services:
  api:
    image: ghcr.io/psydov2/lazysentry:latest
    restart: unless-stopped
    env_file: .env
    environment:
      HOST: 0.0.0.0
      PORT: 3111
      DATABASE_PATH: /data/lazysentry.db
      OSV_SCANNER_PATH: osv-scanner
      TRUFFLEHOG_PATH: trufflehog
    ports:
      # Bound to loopback, not 0.0.0.0: put a reverse proxy in front to expose
      # this beyond the host
      - "127.0.0.1:${PORT:-3111}:3111"
    volumes:
      - lazysentry-data:/data
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://127.0.0.1:3111/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  worker:
    image: ghcr.io/psydov2/lazysentry:latest
    command: ["node", "dist/worker.js"]
    restart: unless-stopped
    env_file: .env
    environment:
      DATABASE_PATH: /data/lazysentry.db
      OSV_SCANNER_PATH: osv-scanner
      TRUFFLEHOG_PATH: trufflehog
    volumes:
      - lazysentry-data:/data
    read_only: true
    tmpfs:
      - /tmp:size=4g
    cap_drop:
      - ALL

volumes:
  lazysentry-data: