# Managed by Ansible — do not edit manually
services:
  clay:
    image: clay:local
    build:
      context: {{ clay_data_dir }}
      dockerfile: Dockerfile
    container_name: clay
    restart: unless-stopped
    tty: true
    environment:
      - ANTHROPIC_API_KEY={{ anthropic_api_key }}
    volumes:
      - {{ clay_data_dir }}/data:/root/.clay
      - {{ clay_data_dir }}/workspace:/workspace
    command: ["clay-server", "--yes", "-p", "2633"]
    networks:
      - traefik_public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.clay.rule=Host(`{{ domain_clay }}`)"
      - "traefik.http.routers.clay.entrypoints=websecure"
      - "traefik.http.routers.clay.tls.certresolver=letsencrypt"
      - "traefik.http.services.clay.loadbalancer.server.scheme=https"
      - "traefik.http.services.clay.loadbalancer.server.port=2633"
      - "traefik.http.routers.clay.middlewares=clay-auth"
{% set ns = namespace(entries=[]) %}
{% for user in clay_users %}
{% set ns.entries = ns.entries + [user.username + ':' + (user.password | password_hash('bcrypt', (user.username | hash('md5'))[:22]) | replace('$', '$$'))] %}
{% endfor %}
      - "traefik.http.middlewares.clay-auth.basicauth.users={{ ns.entries | join(',') }}"

networks:
  traefik_public:
    external: true