services:
  sexy:
    build: .
    container_name: sexy
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    volumes:
      # Writable - the SQLite file must persist across restarts, unlike
      # everything else in the container filesystem.
      - ./data:/app/data
    env_file: .env
    networks:
      - compose_network
    labels:
      - traefik.enable=true
      - traefik.docker.network=${NETWORK_NAME}
      - traefik.http.middlewares.sexy-redirect-web-secure.redirectscheme.scheme=https
      - traefik.http.routers.sexy-web.rule=Host(`${TRAEFIK_HOST}`)
      - traefik.http.routers.sexy-web.entrypoints=web
      - traefik.http.routers.sexy-web.middlewares=sexy-redirect-web-secure
      - traefik.http.routers.sexy-web-secure.rule=Host(`${TRAEFIK_HOST}`)
      - traefik.http.routers.sexy-web-secure.entrypoints=web-secure
      - traefik.http.routers.sexy-web-secure.tls.certresolver=resolver
      - traefik.http.routers.sexy-web-secure.middlewares=security-headers@file,no-index@file
      - traefik.http.services.sexy-web-secure.loadbalancer.server.port=3000
    healthcheck:
      test: ["CMD", "node", "healthcheck.mjs"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3

networks:
  compose_network:
    name: ${NETWORK_NAME}
    external: true