services:
  cloak:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
    image: didi-ai/cloak:latest
    container_name: didiAI-cloak
    restart: unless-stopped
    networks:
      - didi-network
    environment:
      CLOAK_HOST: 0.0.0.0
      CLOAK_PORT: 8770
      CLOAK_POOL_SIZE: ${CLOAK_POOL_SIZE:-3}
      CLOAK_SEARCH_TIMEOUT_SEC: ${CLOAK_SEARCH_TIMEOUT_SEC:-20}
      CLOAK_PAGE_TIMEOUT_MS: ${CLOAK_PAGE_TIMEOUT_MS:-18000}
      CLOAK_MAX_ENGINES: ${CLOAK_MAX_ENGINES:-3}
      CLOAK_MAX_QUERIES: ${CLOAK_MAX_QUERIES:-5}
      CLOAK_DEFAULT_MAX_RESULTS: ${CLOAK_DEFAULT_MAX_RESULTS:-10}
      CLOAK_MAX_RESULTS_CAP: ${CLOAK_MAX_RESULTS_CAP:-30}
      CLOAK_ENGINE_MIN_INTERVAL_MS: ${CLOAK_ENGINE_MIN_INTERVAL_MS:-200}
      CLOAK_HUMANIZE: ${CLOAK_HUMANIZE:-false}
      CLOAK_AUTH_TOKEN: ${CLOAK_AUTH_TOKEN:-}
      CLOAK_LOG_LEVEL: ${CLOAK_LOG_LEVEL:-INFO}
      DISPLAY: ":99"
    # Bind only to localhost on the host — intra-cluster access via DNS name
    # `didiAI-cloak` on didi-network. Public exposure is undesirable (scraping
    # endpoint should never be reachable from the internet).
    ports:
      - "127.0.0.1:8770:8770"
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request,sys; r=urllib.request.urlopen('http://127.0.0.1:8770/health', timeout=3); sys.exit(0 if r.status==200 else 1)\""]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s

networks:
  didi-network:
    external: true