services:
  app:
    build: .
    image: mikrotik-backup:0.0.1
    restart: unless-stopped
    ports:
      - "${BIND_ADDRESS:-127.0.0.1}:${APP_PORT:-5581}:5581"
    environment:
      APP_ENV: production
      APP_NAME: "${APP_NAME:-MikroTik Backup System}"
      LISTEN_ADDR: "0.0.0.0:5581"
      DATA_DIR: /data
      API_PREFIX: "${API_PREFIX:-/api}"
      TIMEZONE: "${TIMEZONE:-Europe/Warsaw}"
      SECRET_KEY: "${SECRET_KEY:-}"
      ALLOW_REGISTRATION: "${ALLOW_REGISTRATION:-false}"
      DEFAULT_ADMIN_USERNAME: "${DEFAULT_ADMIN_USERNAME:-admin}"
      DEFAULT_ADMIN_PASSWORD: "${DEFAULT_ADMIN_PASSWORD:-}"
      ACCESS_TOKEN_EXPIRE_MINUTES: "${ACCESS_TOKEN_EXPIRE_MINUTES:-1440}"
      SSH_HOST_KEY_POLICY: "${SSH_HOST_KEY_POLICY:-accept-new}"
      SSH_TIMEOUT_SECONDS: "${SSH_TIMEOUT_SECONDS:-30}"
      MAX_PARALLEL_BACKUPS: "${MAX_PARALLEL_BACKUPS:-4}"
      SMTP_STARTTLS: "${SMTP_STARTTLS:-true}"
      SMTP_TIMEOUT_SECONDS: "${SMTP_TIMEOUT_SECONDS:-20}"
      CORS_ORIGINS: "${CORS_ORIGINS:-[]}"
      RUST_LOG: "${RUST_LOG:-mikrotik_backup=info,tower_http=warn}"
    volumes:
      - data:/data
    read_only: true
    tmpfs:
      - /tmp:size=2304m,mode=1777
    cap_drop: [ ALL ]
    security_opt: [ no-new-privileges:true ]
    sysctls:
      net.ipv4.ping_group_range: "0 2147483647"
    stop_grace_period: 5m
    healthcheck:
      test: [ CMD, /usr/local/bin/mikrotik-backup, healthcheck ]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3
volumes:
  data: