# Production-oriented example. Create the files described in secrets/README.md first.
services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VERSION: "2.0.2"
    image: ai-disclosure-standard:2.0.2
    environment:
      BASE_URL: "${BASE_URL:?set BASE_URL}"
      OUTPUT_BASE_URL: "${BASE_URL:?set BASE_URL}"
      PUBLIC_NAME: "${PUBLIC_NAME:-AI Usage Disclosure}"
      CONTACT_URL: "${CONTACT_URL:-https://b1tsblog.org/page/ai}"
      DEFAULT_LANGUAGE: "${DEFAULT_LANGUAGE:-de}"
      TRUST_PROXY: "${TRUST_PROXY:-true}"
      SERVICE_MODE: full
      API_ALLOWED_ORIGIN: "${API_ALLOWED_ORIGIN:-*}"
      LICENSE_TOKEN_FILE: /run/secrets/license_token
      LICENSE_MODE: "${LICENSE_MODE:-hybrid}"
      LICENSE_SERVER_URL: "${LICENSE_SERVER_URL:-}"
      LICENSE_INSTANCE_ID: "${LICENSE_INSTANCE_ID:-commercial-app}"
      LICENSE_CACHE_FILE: /data/license-lease.json
      REQUIRE_LICENSE: "${REQUIRE_LICENSE:-false}"
      WHITE_LABEL: "${WHITE_LABEL:-false}"
    secrets:
      - license_token
    volumes:
      - app-license-cache:/data
    ports:
      - "8080:8080"
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "/ai-disclosure", "--healthcheck"]
      interval: 15s
      timeout: 3s
      retries: 3
      start_period: 5s

  bulk:
    build:
      context: .
      dockerfile: Dockerfile.bulk
      args:
        VERSION: "2.0.2"
    image: ai-disclosure-standard-bulk:2.0.2
    environment:
      BASE_URL: "${BULK_BASE_URL:-http://bulk:8080}"
      OUTPUT_BASE_URL: "${BASE_URL:?set BASE_URL}"
      DEFAULT_LANGUAGE: "${DEFAULT_LANGUAGE:-de}"
      SERVICE_MODE: bulk
      API_ALLOWED_ORIGIN: "${BULK_ALLOWED_ORIGIN:-}"
      LICENSE_TOKEN_FILE: /run/secrets/license_token
      LICENSE_MODE: "${LICENSE_MODE:-hybrid}"
      LICENSE_SERVER_URL: "${LICENSE_SERVER_URL:-}"
      LICENSE_INSTANCE_ID: "${BULK_INSTANCE_ID:-commercial-bulk}"
      LICENSE_CACHE_FILE: /data/license-lease.json
      REQUIRE_LICENSE: "true"
      BULK_REQUIRE_API_KEY: "true"
      BULK_API_KEY_FILE: /run/secrets/bulk_api_key
      BULK_MAX_ITEMS: "${BULK_MAX_ITEMS:-500}"
      BULK_MAX_BODY_BYTES: "${BULK_MAX_BODY_BYTES:-4194304}"
    secrets:
      - license_token
      - bulk_api_key
    volumes:
      - bulk-license-cache:/data
    # Keep this private in production; the loopback mapping is for local operators.
    ports:
      - "127.0.0.1:8081:8080"
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "/ai-disclosure", "--healthcheck"]
      interval: 15s
      timeout: 3s
      retries: 3
      start_period: 5s

secrets:
  license_token:
    file: ./secrets/license_token.txt
  bulk_api_key:
    file: ./secrets/bulk_api_key.txt

volumes:
  app-license-cache:
  bulk-license-cache: