services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VERSION: "2.0.2"
    image: ai-disclosure-standard:2.0.2-local
    environment:
      BASE_URL: "${BASE_URL:-http://localhost:8080}"
      PUBLIC_NAME: "${PUBLIC_NAME:-AI Usage Disclosure}"
      CONTACT_URL: "${CONTACT_URL:-https://b1tsblog.org/page/ai}"
      DEFAULT_LANGUAGE: "${DEFAULT_LANGUAGE:-de}"
      TRUST_PROXY: "${TRUST_PROXY:-false}"
      SERVICE_MODE: "${SERVICE_MODE:-full}"
      API_ALLOWED_ORIGIN: "${API_ALLOWED_ORIGIN:-*}"
      LICENSE_TOKEN: "${LICENSE_TOKEN:-}"
      LICENSE_MODE: "${LICENSE_MODE:-offline}"
      LICENSE_SERVER_URL: "${LICENSE_SERVER_URL:-}"
      LICENSE_INSTANCE_ID: "${LICENSE_INSTANCE_ID:-}"
      LICENSE_CACHE_FILE: /data/license-lease.json
      LICENSE_REFRESH_INTERVAL: "${LICENSE_REFRESH_INTERVAL:-15m}"
      LICENSE_REQUEST_TIMEOUT: "${LICENSE_REQUEST_TIMEOUT:-5s}"
      REQUIRE_LICENSE: "${REQUIRE_LICENSE:-false}"
      WHITE_LABEL: "${WHITE_LABEL:-false}"
      BULK_MAX_ITEMS: "${BULK_MAX_ITEMS:-500}"
      BULK_MAX_BODY_BYTES: "${BULK_MAX_BODY_BYTES:-4194304}"
      BULK_REQUIRE_API_KEY: "${BULK_REQUIRE_API_KEY:-false}"
      BULK_API_KEY: "${BULK_API_KEY:-}"
    ports:
      - "8080:8080"
    volumes:
      - license-cache:/data
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "/ai-disclosure", "--healthcheck"]
      interval: 15s
      timeout: 3s
      retries: 3
      start_period: 5s

volumes:
  license-cache: