services:
  api:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        # Non-secret build setting. Override when this host cannot reach the
        # official proxy; keep Go's checksum verification enabled.
        GOPROXY: "${FIRE_SAFETY_BUILD_GOPROXY:-https://proxy.golang.org,direct}"
    image: fire-safety-ymd:test
    container_name: fire-safety-ymd
    restart: unless-stopped
    env_file:
      - .env
    environment:
      # The host binding below keeps this port private; the process must bind
      # all container interfaces for Docker's loopback publish to work.
      FIRE_SAFETY_HTTP_ADDR: ":8080"
      # Explicitly preserve the default-off public test page boundary. The
      # value may be enabled through the deployment's uncommitted .env file.
      FIRE_SAFETY_CHAT_PAGE_ENABLED: "${FIRE_SAFETY_CHAT_PAGE_ENABLED:-false}"
      # This setting is consumed only while resolving the build arg above.
      # Do not retain the selected proxy URL in the runtime environment.
      FIRE_SAFETY_BUILD_GOPROXY: ""
      # A one-off owner/migration credential must never enter the long-lived
      # application container, even if an operator left it in the local file.
      FIRE_SAFETY_POSTGIS_MIGRATION_DSN: ""
      TZ: Asia/Shanghai
    ports:
      - "127.0.0.1:16587:8080"
    extra_hosts:
      # Use host.docker.internal in the DSN only when PostgreSQL runs on this
      # same host; a remote/private database hostname is preferred otherwise.
      - "host.docker.internal:host-gateway"
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/health"]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 10s
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    pids_limit: 256
    stop_grace_period: 20s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"