      - ./data:/app/data
    environment:
      - AI_PROVIDER=${AI_PROVIDER:-gemini}
      - GEMINI_API_KEY=${GEMINI_API_KEY}
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - AI_TIER=${AI_TIER:-FREE}
      - MAPBOX_API_KEY=${MAPBOX_API_KEY}
      # Auth is OFF by default. The published port is reachable by anything
      # that can route to this host, so if that is more than the host itself,
      # set AUTH_REQUIRED=true — the first visit walks you through creating an
      # account, and everything already in the database is assigned to it.
      - AUTH_REQUIRED=${AUTH_REQUIRED:-false}
      # Machine credential for scripts and MCP clients. Setting it also gates
      # the instance. Generate one with: openssl rand -hex 32
      - API_TOKEN=${API_TOKEN:-}
      # Everything below is optional tuning, forwarded so a value in .env
      # actually reaches the container — previously only the eight variables
      # above made it through, and a documented setting like BACKUP_KEEP was
      # silently ignored on the Docker path.
      - CORS_ORIGIN=${CORS_ORIGIN:-}
      - TRASH_RETENTION_DAYS=${TRASH_RETENTION_DAYS:-}
      - BACKUP_INTERVAL_HOURS=${BACKUP_INTERVAL_HOURS:-}
      - BACKUP_KEEP=${BACKUP_KEEP:-}
      - AI_QUICK_MODEL=${AI_QUICK_MODEL:-}
      - AI_DEEP_MODEL=${AI_DEEP_MODEL:-}
      - AI_RESEARCH_MODEL=${AI_RESEARCH_MODEL:-}
      - AI_EMBEDDINGS_MODEL=${AI_EMBEDDINGS_MODEL:-}
    restart: unless-stopped