services:
  rapid7-bulk-export-mcp:
    build: .
    image: rapid7-bulk-export-mcp
    container_name: rapid7-bulk-export-mcp
    ports:
      - "8000:8000"
    environment:
      - RAPID7_API_KEY=${RAPID7_API_KEY}
      - RAPID7_REGION=${RAPID7_REGION}
      - MCP_TRANSPORT=http
      # Required: the HTTP transport refuses to start without inbound auth.
      - MCP_AUTH_JWKS_URI=${MCP_AUTH_JWKS_URI}
      - MCP_AUTH_ISSUER=${MCP_AUTH_ISSUER}
      - MCP_AUTH_AUDIENCE=${MCP_AUTH_AUDIENCE}
      - DATA_DIR=/data
      - TMPDIR=/tmp
    volumes:
      - rapid7-data:/data
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true

volumes:
  rapid7-data: