name: books

services:
  books:
    build: .
    image: books:local
    container_name: books
    restart: unless-stopped
    # только localhost: снаружи — через nginx (books.ruzzy.dev, TLS)
    ports:
      - "127.0.0.1:3010:8000"
    # TG_BOT_TOKEN, TG_BOT_NAME, ALLOWED_TG_IDS, SESSION_SECRET, CLAUDE_CODE_OAUTH_TOKEN — только на сервере
    env_file: .env
    volumes:
      # books.db, файлы книг (files/), модель эмбеддингов (models/), конфиг Claude Code (claude/)
      - ./data:/data
    security_opt:
      - no-new-privileges:true
    cap_drop: [ALL]
    mem_limit: 4g
    cpus: 4
    pids_limit: 512
    logging:
      driver: json-file
      options: {max-size: "10m", max-file: "3"}