# docker-compose.yml
# All runtime configuration is read from the .env file in the same folder.
# This file intentionally contains NO secrets and NO environment values.

services:
  alerthub:
    build:
      context: .
      dockerfile: Dockerfile
    image: alerthub:latest
    container_name: alerthub
    restart: unless-stopped
    env_file:
      - .env
    ports:
      - "${FRONTOFFICE_PORT}:${FRONTOFFICE_PORT}"
    volumes:
      - alerthub_data:/data
    # Hardening
    read_only: false       # SQLite needs to write to /data; the rest of FS is owned by non-root user
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:${FRONTOFFICE_PORT}/login"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3

volumes:
  alerthub_data:
    name: alerthub_data