name: hypothesis-machine

x-firecrawl-env: &firecrawl-env
  REDIS_URL: redis://redis:6379
  REDIS_RATE_LIMIT_URL: redis://redis:6379
  PLAYWRIGHT_MICROSERVICE_URL: http://playwright-service:3000/scrape
  POSTGRES_USER: postgres
  POSTGRES_PASSWORD: postgres
  POSTGRES_DB: postgres
  POSTGRES_HOST: nuq-postgres
  POSTGRES_PORT: "5432"
  USE_DB_AUTHENTICATION: "false"
  NUQ_RABBITMQ_URL: amqp://rabbitmq:5672
  ENV: local
  HOST: 0.0.0.0
  PORT: "3002"
  SEARXNG_ENDPOINT: http://searxng:8080
  NUM_WORKERS_PER_QUEUE: "2"
  CRAWL_CONCURRENT_REQUESTS: "4"
  MAX_CONCURRENT_JOBS: "3"

services:
  searxng:
    image: searxng/searxng:latest
    restart: unless-stopped
    ports: ["127.0.0.1:${SEARXNG_PORT:-8888}:8080"]
    volumes: ["./searxng/settings.yml:/etc/searxng/settings.yml:ro"]
    environment:
      SEARXNG_BASE_URL: http://localhost:8080/
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    cap_add: ["CHOWN", "SETGID", "SETUID"]
    networks: [research]

  firecrawl:
    image: ghcr.io/firecrawl/firecrawl:latest
    restart: unless-stopped
    ports: ["127.0.0.1:3002:3002"]
    environment: *firecrawl-env
    command: node dist/src/harness.js --start-docker
    depends_on:
      redis: { condition: service_started }
      rabbitmq: { condition: service_healthy }
      nuq-postgres: { condition: service_started }
      playwright-service: { condition: service_started }
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    networks: [research, firecrawl-backend]

  playwright-service:
    image: ghcr.io/firecrawl/playwright-service:latest
    restart: unless-stopped
    environment:
      PORT: "3000"
      ALLOW_LOCAL_WEBHOOKS: "false"
      BLOCK_MEDIA: "true"
      MAX_CONCURRENT_PAGES: "4"
    shm_size: 1gb
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    tmpfs: ["/tmp/.cache:noexec,nosuid,size=1g"]
    networks: [firecrawl-backend, research]

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --bind 0.0.0.0 --save "" --appendonly no
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    cap_add: ["SETGID", "SETUID"]
    networks: [firecrawl-backend]

  rabbitmq:
    image: rabbitmq:3-alpine
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "-q", "check_running"]
      interval: 5s
      timeout: 5s
      retries: 8
    security_opt: ["no-new-privileges:true"]
    networks: [firecrawl-backend]

  nuq-postgres:
    image: ghcr.io/firecrawl/nuq-postgres:latest
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
    volumes: ["nuq-data:/var/lib/postgresql/data"]
    security_opt: ["no-new-privileges:true"]
    networks: [firecrawl-backend]

networks:
  research: {}
  firecrawl-backend:
    internal: true

volumes:
  nuq-data: {}