# 1. Navigate to secondary disk and create folder structure
cd /mnt/docker-data
mkdir -p agent-canvas/projects agent-canvas/openhands
cd agent-canvas

# 2. Generate secure browser authentication token
openssl rand -base64 32 > .api_key
chmod 600 .api_key
echo "LOCAL_BACKEND_API_KEY=$(cat .api_key)" > .env
chmod 600 .env

# 3. Create docker-compose.yml (tracking latest)
cat << 'EOF' > docker-compose.yml
services:
  agent-canvas:
    image: ghcr.io/openhands/agent-canvas:latest
    container_name: agent-canvas
    restart: unless-stopped
    ports:
      - "8000:8000"
    environment:
      - LOCAL_BACKEND_API_KEY=${LOCAL_BACKEND_API_KEY}
      - PROJECTS_PATH=/projects
    volumes:
      - ./openhands:/home/openhands/.openhands
      - ./projects:/projects
      - /var/run/docker.sock:/var/run/docker.sock
    stdin_open: true
    tty: true
EOF

# 4. Apply permissions to prevent LXC/bind-mount write errors
chmod -R 777 ./openhands ./projects

# 5. Pull the latest image and boot up
docker compose pull
docker compose up -d

# 6. Display access info
echo "=========================================================="
echo " DEPLOYMENT COMPLETE!"
echo " Open http://<your-container-ip>:8000/canvas"
echo " Use the key below to authenticate in the browser:"
echo "----------------------------------------------------------"
cat .api_key
echo "=========================================================="