services:
  lightrag:
    image: ghcr.io/hkuds/lightrag:latest
    build:
      context: .
      dockerfile: Dockerfile
      tags:
        - ghcr.io/hkuds/lightrag:latest
    ports:
      - "${HOST:-0.0.0.0}:${PORT:-9621}:9621"
    volumes:
      - ./data/rag_storage:/app/data/rag_storage
      - ./data/inputs:/app/data/inputs
      - ./data/prompts:/app/data/prompts
      - ./.env:/app/.env
    deploy:
      restart_policy:
        condition: on-failure
        max_attempts: 10
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      WORKING_DIR: "/app/data/rag_storage"
      INPUT_DIR: "/app/data/inputs"
      PROMPT_DIR: "/app/data/prompts"
      # The container must listen on 0.0.0.0 to be reachable via the published port.
      # SECURITY: set LIGHTRAG_API_KEY (or AUTH_ACCOUNTS with TOKEN_SECRET) in .env
      # so the exposed server is authenticated — without it every endpoint is public.
      HOST: "0.0.0.0"
      PORT: "9621"