services:
  searxng-mcp:
    build:
      context: .
      dockerfile: Dockerfile.prod
    image: searxng-mcp:prod
    init: true
    restart: unless-stopped
    ports:
      - "${SEARXNG_MCP_PUBLISH_PORT:-8811}:8811"
    environment:
      SEARXNG_MCP_BASE_URL: ${SEARXNG_MCP_BASE_URL:-http://host.docker.internal:8890}
      SEARXNG_MCP_FALLBACK_BASE_URLS: ${SEARXNG_MCP_FALLBACK_BASE_URLS:-}
      SEARXNG_MCP_FETCH_VERIFY_TLS: ${SEARXNG_MCP_FETCH_VERIFY_TLS:-1}
      SEARXNG_MCP_SEARCH_CONCURRENCY: ${SEARXNG_MCP_SEARCH_CONCURRENCY:-6}
      SEARXNG_MCP_FETCH_CONCURRENCY: ${SEARXNG_MCP_FETCH_CONCURRENCY:-3}
      SEARXNG_MCP_RENDER_CONCURRENCY: ${SEARXNG_MCP_RENDER_CONCURRENCY:-2}
      SEARXNG_MCP_RENDER_AUTO_FALLBACK: ${SEARXNG_MCP_RENDER_AUTO_FALLBACK:-1}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - searxng-mcp-cache:/data/cache
    read_only: true
    tmpfs:
      - /tmp:size=512m,mode=1777
      - /home/searxng/.cache:size=256m,mode=700
      - /home/searxng/.config:size=64m,mode=700
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

volumes:
  searxng-mcp-cache: