services:
  maskgate:
    build:
      context: .
    image: maskgate:local
    init: true
    ports:
      - "127.0.0.1:${APP_PORT:-8080}:8080"
    environment:
      APP_ENV: local
      APP_HOST: 0.0.0.0
      APP_PORT: 8080
      ENABLE_DEBUG_ENDPOINTS: "false"
      ENABLE_PLAYGROUND: "true"
      TRUSTED_HOSTS: localhost,127.0.0.1,maskgate
      LLM_PROVIDER: ${LLM_PROVIDER:-openai}
      LLM_BASE_URL: ${LLM_BASE_URL:-https://api.example.com/v1}
      LLM_API_KEY: ${LLM_API_KEY:-}
      LLM_DEFAULT_MODEL: ${LLM_DEFAULT_MODEL:-provider-model}
      DETECTOR_PROFILE: ${DETECTOR_PROFILE:-strict}
      POLICY_V2_FILE: ${POLICY_V2_FILE:-}
      MASKGATE_APPLICATION_ID: ${MASKGATE_APPLICATION_ID:-maskgate}
      MASKGATE_API_KEYS: ${MASKGATE_API_KEYS:-}
      REQUIRE_AUTH: ${REQUIRE_AUTH:-false}
    read_only: true
    tmpfs:
      - /tmp:size=256m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 256
    mem_limit: 2g
    cpus: 2.0
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/live', timeout=3).read()"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3
    restart: unless-stopped