services:
  dav-mcp:
    build: .
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    ports:
      - "${MCP_BIND_ADDRESS:-127.0.0.1}:${MCP_HOST_PORT:-8000}:8000"
    environment:
      WEBDAV_URL: ${WEBDAV_URL:-https://dav.ryankegel.com}
      WEBDAV_ROOT: ${WEBDAV_ROOT:-/Notes/Personal}
      WEBDAV_USERNAME: ${WEBDAV_USERNAME:?Set WEBDAV_USERNAME in .env}
      WEBDAV_PASSWORD_FILE: /run/secrets/webdav_password
      MCP_PUBLIC_URL: ${MCP_PUBLIC_URL:?Set MCP_PUBLIC_URL in .env}
      MCP_ALLOWED_HOSTS: ${MCP_ALLOWED_HOSTS:?Set MCP_ALLOWED_HOSTS in .env}
      MCP_ALLOWED_ORIGINS: ${MCP_ALLOWED_ORIGINS:-}
      MCP_AUTH_USERNAME: ${MCP_AUTH_USERNAME:?Set MCP_AUTH_USERNAME in .env}
      MCP_AUTH_PASSWORD_FILE: /run/secrets/mcp_auth_password
      MCP_READ_ONLY: ${MCP_READ_ONLY:-true}
      OAUTH_DATABASE_PATH: /data/oauth.sqlite3
    secrets:
      - webdav_password
      - mcp_auth_password
    volumes:
      - oauth-data:/data
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=2).read()"
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

secrets:
  webdav_password:
    file: ./secrets/webdav_password
  mcp_auth_password:
    file: ./secrets/mcp_auth_password

volumes:
  oauth-data: