services:
  kb-query:
    build:
      # Repo-root context (not the usual `.` = this dir) so the Dockerfile can
      # `COPY packages/kb-retrieval/` — the packages/ Dockerfile convention from
      # CLAUDE.md. scripts/deploy/deploy.sh's gate and deploy-node.sh's
      # `docker compose ... up --build` both resolve this the same way.
      context: ../..
      dockerfile: services/kb-query/Dockerfile
    container_name: kb-query
    restart: unless-stopped
    ports:
      # LAN-only bind, never 0.0.0.0 — same convention as paperless/nextcloud
      # (exposure: private). npm@PIHA vhost + OIDC are a later step (plan §8);
      # this bind is what that vhost will eventually proxy to.
      # Requires .env (from env.example) next to this file at deploy.
      - "${LAN_BIND_IP}:8230:8080"
    environment:
      - KB_DSN=${KB_DSN}
      # Embed backends (Krok 2, aktywny fallback — app/embed_router.py): primary is
      # Ollama @ SOLARIA (GPU, duty-cycled), fallback is ollama-piha on this host
      # (CPU, OLLAMA_KEEP_ALIVE=0). Empty EMBED_FALLBACK_URL disables the fallback
      # leg (pre-Krok-2 behaviour: /search 503s while SOLARIA sleeps).
      - EMBED_PRIMARY_URL=${EMBED_PRIMARY_URL:-http://solaria:11434}
      - EMBED_FALLBACK_URL=${EMBED_FALLBACK_URL:-}
      - EMBED_PRIMARY_NAME=${EMBED_PRIMARY_NAME:-solaria}
      - EMBED_FALLBACK_NAME=${EMBED_FALLBACK_NAME:-piha}
      - EMBED_HEALTH_TTL_S=${EMBED_HEALTH_TTL_S:-30}
      - EMBED_HEALTH_TIMEOUT_S=${EMBED_HEALTH_TIMEOUT_S:-1.5}
      - EMBED_PRIMARY_TIMEOUT_S=${EMBED_PRIMARY_TIMEOUT_S:-3}
      - EMBED_MODEL=${EMBED_MODEL:-bge-m3}
      - SUMMARY_MODEL=${SUMMARY_MODEL:-claude-haiku-4-5}
    # python:3.12-slim has no curl/wget; same in-container check pattern as llm-gateway.
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=3).read()"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s