services:
  ltx-deskweb:
    build: .
    image: ltx-deskweb:0.1.0
    restart: unless-stopped
    init: true
    user: "${WEB_UID:-1000}:${WEB_GID:-1000}"
    ports:
      - "${WEB_BIND_IP:-127.0.0.1}:${WEB_PORT:-8118}:8118"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      LTX_BACKEND_URL: "${LTX_BACKEND_URL:-http://host.docker.internal:8120}"
      WEB_PASSWORD_FILE: /run/secrets/web_password
      LTX_TOKEN_FILE: /run/secrets/ltx_token
      PUBLIC_ORIGIN: "${PUBLIC_ORIGIN:-http://127.0.0.1:8118}"
      LOCAL_INPUT_DIR: /data/inputs
      BACKEND_INPUT_DIR: "${BACKEND_INPUT_DIR:-/data/LTXDesktop/remote-inputs}"
      LOCAL_OUTPUT_DIR: /data/outputs
      BACKEND_OUTPUT_DIR: "${BACKEND_OUTPUT_DIR:-/data/LTXDesktop/outputs}"
    volumes:
      - "${LTX_INPUT_HOST_DIR:?Set shared LTX input directory}:/data/inputs"
      - "${LTX_OUTPUT_HOST_DIR:?Set LTX output directory}:/data/outputs:ro"
    secrets:
      - web_password
      - ltx_token
    read_only: true
    tmpfs:
      - /tmp:size=128m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    labels:
      io.athena-deck.managed: "true"
      io.athena-deck.role: application
      org.ltx-deskweb.role: frontend
      org.ltx-deskweb.backend: ltx-desktop
secrets:
  web_password:
    file: ./secrets/web-password
  ltx_token:
    file: ./secrets/ltx-token