services:
  app:
    image: borrowed-confidence:${RELEASE_SHA:?Set the full tested commit SHA}
    container_name: bc-api
    restart: unless-stopped
    init: true
    user: "1000:1000"
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    cpus: 0.50
    mem_limit: 512m
    memswap_limit: 512m
    pids_limit: 128
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m,mode=1777
    environment:
      NODE_ENV: production
      PORT: "3001"
      DATA_DIR: /data
      APP_ORIGIN: https://borrowed-confidence.52.202.25.181.sslip.io
      COOKIE_SECURE: "true"
      # Deliberate operator enablement; the credential itself is never an env value.
      ALLOW_LIVE_TRYON: ${ALLOW_LIVE_TRYON:-false}
      YOUCAM_API_KEY_FILE: ${YOUCAM_API_KEY_FILE:-}
      MAX_LIVE_JOBS_PER_DAY: ${MAX_LIVE_JOBS_PER_DAY:-1}
      MAX_LIVE_JOBS_PER_SESSION_PER_DAY: ${MAX_LIVE_JOBS_PER_SESSION_PER_DAY:-5}
      MAX_TOTAL_LIVE_JOBS: ${MAX_TOTAL_LIVE_JOBS:-30}
      RELEASE_SHA: ${RELEASE_SHA:?Set the full tested commit SHA}
    volumes:
      - /opt/borrowed-confidence/data:/data
    expose: ["3001"]
    networks: [app]
    secrets: [youcam_api_key]
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "2"

secrets:
  youcam_api_key:
    # Compose bind-mounts this file read-only for this service only. Its host
    # directory is root-only; file is root:1000 0440 for the unprivileged app.
    file: ${BC_YOUCAM_SECRET_FILE:-/opt/borrowed-confidence/secrets/youcam_api_key}

networks:
  app:
    name: borrowed-confidence-net