services:
  gateway:
    build: .
    command: ["-config", "/etc/ollama-gateway/config.json"]
    ports:
      - "${GATEWAY_PUBLISH_ADDRESS:-127.0.0.1}:${GATEWAY_PUBLISH_PORT:-9080}:8080"
    volumes:
      - ${GATEWAY_CONFIG:?set GATEWAY_CONFIG to the production bootstrap JSON}:/etc/ollama-gateway/config.json:ro
      - gateway-data:/data
    user: "65532:65532"
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "/ollama-gateway", "-probe", "http://127.0.0.1:8080/healthz", "-probe-timeout", "2s"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    restart: unless-stopped

volumes:
  gateway-data: