services:
  magent:
    # Select a published immutable release tag or digest in .env.
    image: ${MAGENT_IMAGE:?Set MAGENT_IMAGE to a published release tag or digest}
    env_file:
      - ./.env
    environment:
      JWT_SECRET: ${JWT_SECRET:?Generate an independent JWT_SECRET before starting}
      SETTINGS_ENCRYPTION_KEY: ${SETTINGS_ENCRYPTION_KEY:?Set the original or newly generated Fernet key}
      CORS_ALLOW_ORIGIN: ${CORS_ALLOW_ORIGIN:?Set the exact browser-facing origin}
      MAGENT_APPLICATION_URL: ${MAGENT_APPLICATION_URL:?Set the browser-facing application URL}
    ports:
      # Keep the API internal; the frontend serves /api on this same port.
      - "${MAGENT_BIND_ADDRESS:-127.0.0.1}:${MAGENT_HTTP_PORT:-3000}:3000"
    volumes:
      # Fresh installs only: existing installs must retain their original mount.
      - magent-data:/app/data
    restart: unless-stopped
    stop_grace_period: 30s
    read_only: true
    cap_drop: ["ALL"]
    security_opt: ["no-new-privileges:true"]
    init: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000
      - /app/frontend/.next/cache:rw,noexec,nosuid,size=128m,uid=1000,gid=1000

volumes:
  magent-data: