# docker-compose for bchanot.fr static site.
#
# Usage:
#   cp .env.example .env
#   # edit .env to set the host port (default 8080)
#   docker compose up -d --build
#
# Host port is bound to 127.0.0.1 so the container is reachable only by a
# reverse proxy running on the same machine. Change to 0.0.0.0:${PORT} if
# you need LAN access for testing.

services:
  bchanot-web:
    build:
      context: .
      dockerfile: Dockerfile
    image: bchanot-web:latest
    container_name: bchanot-web
    restart: unless-stopped
    ports:
      - "127.0.0.1:${PORT:-8080}:80"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - NET_BIND_SERVICE