version: "3.9"
services:
  app:
    image: ghcr.io/REPLACE_ME/ai-disclosure-standard:1.6.3
    environment:
      BASE_URL: https://ai.example.org
      PUBLIC_NAME: AI Usage Disclosure
      CONTACT_URL: https://b1tsblog.org/page/ai
      SALES_URL: "${SALES_URL:-https://b1tsblog.org/page/ai}"
      DEFAULT_LANGUAGE: de
      TRUST_PROXY: "false"
      LOG_CLIENT_IP: "false"
      ENABLE_HSTS: "true"
      METRICS_ENABLED: "false"
      LEGAL_STRICT: "${LEGAL_STRICT:-true}"
      LEGAL_NAME: "${LEGAL_NAME:-REPLACE_ME}"
      LEGAL_ADDRESS: "${LEGAL_ADDRESS:-REPLACE_ME}"
      LEGAL_EMAIL: "${LEGAL_EMAIL:-REPLACE_ME}"
      HOSTING_PROVIDER: "${HOSTING_PROVIDER:-REPLACE_ME}"
      LOG_RETENTION: "${LOG_RETENTION:-REPLACE_ME}"
      CONSUMER_DISPUTE_STATUS: "${CONSUMER_DISPUTE_STATUS:-REPLACE_ME}"
      LICENSE_TOKEN: "${LICENSE_TOKEN:-}"
      LICENSE_MODE: "${LICENSE_MODE:-offline}"
      LICENSE_SERVER_URL: "${LICENSE_SERVER_URL:-}"
      LICENSE_INSTANCE_ID: "${LICENSE_INSTANCE_ID:-swarm}"
      LICENSE_CACHE_FILE: /data/license-lease.json
    ports:
      - target: 8080
        published: 8080
        protocol: tcp
        mode: ingress
    networks:
      - public
    volumes:
      - license-cache:/data
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "/ai-disclosure", "--healthcheck"]
      interval: 15s
      timeout: 3s
      retries: 3
      start_period: 5s
    deploy:
      mode: replicated
      replicas: 3
      endpoint_mode: vip
      update_config:
        parallelism: 1
        delay: 5s
        order: start-first
        failure_action: rollback
      rollback_config:
        parallelism: 1
        order: stop-first
      restart_policy:
        condition: on-failure
        delay: 3s
        max_attempts: 5
        window: 30s
      placement:
        preferences:
          - spread: node.labels.zone
      resources:
        reservations:
          cpus: "0.05"
          memory: 24M
        limits:
          cpus: "0.50"
          memory: 128M
networks:
  public:
    driver: overlay
    attachable: true

volumes:
  license-cache: