services:
  llm-gateway:
    build: .
    container_name: llm-gateway
    restart: unless-stopped
    ports:
      # tailscale-internal: the listen socket is bound ONLY to the node's
      # Tailscale interface IP (TAILSCALE_BIND_IP), never 0.0.0.0 — same
      # convention as fleet-prometheus. Reachability is enforced in the bind
      # itself; consumers reach it as http://piha:8080 over the mesh.
      # Requires .env (from env.example) next to this file at deploy.
      - "${TAILSCALE_BIND_IP}:8080:8080"
    environment:
      # Ollama upstream on SOLARIA; "solaria" resolves via the host's
      # Tailscale MagicDNS, forwarded by Docker's embedded DNS.
      - OLLAMA_URL=${OLLAMA_URL:-http://solaria:11434/api/generate}
    # python:3.12-slim has no curl/wget, but it does have python — same
    # in-container check pattern as control-plane.
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/', timeout=3).read()"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s