services:
  code-executor:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "6000:3000"
      - "6001:3001"
    environment:
      - INTERNAL_TOKEN=${INTERNAL_TOKEN}
      - JOBS_DIR=/var/lib/code-executor/jobs
      - NODE_ENV=production
      - PDF_S3_BUCKET=${PDF_S3_BUCKET}
      - PDF_S3_REGION=${PDF_S3_REGION}
      - PDF_S3_KEY_PREFIX=${PDF_S3_KEY_PREFIX:-pdfs}
      - PDF_SIGNED_URL_TTL_SECONDS=${PDF_SIGNED_URL_TTL_SECONDS:-3600}
      # Bulk transcript generation (callbacks reuse INTERNAL_TOKEN)
      - TRANSCRIPT_WORKER_CONCURRENCY=${TRANSCRIPT_WORKER_CONCURRENCY:-3}
      # Optional AWS credentials — omit on EC2 to use instance IAM role instead
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      # Not under /tmp: Ubuntu's systemd-tmpfiles deletes /tmp entries idle for 30 days,
      # which left this mount pointing at a deleted folder and every job hanging.
      # Same path on both sides — job containers bind-mount their folder from the host.
      - /var/lib/code-executor/jobs:/var/lib/code-executor/jobs:z
    mem_limit: 1.5g
    restart: unless-stopped