services:
  neo-chat:
    build:
      context: .
      args:
        NEXT_DEPLOYMENT_ID: ${NEXT_DEPLOYMENT_ID:-}
        NEXT_PUBLIC_ENABLE_INTELLIGENT_UI_EXPLORER: ${NEXT_PUBLIC_ENABLE_INTELLIGENT_UI_EXPLORER:-true}
        NEXT_PUBLIC_MCP_APPS_SANDBOX_ORIGIN: ${NEXT_PUBLIC_MCP_APPS_SANDBOX_ORIGIN:-}
    image: neo-chat:local
    ports:
      - "127.0.0.1:3000:3000"
    # Load optional deployment-wide defaults (including DEFAULT_* variables).
    # Keep this scoped to neo-chat; mcp-bridge receives only its explicit values.
    env_file:
      - path: .env
        required: false
    environment:
      NODE_ENV: production
      PORT: "3000"
      HOSTNAME: "0.0.0.0"
      DEPLOYMENT_MODE: ${DEPLOYMENT_MODE:-local}
      ALLOW_INSECURE_LOCAL_PRODUCTION: ${ALLOW_INSECURE_LOCAL_PRODUCTION:-false}
      ALLOW_INSECURE_HTTP_COOKIES: ${ALLOW_INSECURE_HTTP_COOKIES:-false}
      NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:-http://localhost:3000}
      ACCESS_PASSWORD: ${ACCESS_PASSWORD:-}
      BYOK_PRIVATE_KEY_PEM: ${BYOK_PRIVATE_KEY_PEM:-}
      BYOK_KEY_ID: ${BYOK_KEY_ID:-}
      BYOK_ALLOW_EPHEMERAL_KEY: ${BYOK_ALLOW_EPHEMERAL_KEY:-true}
      ALLOW_LOCAL_NETWORK_PROXY: ${ALLOW_LOCAL_NETWORK_PROXY:-}
      TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
      RATE_LIMIT_STORE: ${RATE_LIMIT_STORE:-memory}
      DOCUMENT_PARSE_JOB_STORE: ${DOCUMENT_PARSE_JOB_STORE:-memory}
      PLUGIN_REGISTRY_STORE: ${PLUGIN_REGISTRY_STORE:-memory}
      UPSTASH_REDIS_REST_URL: ${UPSTASH_REDIS_REST_URL:-}
      UPSTASH_REDIS_REST_TOKEN: ${UPSTASH_REDIS_REST_TOKEN:-}
      SHARING_ENABLED: ${SHARING_ENABLED:-false}
    restart: unless-stopped
    healthcheck:
      test:
        [
          "CMD-SHELL",
          'node -e "fetch(''http://127.0.0.1:3000/api/health'').then((response) => process.exit([200, 401].includes(response.status) ? 0 : 1)).catch(() => process.exit(1))"',
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  mcp-bridge:
    profiles: ["mcp"]
    build:
      context: .
      dockerfile: docker/mcp-bridge/Dockerfile
    image: neo-chat-mcp-bridge:local
    init: true
    ports:
      - "127.0.0.1:${MCP_BRIDGE_PORT:-3400}:3400"
    environment:
      NODE_ENV: production
      PORT: "3400"
      HOST: "0.0.0.0"
      MCP_BRIDGE_CONFIG: /config/servers.json
      MCP_BRIDGE_TOKEN: ${MCP_BRIDGE_TOKEN:-}
    volumes:
      - ${MCP_BRIDGE_CONFIG_FILE:-./docker/mcp-bridge/servers.example.json}:/config/servers.json:ro
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    mem_limit: 256m
    memswap_limit: 256m
    restart: unless-stopped
    healthcheck:
      test:
        [
          "CMD-SHELL",
          'node -e "fetch(''http://127.0.0.1:3400/health'').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"',
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s