name: knowledge-adapter

services:
  adapter:
    image: "knowledge-adapter-service:${ADAPTER_IMAGE_TAG:-local}"
    build:
      context: ..
      dockerfile: Dockerfile
    user: "10001:10001"
    init: true
    restart: unless-stopped
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 256
    mem_limit: 1g
    cpus: 2.0
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=64m
    ports:
      - "127.0.0.1:18080:8080"
    environment:
      DIFY_KEY_HASH_CURRENT: "${DIFY_KEY_HASH_CURRENT:?set DIFY_KEY_HASH_CURRENT}"
      DIFY_KEY_HASH_NEXT: "${DIFY_KEY_HASH_NEXT:-}"
      WEKNORA_BASE_URL: "${WEKNORA_BASE_URL:?set WEKNORA_BASE_URL}"
      WEKNORA_API_KEY_FILE: /run/secrets/weknora_api_key
      WEKNORA_ALLOWED_KB_IDS: "${WEKNORA_ALLOWED_KB_IDS:?set WEKNORA_ALLOWED_KB_IDS}"
      WEKNORA_TENANT_ID: "${WEKNORA_TENANT_ID:?set WEKNORA_TENANT_ID}"
      WEKNORA_OSS_STORAGE_BACKEND_ID: "${WEKNORA_OSS_STORAGE_BACKEND_ID:?set WEKNORA_OSS_STORAGE_BACKEND_ID}"
      OSS_REGION: "${OSS_REGION:?set OSS_REGION}"
      OSS_BUCKET: "${OSS_BUCKET:?set OSS_BUCKET}"
      OSS_CREDENTIAL_MODE: "${OSS_CREDENTIAL_MODE:-static_ak}"
      OSS_RAM_ROLE_NAME: "${OSS_RAM_ROLE_NAME:-}"
      OSS_ACCESS_KEY_ID_FILE: /run/secrets/oss_access_key_id
      OSS_ACCESS_KEY_SECRET_FILE: /run/secrets/oss_access_key_secret
      ASSET_PUBLIC_BASE_URL: "${ASSET_PUBLIC_BASE_URL:?set ASSET_PUBLIC_BASE_URL}"
      MAX_QUERY_CHARS: "${MAX_QUERY_CHARS:-2000}"
      MAX_TOP_K: "${MAX_TOP_K:-5}"
      MAX_CHUNK_CHARS: "${MAX_CHUNK_CHARS:-4000}"
      MAX_TOTAL_CHARS: "${MAX_TOTAL_CHARS:-12000}"
      WEKNORA_TIMEOUT_SECONDS: "${WEKNORA_TIMEOUT_SECONDS:-15}"
      ASSET_DATABASE_URL_FILE: /run/secrets/asset_database_url
      WEKNORA_READONLY_DATABASE_URL_FILE: /run/secrets/weknora_readonly_database_url
    volumes:
      - type: bind
        source: "${WEKNORA_API_KEY_SECRET_FILE:?set WEKNORA_API_KEY_SECRET_FILE}"
        target: /run/secrets/weknora_api_key
        read_only: true
      - type: bind
        source: "${ASSET_DATABASE_URL_SECRET_FILE:?set ASSET_DATABASE_URL_SECRET_FILE}"
        target: /run/secrets/asset_database_url
        read_only: true
      - type: bind
        source: "${WEKNORA_READONLY_DATABASE_URL_SECRET_FILE:?set WEKNORA_READONLY_DATABASE_URL_SECRET_FILE}"
        target: /run/secrets/weknora_readonly_database_url
        read_only: true
      - type: bind
        source: "${OSS_ACCESS_KEY_ID_HOST_FILE:?set OSS_ACCESS_KEY_ID_HOST_FILE}"
        target: /run/secrets/oss_access_key_id
        read_only: true
      - type: bind
        source: "${OSS_ACCESS_KEY_SECRET_HOST_FILE:?set OSS_ACCESS_KEY_SECRET_HOST_FILE}"
        target: /run/secrets/oss_access_key_secret
        read_only: true
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2).read()"
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s
    stop_grace_period: 20s
    networks:
      - adapter
      - weknora_upstream

networks:
  adapter:
    driver: bridge
  weknora_upstream:
    external: true
    name: "${WEKNORA_NETWORK_NAME:?set WEKNORA_NETWORK_NAME}"