docker-compose.yml

services:
  ib-gateway:
    build: .
    container_name: ${IB_GATEWAY_CONTAINER_NAME:-ib-gateway}
    restart: always
    environment:
      # Read variables from the host's .env file
      - TWS_USERID=${TWS_USERID}
      - TWS_PASSWORD=${TWS_PASSWORD}
      - TOTP_SECRET=${TOTP_SECRET}
      - TRADING_MODE=${TRADING_MODE:-paper}
      - TWS_ACCEPT_INCOMING=${TWS_ACCEPT_INCOMING:-accept}
      - READ_ONLY_API=${READ_ONLY_API:-no}
      - IB_GATEWAY_SKIP_IBC_READ_ONLY_API_CONFIG=${IB_GATEWAY_SKIP_IBC_READ_ONLY_API_CONFIG:-yes}
      - IB_GATEWAY_SKIP_IBC_ACCEPT_INCOMING_CONFIG=${IB_GATEWAY_SKIP_IBC_ACCEPT_INCOMING_CONFIG:-yes}
      # Keep IBC aligned with the upstream image defaults so paper/live
      # sessions recover after missed 2FA or stale-session prompts.
      - TWOFA_DEVICE=${TWOFA_DEVICE:-}
      - TWOFA_TIMEOUT_ACTION=${TWOFA_TIMEOUT_ACTION:-restart}
      - RELOGIN_AFTER_TWOFA_TIMEOUT=${RELOGIN_AFTER_TWOFA_TIMEOUT:-yes}
      - IBC_SECOND_FACTOR_AUTHENTICATION_EXIT_INTERVAL=${IBC_SECOND_FACTOR_AUTHENTICATION_EXIT_INTERVAL:-180}
      - EXISTING_SESSION_DETECTED_ACTION=${EXISTING_SESSION_DETECTED_ACTION:-primary}
      # Set to no when IBC should use IBKR Mobile push approval instead of
      # the local TOTP auto-fill helper.
      - IBKR_2FA_AUTOFILL=${IBKR_2FA_AUTOFILL:-yes}
      - IBKR_2FA_MAX_SUBMISSIONS=${IBKR_2FA_MAX_SUBMISSIONS:-1}
      # e2-micro has less than 1 GiB RAM. The upstream image defaults to
      # -Xmx768m, which can starve sshd/Docker/guest-agent. Keep this
      # configurable, but use a safer default for the current VM.
      - JAVA_HEAP_SIZE=${JAVA_HEAP_SIZE:-512}
      # The upstream vmoptions use 20 parallel GC threads, which is too
      # aggressive for the current 2 vCPU VM and can slow Gateway startup.
      - IB_GATEWAY_PARALLEL_GC_THREADS=${IB_GATEWAY_PARALLEL_GC_THREADS:-2}
      - IB_GATEWAY_CONC_GC_THREADS=${IB_GATEWAY_CONC_GC_THREADS:-1}
      - VNC_SERVER_PASSWORD=${VNC_SERVER_PASSWORD}
      - LOGIN_TIMEOUT=600

      # Cloud Run -> VPC -> GCE private IP access
      # IMPORTANT: restrict to your Serverless VPC Access connector CIDR or Cloud Run egress CIDR.
      - ACCEPT_API_FROM_IP=${ACCEPT_API_FROM_IP:?Set ACCEPT_API_FROM_IP to your Cloud Run egress subnet or connector CIDR}
      - ALLOW_CONNECTIONS_FROM_LOCALHOST_ONLY=${ALLOW_CONNECTIONS_FROM_LOCALHOST_ONLY:-no}
    volumes:
      - ./2fa_bot.py:/home/ibgateway/2fa_bot.py
    ports:
      # The base image exposes remote API access through socat on container
      # ports 4003/4004 while keeping IB Gateway itself localhost-only.
      - "${IB_GATEWAY_LIVE_HOST_PORT:-4001}:4003"
      - "${IB_GATEWAY_PAPER_HOST_PORT:-4002}:4004"

      # VNC Desktop Port for visual monitoring (Default: 5900)
      # Strongly recommended to keep blocked by firewall or tunnel only.
      - "${IB_GATEWAY_VNC_HOST_ADDRESS:-127.0.0.1}:${IB_GATEWAY_VNC_HOST_PORT:-5900}:5900"