docker-compose.yml

networks:
  web:
  internal:

services:
  traefik:
    image: traefik:v3
    restart: unless-stopped
    networks: [web, internal]
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=internal
      - --providers.file.directory=/dynamic
      - --providers.file.watch=true
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.address=:80
      - --certificatesresolvers.le.acme.email=${CLAYDE_GIT_EMAIL}
      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.le.acme.httpchallenge=true
      - --certificatesresolvers.le.acme.httpchallenge.entrypoint=web
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/letsencrypt:/letsencrypt
      # Hand-written routes for host services that are not containers here
      # (the /board and /walk backends on the host).
      - ./traefik-dynamic:/dynamic:ro
  clayde:
    image: ghcr.io/claydecode/me:main
    restart: unless-stopped
    user: "1000:1000"
    # The host's docker group, so the mounted socket below is usable as uid
    # 1000. Must match `getent group docker` on the host.
    group_add:
      - "${DOCKER_GID:-111}"
    networks: [internal]
    expose:
      - "8080"
    environment:
      - CLAYDE_ENABLED=true
    volumes:
      - ./data:/data
      # Dedicated Claude config dir for the container (required when
      # CLAYDE_CLAUDE_BACKEND=cli). Use a SEPARATE login here — see README:
      #   CLAUDE_CONFIG_DIR=~/clayde-claude claude login
      # Mount the DIRECTORY, not the single .credentials.json file: the CLI
      # refreshes its short-lived OAuth token via atomic rename (new inode),
      # which a single-file bind mount pins to the stale inode at start —
      # causing "authentication expired" until the stack is restarted. A
      # directory mount resolves the path live, so refreshes are picked up.
      - ~/clayde-claude:/home/clayde/.claude
      # Pebble skill directories — mount one or more host dirs read-only
      # under /skills/. Subdirectory layout is free; discovery is recursive.
      - ~/skills/personal:/skills/personal:ro
      - ~/skills/shared:/skills/shared:ro
      # Whole personal skill library, read-only — lets scheduled tasks (and
      # Pebble requests) use any skill from the knowledge base, e.g. ntfy-ping
      # for an intentional success notification.
      - ~/knowledge_base/skills:/skills/kb:ro
      # Pebble knowledge-base working directory — Syncthing on the host
      # handles cross-device sync; container performs no git on the KB.
      - ~/knowledge_base:/home/clayde/knowledge_base
      # Scheduled-task markdown files (cron/at frontmatter). Read-write: the
      # scheduler moves fired one-off files into a done/ subdirectory.
      - ~/clayde-tasks:/tasks
      # Docker CLI access for agent runs that need to resolve images, e.g. the
      # app-repository update pass and its `docker compose pull --dry-run`.
      # Full socket: an agent in this container can control every container on
      # the host. Deliberate, and the reason the whitelist above matters.
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.clayde.rule=Host(`${CLAYDE_PEBBLE_HOST}`) && PathPrefix(`/webhook`)"
      - "traefik.http.routers.clayde.entrypoints=websecure"
      - "traefik.http.routers.clayde.tls.certresolver=le"
      - "traefik.http.services.clayde.loadbalancer.server.port=8080"