services:
  sigil-bot:
    build: .
    container_name: sigil-bot
    restart: unless-stopped
    env_file:
      - secrets.env
    environment:
      TZ: Australia/Adelaide
      SIGIL_MODE: draft
      SIGIL_DATA_DIR: /app/data
      SIGIL_LOG_DIR: /app/data/logs
      SIGIL_CONFIG_DIR: /app/config
      PYTHONPATH: /app
      SMTP_HOST: ancillary-vm
      SMTP_PORT: "25"
      EMAIL_TO: ###_EMAIL
      EMAIL_FROM: ###_EMAIL
    volumes:
      - sigil-data:/app/data
      - ./kill-switch:/host/kill-switch:ro
    ports:
      - "8080:8080"
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
    ulimits:
      nofile:
        soft: 65536
        hard: 65536

  pump-ttl-worker:
    build: ./pump-ttl-worker
    container_name: pump-ttl-worker
    restart: unless-stopped
    env_file:
      - secrets-ttl-worker.env
    environment:
      TZ: Australia/Adelaide
      SIGIL_HEARTBEAT_PATH: /app/data/bot_heartbeat
      KILL_SWITCH_PATH: /host/kill-switch/kill_switch.flag
      PYTHONPATH: /app
    volumes:
      - sigil-data:/app/data
      - ./kill-switch:/host/kill-switch:ro
    depends_on:
      sigil-bot:
        condition: service_healthy
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  micro-scanner:
    build: ./micro-scanner
    container_name: micro-scanner
    restart: unless-stopped
    env_file:
      - secrets-micro.env
    environment:
      TZ: Australia/Adelaide
      SIGIL_MODE: draft
      SIGIL_DATA_DIR: /app/data
      MICRO_CONFIG_PATH: /app/config/micro.yaml
      KILL_SWITCH_PATH: /host/kill-switch/kill_switch.flag
    volumes:
      - sigil-data:/app/data
      - ./config:/app/config:ro
      - ./kill-switch:/host/kill-switch:ro
    depends_on:
      sigil-bot:
        condition: service_healthy
    # NO ports published — bind ###_IP internally (SEC-1 fix)
    healthcheck:
      test:
        - "CMD"
        - "python"
        - "-c"
        - >-
          import urllib.request;
          urllib.request.urlopen('http://###_IP:8081/health/ready')
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    security_opt:
      - "no-new-privileges:true"
    ulimits:
      nofile:
        soft: 8192
        hard: 8192
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"

volumes:
  sigil-data:
    driver: local
