name: siteforge-release-agent
services:
  agent:
    build:
      context: .
      dockerfile: Dockerfile.enterprise
      args:
        SITEFORGE_GIT_SHA: ${SITEFORGE_GIT_SHA:-unknown}
    image: siteforge/web:8.21.0-dev.1
    command: ['python','-m','uvicorn','app.deploy_agent:app','--host','0.0.0.0','--port','8790']
    restart: unless-stopped
    environment:
      SITEFORGE_DEPLOY_SECRET: ${SITEFORGE_DEPLOY_SECRET:-}
      SITEFORGE_DEPLOY_SECRET_REF: ${SITEFORGE_DEPLOY_SECRET_REF:-}
      SITEFORGE_DEPLOY_ROOT: /srv/releases
    volumes:
      - releases:/srv/releases
    ports:
      - '127.0.0.1:8790:8790'
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: ['no-new-privileges:true']
volumes:
  releases: