services:
  decidealot:
    build:
      context: .
    image: psyb0t/decidealot:local
    user: "${DECIDEALOT_UID:-1000}:${DECIDEALOT_GID:-1000}"
    init: true
    restart: unless-stopped
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 512
    ports:
      - "127.0.0.1:8080:8080"
    environment:
      DECIDEALOT_API_KEY: ${DECIDEALOT_API_KEY:-}
      DECIDEALOT_LOG_LEVEL: ${DECIDEALOT_LOG_LEVEL:-INFO}
      DECIDEALOT_MAX_REQUEST_BYTES: ${DECIDEALOT_MAX_REQUEST_BYTES:-1048576}
      DECIDEALOT_MAX_BATCH_REQUESTS: ${DECIDEALOT_MAX_BATCH_REQUESTS:-0}
      DECIDEALOT_MAX_BATCH_CONCURRENCY: ${DECIDEALOT_MAX_BATCH_CONCURRENCY:-0}
      DECIDEALOT_MCP_ALLOWED_HOSTS: "${DECIDEALOT_MCP_ALLOWED_HOSTS:-127.0.0.1,127.0.0.1:*,localhost,localhost:*,[::1],[::1]:*,decidealot,decidealot:*}"
      DECIDEALOT_MCP_ALLOWED_ORIGINS: "${DECIDEALOT_MCP_ALLOWED_ORIGINS:-http://127.0.0.1:*,http://localhost:*,http://[::1]:*}"
      DECIDEALOT_PROVIDER_IDLE_UNLOAD_SECONDS: ${DECIDEALOT_PROVIDER_IDLE_UNLOAD_SECONDS:-600}
      DECIDEALOT_MAX_RESIDENT_LOCAL_PROVIDERS: ${DECIDEALOT_MAX_RESIDENT_LOCAL_PROVIDERS:-1}
      DECIDEALOT_LAYA_ENABLED: ${DECIDEALOT_LAYA_ENABLED:-true}
      DECIDEALOT_VON_ENABLED: ${DECIDEALOT_VON_ENABLED:-true}
      DECIDEALOT_CLM_ENABLED: ${DECIDEALOT_CLM_ENABLED:-auto}
      DECIDEALOT_CLM_EMBEDDINGS_URL: ${DECIDEALOT_CLM_EMBEDDINGS_URL:-}
      DECIDEALOT_CLM_EMBEDDINGS_MODEL: ${DECIDEALOT_CLM_EMBEDDINGS_MODEL:-qwen3-8b}
      DECIDEALOT_CLM_EMBEDDINGS_API_KEY: ${DECIDEALOT_CLM_EMBEDDINGS_API_KEY:-}
      DECIDEALOT_CLM_EMBEDDINGS_TIMEOUT_SECONDS: ${DECIDEALOT_CLM_EMBEDDINGS_TIMEOUT_SECONDS:-120}
      DECIDEALOT_CLM_CANDIDATE_CACHE_ENTRIES: ${DECIDEALOT_CLM_CANDIDATE_CACHE_ENTRIES:-1024}
      DECIDEALOT_CLM_CANDIDATE_CACHE_TTL_SECONDS: ${DECIDEALOT_CLM_CANDIDATE_CACHE_TTL_SECONDS:-600}
      DECIDEALOT_CLM_MAX_TEXT_BYTES: ${DECIDEALOT_CLM_MAX_TEXT_BYTES:-8192}
      DECIDEALOT_CLM_PARALLEL_WITH_LOCAL_MODELS: ${DECIDEALOT_CLM_PARALLEL_WITH_LOCAL_MODELS:-false}
      DECIDEALOT_TYPESAFE_API_KEY: ${DECIDEALOT_TYPESAFE_API_KEY:-}
      DECIDEALOT_JEV_ENABLED: ${DECIDEALOT_JEV_ENABLED:-auto}
    volumes:
      - type: bind
        source: ${DECIDEALOT_MODEL_DIRECTORY:?set DECIDEALOT_MODEL_DIRECTORY to a writable host directory}
        target: /models
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=128m
      - /var/run:rw,noexec,nosuid,size=8m
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=3).read()"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: "4.0"
          memory: 8g
          pids: 512
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"