services:
  api:
    build: .
    env_file:
      - .env
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/health').then((r) => { if (!r.ok) process.exit(1); }).catch(() => process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    ports:
      - "${PORT:-3000}:3000"
    environment:
      PORT: 3000
      API_KEY: ${API_KEY:-}
      ALLOWED_GIT_HOSTS: ${ALLOWED_GIT_HOSTS:-}
      CACHE_TTL_MINUTES: ${CACHE_TTL_MINUTES:-5}
      CACHE_SWEEP_INTERVAL_MINUTES: ${CACHE_SWEEP_INTERVAL_MINUTES:-5}
      RATE_LIMIT_WINDOW_MINUTES: ${RATE_LIMIT_WINDOW_MINUTES:-5}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-30}
      MAX_CONCURRENT_SCANS: ${MAX_CONCURRENT_SCANS:-4}
      MAX_FILES_PER_SCAN: ${MAX_FILES_PER_SCAN:-20000}
      MAX_FILE_SIZE_MB: ${MAX_FILE_SIZE_MB:-5}
      MAX_SCAN_SIZE_MB: ${MAX_SCAN_SIZE_MB:-100}
      CLONE_TIMEOUT_SECONDS: ${CLONE_TIMEOUT_SECONDS:-45}
      DEFAULT_SSH_KEY_NAME: ${DEFAULT_SSH_KEY_NAME:-loc_via_git_ed25519}
      GENERATE_SSH_KEY_IF_MISSING: ${GENERATE_SSH_KEY_IF_MISSING:-false}
      TRUST_PROXY: ${TRUST_PROXY:-false}
      SSH_KEYS_DIR: /app/keys
      TMP_DIR: /tmp/loc-via-git
    volumes:
      - ssh_keys:/app/keys
    tmpfs:
      - /tmp/loc-via-git:size=${TMPFS_SIZE:-512m},mode=1777
    restart: unless-stopped

volumes:
  ssh_keys: