name: pds-operator

# Admin dashboard for the PDS — deployed by Ansible to
# {{ pds_data_dir }}/operator/compose.yaml

services:
  app:
    build: .
    env_file: .env
    environment:
      - HOST=0.0.0.0 # required for reverse proxy to reach
      - DB_PATH=/data/data.sqlite
      - AUDIT_LOG_PATH=/data/audit.log
    ports:
      - "127.0.0.1:8787:8787"
    volumes:
      # bind mount keeps data under /pds — captured by the backup tarball
      - ./data:/data
    # runs unprivileged; ./data must be owned by uid 1000 (node)
    user: node
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped