# 2dph — docker composition
#
#   docker compose run --rm brain index                     # rebuild graph
#   docker compose run --rm brain search "Matrix fed"       # one-shot query
#   docker compose run --rm brain serve                     # async Go server
#   docker compose up brain-watch                           # auto re-index
#
# Caching: the 128M model (HF_HOME) and kb.lbug (VAR_DIR) live in named
# volumes, so rebuilds never redownload the model or re-derive the graph.
# Secrets are never baked into the image: search.env + db-profiles.yml mount
# read-only from ~/.config/brain.

name: 2dph

services:
  brain:
    image: ghcr.io/eslider/2dph:latest
    build:
      context: .
      dockerfile: Dockerfile
      cache_from:
        - ghcr.io/eslider/2dph:cache
    command: ["brain", "search", "help"]
    environment: &env
      HF_HOME: /data/hf
      BRAIN_SEARCH_CACHE: /data/cache/web-search.sqlite
      BRAIN_DB_PROFILES: /secret/db-profiles.yml
      BRAIN_SEARCH_ENV: /secret/search.env
      KB_SEARCH_CMD: /app/bin/kb/search
      KB_WORKERS: "4"
    volumes:
      - kb-model:/data/hf
      - kb-var:/data
      # corpus is read-only on the host, never written from the container
      - ..:/corpus:ro
      - ~/.config/brain:/secret:ro
    read_only: true
    tmpfs:
      - /tmp
    healthcheck:
      test: ["CMD", "python3", "-c", "import ladybug, model2vec, mistune; print('ok')"]
      interval: 30s
      timeout: 5s
      retries: 3
    restart: unless-stopped
    stop_grace_period: 20s

  # watcher: re-index on corpus file change (watchdog script)
  brain-watch:
    image: ghcr.io/eslider/2dph:latest
    environment: *env
    volumes:
      - kb-model:/data/hf
      - kb-var:/data
      - ..:/corpus:ro
      - ~/.config/brain:/secret:ro
    command: ["brain", "watch", "/corpus"]
    read_only: true
    tmpfs:
      - /tmp
    restart: unless-stopped
    stop_grace_period: 20s

  # Optional local SearXNG (D3). Skip if BRAIN_SEARCH_URL already points at a
  # live instance — do not run a second copy on that host.
  #   SEARXNG_SECRET=$(openssl rand -hex 32) docker compose --profile searxng up -d
  searxng:
    profiles: ["searxng"]
    image: docker.io/searxng/searxng:2026.8.10-0a118066d
    ports:
      - "127.0.0.1:8888:8080"
    environment:
      SEARXNG_SECRET: ${SEARXNG_SECRET:-}
    volumes:
      - ./deploy/searxng/settings.yml:/etc/searxng/settings.yml:ro
      - ./deploy/searxng/limiter.toml:/etc/searxng/limiter.toml:ro
    restart: unless-stopped

volumes:
  kb-model:
  kb-var: