services:
  bookish:
    build:
      context: .
      args:
        # Riproducibilita (R4b): sha256 di requirements.lock. Default = hash
        # corrente; in dev puoi sovrascriverlo con REQUIREMENTS_CHECKSUM=""
        REQUIREMENTS_CHECKSUM: ${REQUIREMENTS_CHECKSUM:-d13e4fb14a909e0bd06d20894860152d5334aa341dd9dec2e5e4ca368a0d2a62}
    image: bookish:local
    ports:
      - "${PORT:-5000}:5000"
    environment:
      BOOKISH_SECRET: ${BOOKISH_SECRET:?Copia .env.example in .env e imposta BOOKISH_SECRET}
      BOOKISH_DATA_DIR: /data
      BOOKISH_DEBUG: "false"
      BOOKISH_CLEANUP_HOURS: ${BOOKISH_CLEANUP_HOURS:-1}
      # Sicurezza opzionale
      BOOKISH_AUTH_USERNAME: ${BOOKISH_AUTH_USERNAME:-}
      BOOKISH_AUTH_PASSWORD: ${BOOKISH_AUTH_PASSWORD:-}
      BOOKISH_RATE_LIMIT_UPLOAD: ${BOOKISH_RATE_LIMIT_UPLOAD:-20}
      # Osservabilità: "json" = logging strutturato (1 riga JSON per log)
      LOG_FORMAT: ${LOG_FORMAT:-}
      # Timeout conversioni (s); default 300 — alza per libri lunghi
      BOOKISH_CONVERSION_TIMEOUT: ${BOOKISH_CONVERSION_TIMEOUT:-300}
      PORT: "5000"
    volumes:
      - bookish-data:/data
    restart: unless-stopped
    mem_limit: 1g
    cpus: "1.0"
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp
    stop_grace_period: 30s

volumes:
  bookish-data: