services:
  certvault:
    build: .
    image: certvault:local
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - ./config:/config:ro
      - certvault-data:/data
      - ./hooks:/hooks:ro
    secrets:
      - master_key
      - admin_token
      - cloudflare_token
    environment:
      CERTVAULT_CONFIG: /config/config.yaml
      CERTVAULT_MASTER_KEY_FILE: /run/secrets/master_key
      CERTVAULT_BOOTSTRAP_ADMIN_TOKEN_FILE: /run/secrets/admin_token
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "-q",
          "-O",
          "/dev/null",
          "http://127.0.0.1:8080/api/v1/health",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

secrets:
  master_key:
    file: ./secrets/master-key
  admin_token:
    file: ./secrets/admin-token
  cloudflare_token:
    file: ./secrets/cloudflare-token

volumes:
  certvault-data: