services:
  kotlm:
    image: "${KOTLM_IMAGE:-ghcr.io/heapy/kotlm:main}"
    build: .
    restart: unless-stopped
    environment:
      KOTLM_CLIENTS_FILE: /run/kotlm-secrets/clients.json
      KOTLM_ADMIN_KEY: "${KOTLM_ADMIN_KEY:?set KOTLM_ADMIN_KEY in .env}"
      KOTLM_AUTH_FILE: /run/kotlm-secrets/codex_auth.json
      KOTLM_STATE_DIR: /var/lib/kotlm
      KOTLM_ALLOWED_MODELS: "${KOTLM_ALLOWED_MODELS:-gpt-6-astra,gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna}"
    volumes:
      # The directory is mounted instead of individual Docker secrets so the
      # optional auth bootstrap file may be absent during device-code login.
      - ./secrets:/run/kotlm-secrets:ro
      # The rotated refresh token and daily usage must survive restarts.
      - kotlm_state:/var/lib/kotlm
    ports:
      # Bind locally so only neighboring services and the host can reach the proxy.
      - "127.0.0.1:8080:8080"

volumes:
  kotlm_state: