docker-compose.yml

services:
  server:
    build:
      context: .
      args:
        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org}
    container_name: openlogtool-server
    restart: unless-stopped
    init: true
    ports:
      - "${BIND_ADDRESS:-127.0.0.1}:${HOST_PORT:-3000}:3000"
    environment:
      PORT: "3000"
      DB_PATH: /app/data/openlogtool.db
      CONTAINER_MODE: "true"
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set}
      ADMIN_BOOTSTRAP_TOKEN: ${ADMIN_BOOTSTRAP_TOKEN:-}
      INVITE_HMAC_KEY: ${INVITE_HMAC_KEY:?INVITE_HMAC_KEY must be set}
      PUBLIC_SHARE_HMAC_KEY: ${PUBLIC_SHARE_HMAC_KEY:?PUBLIC_SHARE_HMAC_KEY must be set}
      JWT_ISSUER: ${JWT_ISSUER:-openlogtool-server}
      ACCESS_TOKEN_TTL_SECONDS: "${ACCESS_TOKEN_TTL_SECONDS:-900}"
      REFRESH_TOKEN_TTL_DAYS: "${REFRESH_TOKEN_TTL_DAYS:-30}"
      CORS_ORIGINS: ${CORS_ORIGINS:-}
      TRUST_PROXY: "${TRUST_PROXY:-false}"
      JSON_BODY_LIMIT: ${JSON_BODY_LIMIT:-1mb}
      RATE_LIMIT_ENABLED: "${RATE_LIMIT_ENABLED:-true}"
    volumes:
      - ./data:/app/data
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges=true
    stop_grace_period: 20s
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - "fetch('http://127.0.0.1:3000/api/v1/server-info').then((response) => { if (!response.ok) process.exit(1); }).catch(() => process.exit(1))"
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s