# 知識庫系統 V5 — PRD §35.2 安全選項
# read_only / cap_drop ALL / no-new-privileges / 寫入限定 mount + tmpfs

services:
  app:
    build: .
    image: kbv5:latest
    container_name: kbv5
    user: "1000:1000"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:size=64m
      - /home/kb:size=16m            # pip cache、user-level temp
    volumes:
      # MD 為事實來源（§6）— 必須可寫
      - ./vault:/app/vault
      # SQLite DB + history + PII centroids + AI 詞典等 — 必須可寫
      - ./data:/app/data
      # 前端靜態檔（mockup HTML 由映像帶入；如要熱替換可掛 ro）
      # - ./static:/app/static:ro
    ports:
      - "127.0.0.1:8000:8000"        # 預設綁本機；用 reverse proxy 對外
    environment:
      KBV5_ENV: prod
      KBV5_RATE_LIMIT: "1"
      KBV5_SEED: "1"
    env_file:
      - .env.prod                    # JWT_SECRET / AI 金鑰等敏感資料
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/healthz"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3