name: cities-labeler

# Cities labeler — deployed by Ansible to
# {{ pds_data_dir }}/cities/compose.yaml

services:
  app:
    build: .
    env_file: .env
    ports:
      - "127.0.0.1:4100:4100"
    # the host's /etc/hosts maps the PDS hostname to 127.0.1.1 (cloud-init
    # manage_etc_hosts), which Docker propagates to container DNS — pin the
    # real address so the labeler can log in to the PDS
    extra_hosts:
      - "{{ pds_hostname }}:{{ hostvars[inventory_hostname].ansible_default_ipv4.address }}"
    volumes:
      # bind mount keeps the label database under /pds — captured by the backup tarball
      - ./data:/data
    # runs unprivileged; ./data must be owned by uid 1000
    user: "1000:1000"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped