services:
  api:
    build:
      context: ./apps/api
      dockerfile: Dockerfile
    image: prospect-platform-api:local
    environment:
      APP_ENV: ${APP_ENV:-development}
      API_HOST: 0.0.0.0
      API_PORT: 8000
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:8080}
      SESSION_SECRET: ${SESSION_SECRET:-}
      DATA_DIR: /data
      # Optional first-run admin bootstrap; leave unset after provisioning.
      BOOTSTRAP_ADMIN_EMAIL: ${BOOTSTRAP_ADMIN_EMAIL:-}
      BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD:-}
      AI_RESEARCH_PROVIDER: ${AI_RESEARCH_PROVIDER:-}
      AI_RESEARCH_PROVIDER_MODEL: ${AI_RESEARCH_PROVIDER_MODEL:-}
      AI_RESEARCH_PROVIDER_URL: ${AI_RESEARCH_PROVIDER_URL:-}
      AI_RESEARCH_PROVIDER_ALLOWED_HOSTS: ${AI_RESEARCH_PROVIDER_ALLOWED_HOSTS:-}
      AI_RESEARCH_PROVIDER_API_KEY: ${AI_RESEARCH_PROVIDER_API_KEY:-}
      # Native Nous Portal tool-calling research (server-side secrets only).
      NOUS_API_KEY: ${NOUS_API_KEY:-}
      NOUS_MODEL: ${NOUS_MODEL:-Hermes-4-405B}
      NOUS_BASE_URL: ${NOUS_BASE_URL:-https://inference-api.nousresearch.com/v1}
      NOUS_ALLOWED_HOSTS: ${NOUS_ALLOWED_HOSTS:-inference-api.nousresearch.com}
      FIRECRAWL_API_KEY: ${FIRECRAWL_API_KEY:-}
      FIRECRAWL_BASE_URL: ${FIRECRAWL_BASE_URL:-https://api.firecrawl.dev/v1}
      FIRECRAWL_ALLOWED_HOSTS: ${FIRECRAWL_ALLOWED_HOSTS:-api.firecrawl.dev}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      # Deprecated migration-only generic search adapter.
      SEARCH_PROVIDER_URL: ${SEARCH_PROVIDER_URL:-}
      SEARCH_PROVIDER_ALLOWED_HOSTS: ${SEARCH_PROVIDER_ALLOWED_HOSTS:-}
      SEARCH_PROVIDER_API_KEY: ${SEARCH_PROVIDER_API_KEY:-}
      AUTOMATED_OUTREACH_ENABLED: "false"
    volumes:
      - prospect_api_data:/data
    read_only: true
    init: true
    pids_limit: 128
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/v1/health/ready', timeout=2)"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 5s
    restart: unless-stopped

  web:
    build:
      context: ./apps/web
      dockerfile: Dockerfile
    image: prospect-platform-web:local
    environment:
      API_UPSTREAM_HOST: api
      API_UPSTREAM_PORT: "8000"
      AUTOMATED_OUTREACH_ENABLED: "false"
    ports:
      - "${WEB_PORT:-8080}:8080"
    read_only: true
    init: true
    pids_limit: 128
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 3s
    restart: unless-stopped

volumes:
  prospect_api_data:
    name: prospect-platform-api-data