docker-compose.codespaces.yml

# Use in Codespaces: docker compose -f docker-compose.yml -f docker-compose.codespaces.yml up
#
# This overlay publishes on 0.0.0.0 so the Codespaces port-forwarder can reach
# the services. That makes it the one shipped configuration where the API is not
# loopback-only, so it must not run unauthenticated.
#
# API_BEARER_TOKEN uses `:?`, so Compose refuses to start when it is unset rather
# than silently publishing an unauthenticated control plane that can drive a
# browser holding stored logins. Reported privately 2026-06-17: with the API on
# 0.0.0.0 and no token, anyone who could reach the port could open a session from
# a saved auth profile and export its cookies.
#
#   export API_BEARER_TOKEN="$(python -c 'import secrets; print(secrets.token_urlsafe(32))')"
#
# Raw VNC (5900) is deliberately no longer published here: without a password
# it is unauthenticated, and only safe behind a loopback bind. noVNC (6080)
# stays published so human takeover still works. Codespaces forwards ports
# privately by default; if you make 6080 public, also set VNC_PASSWORD (noVNC
# then prompts for it; only the first 8 characters count). noVNC only accepts
# its own page on loopback names, so set NOVNC_ALLOWED_HOSTS to the forwarded
# host name (<codespace>-6080.app.github.dev) if takeover reports
# "Invalid Origin Header".
#
# `!override` replaces the base service's `ports` list instead of merging with it.
# Without it, Compose appends these entries to the base 127.0.0.1 bindings, so both
# 127.0.0.1:PORT and 0.0.0.0:PORT are published for the same container port and the
# second bind fails with "address already in use" (breaks the devcontainer
# postStartCommand). Requires Docker Compose v2.24.4+ (Codespaces ships newer).
services:
  browser-node:
    ports: !override
      - "0.0.0.0:${NOVNC_PORT:-6080}:6080"

  controller:
    environment:
      API_BEARER_TOKEN: ${API_BEARER_TOKEN:?set API_BEARER_TOKEN before using the Codespaces overlay - it publishes the API on 0.0.0.0 and must not run unauthenticated}
      # Overrides the base file's `loopback`. Compose refuses to start without a
      # token above; this makes the controller itself refuse too, so the guard
      # survives anyone copying these service definitions somewhere else.
      API_BIND_SCOPE: exposed
    ports: !override
      - "0.0.0.0:${API_PORT:-8000}:8000"