services:
  topic-watch:
    build: .
    container_name: topic-watch
    ports:
      # Loopback by default: Topic Watch has no authentication, and Docker's
      # published ports are inserted ahead of ufw/firewalld rules, so publishing
      # on every interface would expose it even on a host whose firewall denies
      # incoming traffic. Set TOPIC_WATCH_BIND_ADDR=0.0.0.0 in .env to reach it
      # from other devices, and put it behind an authenticating reverse proxy.
      - "${TOPIC_WATCH_BIND_ADDR:-127.0.0.1}:${TOPIC_WATCH_PORT:-8000}:8000"
    volumes:
      - ./data:/app/data
    restart: unless-stopped
    healthcheck:
      # OVH-122: explicit urlopen timeout (< the 5s Docker timeout) so the probe
      # is self-bounded if /health hangs, rather than relying on Docker's SIGKILL.
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=4)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          memory: 512M
    environment:
      - TZ=${TZ:-UTC}
      # Match the bind-mounted ./data ownership to your host user so the
      # container can write the database/config. Defaults to 1000 (the typical
      # first Linux user). If `id -u` on your host is not 1000, set PUID/PGID
      # (e.g. in a .env file) to your host UID/GID.
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      # Only send cookies over HTTPS. TOPIC_WATCH_SECURE_COOKIES in .env
      # reaches the container through this line — uncommenting it there alone
      # is not enough, since .env only fills in ${...} placeholders here.
      - TOPIC_WATCH_SECURE_COOKIES=${TOPIC_WATCH_SECURE_COOKIES:-false}
      # Extra hostnames the app answers to (comma-separated). Empty by default:
      # localhost, *.local and any IP address are already accepted. Set it in
      # .env when a reverse proxy forwards a hostname.
      - TOPIC_WATCH_ALLOWED_HOSTS=${TOPIC_WATCH_ALLOWED_HOSTS:-}
      # Override config via environment variables instead of mounting config.yml.
      # These are list entries, so keep the leading "- " when uncommenting:
      # - TOPIC_WATCH_LLM__API_KEY=your-api-key-here
      # - TOPIC_WATCH_LLM__MODEL=openai/gpt-5.4-nano
      # - TOPIC_WATCH_CHECK_INTERVAL_HOURS=6