# =============================================================================
# Cipher Barcode Studio — docker-compose
# Usage:  docker compose up -d --build
# Access: http://localhost:8080
# =============================================================================

services:
  cipher:
    build:
      context: .
      dockerfile: Dockerfile
    image: cipher-barcode-studio:1.0.0
    container_name: cipher-barcode-studio
    restart: unless-stopped

    ports:
      # Host:Container — change the left side to publish on a different port
      - "${HOST_PORT:-8080}:8080"

    # ---------- Runtime hardening ----------
    # Run as the non-root user baked into the image (UID 101)
    user: "101:101"
    # Read-only root filesystem with explicit tmpfs for nginx's scratch dirs
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m
      - /var/cache/nginx:rw,noexec,nosuid,size=16m
      - /var/run:rw,noexec,nosuid,size=4m
    # Drop every Linux capability; nginx-unprivileged on port 8080 needs none
    cap_drop:
      - ALL
    # Stop the container from gaining new privileges
    security_opt:
      - no-new-privileges:true

    # ---------- Resource limits ----------
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 128M
        reservations:
          cpus: "0.05"
          memory: 32M

    # ---------- Logging ----------
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "3"

    # ---------- Healthcheck (overrides Dockerfile so we can tune it) ----------
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:8080/healthz"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s

    networks:
      - cipher-net

networks:
  cipher-net:
    driver: bridge