docker-compose.yml

services:
  app:
    image: ghcr.io/oidatiftla/calendar-proxy:latest
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    ports:
      - 8000:8000

    # For development - mount source for live reload (uncomment if needed)
    # volumes:
    #   - ./src:/app:ro

    environment:
      # Required settings
      - PROXY_TOKENS=test-token-123,test-token-456

      # Optional settings for testing
      - ALLOWED_HOSTS=outlook.office365.com,calendar.google.com
      - RATE_LIMIT_PER_MIN=60
      - UPSTREAM_USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15
      - MAX_RESPONSE_BYTES=10485760
      - CONNECT_TIMEOUT=10
      - READ_TIMEOUT=30
      - ALLOWED_CONTENT_TYPES=text/calendar,text/plain,text/html,application/octet-stream

      # Logging settings
      - LOG_LEVEL=DEBUG  # Options: DEBUG, INFO, WARNING, ERROR
      - DISABLE_ACCESS_LOG=false  # Set to 'true' to disable uvicorn access logs entirely

    # Security hardening
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

    # Resource limits
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '0.5'

    # Temporary filesystems for read-only container
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
      - /var/tmp:noexec,nosuid,size=50m

    # Health check
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/healthz"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 5s

# Optional: Redis for rate limiting in production
# Uncomment if you want to test with Redis
#  redis:
#    image: redis:7-alpine
#    ports:
#      - "6379:6379"
#    command: redis-server --appendonly yes
#    volumes:
#      - redis_data:/data
#    restart: unless-stopped

# volumes:
#   redis_data: