services:
  app:
    build:
      context: .
    restart: unless-stopped
    env_file:
      - .env
    environment:
      HOST: 0.0.0.0
      PORT: 8791
      IMPRINT_DATA_DIR: /data
      TRUST_PROXY: 1
    user: "${APP_UID:-1000}:${APP_GID:-1000}"
    volumes:
      - ./data:/data
    expose:
      - "8791"
    read_only: true
    tmpfs:
      - /tmp:size=16m
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        - CMD
        - python3
        - -c
        - "import json,urllib.request; assert json.load(urllib.request.urlopen('http://127.0.0.1:8791/api/health', timeout=3))['ok']"
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  web:
    image: nginx:1.27-alpine
    restart: unless-stopped
    depends_on:
      app:
        condition: service_healthy
    ports:
      - "127.0.0.1:8090:80"
    volumes:
      - ./deploy/nginx-container.conf:/etc/nginx/conf.d/default.conf:ro
    security_opt:
      - no-new-privileges:true
