docker-compose.yml

# NeoImage2Pattern — local-first stack. Without any API key or GPU:
#   cp .env.example .env && docker compose up --build   ->  http://localhost:5173
# Ports are published on 127.0.0.1 only (never 0.0.0.0).
name: neoimage2pattern

services:
  api:
    build:
      context: .
      dockerfile: backend/Dockerfile
      args:
        GIT_COMMIT: ${GIT_COMMIT:-unknown}
    env_file:
      - path: .env
        required: false
    environment:
      DATA_DIR: /data
      ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,[::1],api}
      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:-http://localhost:5173,http://127.0.0.1:5173,http://localhost:8000,http://127.0.0.1:8000}
      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-http://host.docker.internal:11434}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - api-data:/data
    tmpfs:
      - /tmp
    read_only: true
    security_opt:
      - no-new-privileges:true
    ports:
      - "127.0.0.1:8000:8000"
    healthcheck:
      test: ["CMD", "python", "-c", "import sys,urllib.request; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=2).status == 200 else 1)"]
      interval: 10s
      timeout: 3s
      retries: 12

  web:
    build:
      context: .
      dockerfile: frontend/Dockerfile
    depends_on:
      api:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    ports:
      - "127.0.0.1:5173:80"

  # Optional local model server: OLLAMA_BASE_URL=http://ollama:11434 docker compose --profile ollama up
  ollama:
    image: ollama/ollama@sha256:265409e1d931028a8f7d5a32bcbafddd7bffbc6cc629d77efe9560adf692a5e7
    profiles: ["ollama"]
    volumes:
      - ollama-models:/root/.ollama
    ports:
      - "127.0.0.1:11434:11434"

  # Independent QA tools (Poppler). Not part of the user runtime: docker compose --profile qa run --rm qa
  qa:
    build:
      context: .
      dockerfile: qa/Dockerfile
    profiles: ["qa"]

volumes:
  api-data:
  ollama-models: