services:
  whoop-personal-mcp:
    build:
      context: .
    restart: unless-stopped
    env_file:
      - .env
    environment:
      NODE_ENV: production
      PORT: "3000"
      BIND_HOST: 0.0.0.0
      DATA_DIR: /app/data
    ports:
      # Localhost-only by default. Deliberately opt into an external bind only
      # behind a reviewed HTTPS reverse proxy/firewall.
      - "127.0.0.1:${WHOOP_MCP_PORT:-3000}:3000"
    volumes:
      - whoop-personal-mcp-data:/app/data
      - ./whoop-mcp.config.json:/app/whoop-mcp.config.json:ro
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - "fetch('http://127.0.0.1:3000/health').then(r => { if (!r.ok) process.exit(1) }).catch(() => process.exit(1))"
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

volumes:
  whoop-personal-mcp-data: