services:
  web:
    build:
      context: .
    image: ${APP_IMAGE:-xiaobai-review-next:local}
    init: true
    restart: unless-stopped
    ports:
      - "${APP_PUBLISH_PORT:-8876}:8765"
    environment:
      APP_ENV: production
      APP_HOST: 0.0.0.0
      APP_PORT: 8765
      APP_DATA_DIR: /app/data
      APP_DATABASE_PATH: /app/data/xiaobai.db
      APP_PRIVATE_MENTOR_SKILLS_DIR: /app/data/private-mentor-skills
      APP_ENCRYPTION_KEY: ${APP_ENCRYPTION_KEY:?APP_ENCRYPTION_KEY must be set}
      APP_LOG_LEVEL: ${APP_LOG_LEVEL:-INFO}
      APP_TIMEZONE: ${APP_TIMEZONE:-Asia/Shanghai}
    volumes:
      - ${APP_STORAGE_PATH:-./data}:/app/data
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    stop_grace_period: 30s