services:
  monet4:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: monet4
    env_file:
      - .env
    environment:
      PORT: 5000
      FLASK_DEBUG: 0
      CHAT_DB_PATH: /app/data/chat.db
      CHAT_UPLOAD_DIR: /app/data/uploads
      CHAT_SECRET_KEY_PATH: /app/data/flask_secret.key
      CHAT_CLIENT_HASH_KEY_PATH: /app/data/client_hash.key
      SESSION_COOKIE_SECURE: 1
      TRUSTED_PROXY_HOPS: 1
      GUNICORN_CMD_ARGS: "--worker-tmp-dir /tmp"
      FLASK_SECRET_KEY: ${FLASK_SECRET_KEY:-}
      CHAT_CLIENT_HASH_KEY: ${CHAT_CLIENT_HASH_KEY:-}

      # VPS2 helper integration
      CALLS_BASE: ${CALLS_BASE:-https://calls.backend-3.com}
      CALL_HELPER_SHARED_SECRET: ${CALL_HELPER_SHARED_SECRET:-}
      CALL_TOKEN_TTL_SECONDS: ${CALL_TOKEN_TTL_SECONDS:-60}

    volumes:
      - chat_data:/app/data
    networks:
      - privatenet
    restart: unless-stopped
    # read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
      - /run/gunicorn:size=16m,mode=1777
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5000/api/csrf', timeout=5).read()"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    labels:
      caddy: money.backend-3.com
      caddy.reverse_proxy: "{{upstreams 5000}}"

volumes:
  chat_data:

networks:
  privatenet:
    external: true