# deploy/mainnet/docker-compose.gateway.yml — OpenAI-compatible Gateway — MAINNET
#
# Multi-tenant, custodial OpenAI gateway. Each API key is its own buyer wallet;
# every request posts an on-chain escrow from that user's wallet. See docs/gateway.md.
#
# Secrets live in gateway/.env (NOT committed):
#   GATEWAY_MASTER_KEY=<openssl rand -hex 32>   # losing this locks ALL user funds
# Back up BOTH gateway/.env (the master key) AND the gateway-mainnet-data volume
# (the gateway.db holds every user's encrypted wallet key + usage).

name: marketplace-mainnet-gateway

services:
  gateway:
    build:
      context: ../..
      dockerfile: gateway/Dockerfile
    container_name: marketplace-mainnet-gateway
    restart: unless-stopped
    env_file:
      - path: ../../gateway/.env
        required: true
    environment:
      INDEXER_URL: http://marketplace-mainnet-indexer:8090
      OGMIOS_URL: https://ogmios.vector.mainnet.apexfusion.org
      LIVE_CHAIN: "1"
      NETWORK_ID: "1"
      GATEWAY_PORT: "8080"
      GATEWAY_DB_DIR: /repo/data/gateway
      # Mainnet chain genesis (slot↔wallclock). MUST match buyer/supplier or
      # PostEscrow validity bounds land ~51 days off and Ogmios rejects (code 3118).
      VECTOR_ZERO_TIME_MS: "1756485600000"
      # On-chain reference-script UTxOs (escrow spending validator) used by
      # Accept/Reclaim/Submit. Same values the buyer/suppliers use on mainnet.
      ESCROW_REF_UTXO: c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#0
      ADVERT_REF_UTXO: c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#1
      # Browser Origins allowed to call the gateway cross-origin. The buyer
      # frontend's "API Keys" page (served from marketplace.vector…) POSTs to
      # /signup here. Comma-separated; empty disables CORS entirely.
      GATEWAY_CORS_ORIGINS: https://marketplace.vector.apexfusion.org
      # Ticket mode: the escrow post at session open is the only chain op;
      # the sweeper reclaims Open escrows after deliver_by. Must match the
      # kimi-chat suppliers' CHAT_SETTLE_MODE.
      CHAT_SETTLE_MODE: ticket
      # Demo janitor closes idle sessions BEFORE the suppliers' 15 min
      # CHAT_IDLE_TIMEOUT_MS backstop.
      DEMO_SESSION_IDLE_MS: "600000"
    volumes:
      - gateway-mainnet-data:/repo/data/gateway
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
      interval: 20s
      timeout: 5s
      retries: 3
      start_period: 15s
    networks:
      - marketplace-mainnet-net
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-net"
      - "traefik.http.routers.mp-gateway-mainnet.entrypoints=web"
      - "traefik.http.routers.mp-gateway-mainnet.rule=Host(`api.marketplace.vector.apexfusion.org`)"
      - "traefik.http.services.mp-gateway-mainnet.loadbalancer.server.port=8080"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

networks:
  marketplace-mainnet-net:
    external: true
    name: marketplace-mainnet-net
  traefik-net:
    external: true
    name: traefik-net

volumes:
  gateway-mainnet-data: