version: "3.9"
services:
  bulk:
    image: ghcr.io/REPLACE_ME/ai-disclosure-standard-bulk:2.0.2
    environment:
      BASE_URL: http://bulk:8080
      OUTPUT_BASE_URL: https://ai.example.org
      DEFAULT_LANGUAGE: de
      SERVICE_MODE: bulk
      API_ALLOWED_ORIGIN: ""
      LICENSE_TOKEN_FILE: /run/secrets/license_token
      LICENSE_MODE: "${LICENSE_MODE:-hybrid}"
      LICENSE_SERVER_URL: "${LICENSE_SERVER_URL:-https://licenses.example.org}"
      LICENSE_INSTANCE_ID: "${LICENSE_INSTANCE_ID:-swarm-bulk}"
      LICENSE_CACHE_FILE: /data/license-lease.json
      REQUIRE_LICENSE: "true"
      BULK_REQUIRE_API_KEY: "true"
      BULK_API_KEY_FILE: /run/secrets/bulk_api_key
      BULK_MAX_ITEMS: "${BULK_MAX_ITEMS:-500}"
      BULK_MAX_BODY_BYTES: "${BULK_MAX_BODY_BYTES:-4194304}"
    secrets:
      - license_token
      - bulk_api_key
    networks: [internal]
    volumes:
      - bulk-license-cache:/data
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    cap_drop: [ALL]
    healthcheck:
      test: ["CMD", "/ai-disclosure", "--healthcheck"]
      interval: 15s
      timeout: 3s
      retries: 3
      start_period: 5s
    deploy:
      replicas: 3
      update_config:
        order: start-first
        parallelism: 1
      restart_policy:
        condition: on-failure
      resources:
        reservations:
          cpus: "0.05"
          memory: 32M
        limits:
          cpus: "1.0"
          memory: 192M
secrets:
  license_token:
    external: true
  bulk_api_key:
    external: true
networks:
  internal:
    driver: overlay
    attachable: false
volumes:
  bulk-license-cache: