version: "3.9"
services:
  app:
    image: ghcr.io/REPLACE_ME/ai-disclosure-standard:2.0.2
    environment:
      BASE_URL: https://ai.example.org
      PUBLIC_NAME: AI Usage Disclosure
      CONTACT_URL: https://b1tsblog.org/page/ai
      DEFAULT_LANGUAGE: de
      TRUST_PROXY: "true"
      SERVICE_MODE: full
      API_ALLOWED_ORIGIN: "*"
      LICENSE_TOKEN: "${LICENSE_TOKEN:-}"
      LICENSE_MODE: "${LICENSE_MODE:-offline}"
      LICENSE_SERVER_URL: "${LICENSE_SERVER_URL:-}"
      LICENSE_INSTANCE_ID: "${LICENSE_INSTANCE_ID:-swarm}"
      LICENSE_CACHE_FILE: /data/license-lease.json
      WHITE_LABEL: "${WHITE_LABEL:-false}"
    ports:
      - target: 8080
        published: 8080
        protocol: tcp
        mode: ingress
    networks: [public]
    volumes:
      - license-cache:/data
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    cap_drop: [ALL]
    healthcheck:
      test: ["CMD", "/ai-disclosure", "--healthcheck"]
      interval: 15s
      timeout: 3s
      retries: 3
      start_period: 5s
    deploy:
      mode: replicated
      replicas: 3
      endpoint_mode: vip
      update_config:
        parallelism: 1
        delay: 5s
        order: start-first
        failure_action: rollback
      rollback_config:
        parallelism: 1
        order: stop-first
      restart_policy:
        condition: on-failure
        delay: 3s
        max_attempts: 5
        window: 30s
      placement:
        preferences:
          - spread: node.labels.zone
      resources:
        reservations:
          cpus: "0.05"
          memory: 32M
        limits:
          cpus: "0.50"
          memory: 128M
networks:
  public:
    driver: overlay
    attachable: true
volumes:
  license-cache: