name: cadworld-sim
services:
  decision:
    image: cadworld-decision:${CADWORLD_RELEASE:?release tag required}
    command:
      - --website-origin
      - https://cadworld-sim.robotquan.com
      - --bind
      - 0.0.0.0
      - --trusted-proxy
      - 172.30.88.1
      - --website-key-file
      - /run/secrets/model-keys.env
      - --website-budget-file
      - /var/lib/cadworld/budget.sqlite
      - --max-inference
      - '2'
    volumes:
      - /opt/cadworld-sim/secrets/model-keys.env:/run/secrets/model-keys.env:ro
      - /opt/cadworld-sim/budget:/var/lib/cadworld:rw
    ports:
      - '127.0.0.1:8768:8768'
    restart: unless-stopped
    init: true
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=268435456,mode=1777
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 2g
    cpus: 2
    pids_limit: 128
    stop_grace_period: 20s
    healthcheck:
      test:
        [
          CMD,
          python,
          -c,
          "import urllib.request; r=urllib.request.Request('http://127.0.0.1:8768/healthz',headers={'Host':'cadworld-sim.robotquan.com'}); urllib.request.urlopen(r,timeout=3).read()",
        ]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 15s
    logging:
      driver: json-file
      options: { max-size: 5m, max-file: '3' }
    networks: [cadworld]
  certbot:
    image: cadworld-certbot:locked
    profiles: [maintenance]
    volumes:
      - /opt/1panel/apps/openresty/openresty/www/acme/cadworld-sim.robotquan.com:/var/www/acme
      - /opt/1panel/apps/openresty/openresty/www/ssl/cadworld-sim.robotquan.com:/etc/letsencrypt
    tmpfs:
      - /var/lib/letsencrypt
      - /var/log/letsencrypt
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    networks: [cadworld]
networks:
  cadworld:
    ipam:
      config:
        - subnet: 172.30.88.0/24
          gateway: 172.30.88.1