services:
  audit-hardening-tool:
    image: audit-hardening-tool:latest
    build: .
    container_name: audit-hardening-tool

    # Host network: container shares host's network stack
    # Required for RADIUS server connectivity (UDP to internal network)
    network_mode: host

    # App accessible at: http://server:8888/audit/
    command: >
      uvicorn web_app_fastapi:app
      --host 0.0.0.0
      --port 8888
      --proxy-headers
      --forwarded-allow-ips *
      --root-path /audit

    volumes:
      # Application source code (mounted from host for easy updates)
      - ./app:/app

      # Config files (read-only) - mounted from host
      - ./config:/app/config:ro
      - ./keys:/app/keys:ro
      - ./users_config.json:/app/users_config.json
      - ./radius_config.json:/app/radius_config.json:ro
      - ./email_config.json:/app/email_config.json:ro
      - ./sso_config.json:/app/sso_config.json:ro
      - ./unit_mapping.json:/app/unit_mapping.json

      # Tools directory (read-write for admin upload)
      - ./tools:/app/tools
      - ./docs:/app/docs

      # Data directories (read-write)
      - ./uploads:/app/uploads
      - ./output:/app/output

    environment:
      - TZ=Asia/Ho_Chi_Minh
      - PYTHONUNBUFFERED=1

    restart: unless-stopped

    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"