services:
  app:
    build:
      context: .
    container_name: update-server
    image: update-server:latest
    restart: unless-stopped
    init: true
    ports:
      - "127.0.0.1:8080:8080"
    environment:
      APP_ADDR: "0.0.0.0:8080"
      APP_BASE_URL: "${APP_BASE_URL:?set APP_BASE_URL to the public HTTPS URL}"
      DATA_DIR: "/data"
      SQLITE_PATH: "/data/db.sqlite"
      ARTIFACTS_DIR: "/data/artifacts"
      MIGRATIONS_DIR: "/app/migrations"
      TEMPLATES_DIR: "/app/web/templates"
      STATIC_DIR: "/app/web/static"
      TRUST_PROXY_HEADERS: "true"
      ADMIN_EMAIL: "${ADMIN_EMAIL:?set ADMIN_EMAIL}"
      ADMIN_PASSWORD: "${ADMIN_PASSWORD:?set ADMIN_PASSWORD}"
      APP_LOG_LEVEL: "${APP_LOG_LEVEL:-INFO}"
      APP_READ_TIMEOUT: "${APP_READ_TIMEOUT:-30s}"
      APP_READ_HEADER_TIMEOUT: "${APP_READ_HEADER_TIMEOUT:-5s}"
      APP_WRITE_TIMEOUT: "${APP_WRITE_TIMEOUT:-60s}"
      APP_IDLE_TIMEOUT: "${APP_IDLE_TIMEOUT:-120s}"
      APP_MAX_HEADER_BYTES: "${APP_MAX_HEADER_BYTES:-1048576}"
      APP_LOGIN_RATE_LIMIT_PER_MINUTE: "${APP_LOGIN_RATE_LIMIT_PER_MINUTE:-10}"
      APP_LOGIN_RATE_LIMIT_BURST: "${APP_LOGIN_RATE_LIMIT_BURST:-5}"
      APP_CLIENT_RATE_LIMIT_PER_MINUTE: "${APP_CLIENT_RATE_LIMIT_PER_MINUTE:-120}"
      APP_CLIENT_RATE_LIMIT_BURST: "${APP_CLIENT_RATE_LIMIT_BURST:-60}"
    volumes:
      - update-server-data:/data
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

volumes:
  update-server-data: