# Spendlight. Start with scripts/deploy.sh, which builds a versioned image
# first. Settings live in .env (copy .env.example to begin).
name: spendlight

services:
  spendlight:
    image: spendlight:latest
    build:
      context: .
      args:
        APP_VERSION: ${APP_VERSION:-dev}
    container_name: spendlight
    restart: unless-stopped
    env_file:
      - path: .env
        required: false
    environment:
      TZ: ${TZ:-America/New_York}
      # HTTPS is handled by a reverse proxy (NGINX) in front of the app.
      TRUST_PROXY: "true"
    ports:
      - "${HOST_PORT:-8095}:3000"
    volumes:
      - ${DATA_PATH:-./data}:/data
      - ${BACKUP_PATH:-./backups}:/backups
    user: "${PUID:-1000}:${PGID:-1000}"
    read_only: true
    tmpfs:
      - /tmp
    mem_limit: 256m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL