# recon-triage compose.
#
#   Default (LLM-free):   docker compose run --rm app scan --scope /data/scope.yaml --target example.com --out /data/out
#   With local LLM:       docker compose --profile llm up -d ollama
#                         docker compose --profile llm run --rm app-llm scan ...
#
# The default `app` service leaves LLM_BASE_URL unset, so the triage stage uses
# deterministic ranking. The `app-llm` service (only created with the `llm`
# profile) starts Ollama and wires LLM_BASE_URL=http://ollama:11434/v1.

x-app-base: &app-base
  build:
    context: .
    target: runtime
  image: recon-triage:latest
  user: "app"                       # recon/triage only; connect scans need no caps
  volumes:
    - ./scope.yaml:/data/scope.yaml:ro
    - ./out:/data/out
    - nuclei-templates:/home/app/nuclei-templates
  command: ["--help"]

services:
  app:
    <<: *app-base
    environment:
      NUCLEI_TEMPLATES_DIR: /home/app/nuclei-templates
      # LLM_BASE_URL intentionally unset -> deterministic triage.

  app-llm:
    <<: *app-base
    profiles: ["llm"]
    depends_on:
      - ollama
    environment:
      NUCLEI_TEMPLATES_DIR: /home/app/nuclei-templates
      LLM_BASE_URL: http://ollama:11434/v1
      LLM_MODEL: ${LLM_MODEL:-qwen2.5:7b-instruct}
      LLM_API_KEY: ${LLM_API_KEY:-not-needed}

  # Optional local LLM. Only created with the `llm` profile.
  ollama:
    image: ollama/ollama:latest
    profiles: ["llm"]
    ports:
      - "11434:11434"
    volumes:
      - ollama:/root/.ollama

volumes:
  nuclei-templates:
  ollama: