# ============================================================
# NSCT — docker-compose.yml
# Services: nsct-api, postgres, optional searxng
# ============================================================

x-common: &common
  env_file:
    - .env
  restart: unless-stopped
  security_opt:
    - no-new-privileges:true
  deploy:
    resources:
      limits:
        memory: 1G
        cpus: "1.0"
      reservations:
        memory: 256M
        cpus: "0.25"

services:
  # ---------- PostgreSQL ----------
  postgres:
    image: postgres:16-alpine
    container_name: nsct-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-nsct}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-nsct_secret}
      POSTGRES_DB: ${POSTGRES_DB:-nsct}
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-nsct} -d ${POSTGRES_DB:-nsct}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"

  # ---------- SearXNG (optional) ----------
  searxng:
    image: searxng/searxng:latest
    container_name: nsct-searxng
    ports:
      - "8888:8080"
    volumes:
      - searxng_cache:/var/cache/searxng
      - ./config/searxng/settings.yml:/etc/searxng/settings.yml:ro
    environment:
      - SEARXNG_BASE_URL=http://localhost:8888/
      - SEARXNG_SECRET=nsct_searxng_secret_key_change_me
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL

  # ---------- NSCT API ----------
  nsct-api:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: nsct-api
    <<: *common
    ports:
      - "8080:8080"
    environment:
      NSCT_DB_URL: postgresql+asyncpg://${POSTGRES_USER:-nsct}:${POSTGRES_PASSWORD:-nsct_secret}@postgres:5432/${POSTGRES_DB:-nsct}
      NSCT_LLM_MAX_CONCURRENCY: "${NSCT_LLM_MAX_CONCURRENCY:-3}"
      NSCT_SEARXNG_BASE_URL: http://searxng:8080/
      # The default SearXNG engine set is often rate-limited.  Operators can
      # override this comma-separated list in their environment.
      NSCT_SEARXNG_ENGINES: "${NSCT_SEARXNG_ENGINES:-bing,yahoo}"
    depends_on:
      postgres:
        condition: service_healthy
      searxng:
        condition: service_started
    volumes:
      - nsct_data:/app/data
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8080/health')\" || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL

volumes:
  postgres_data:
    driver: local
  nsct_data:
    driver: local
  searxng_cache:
    driver: local