services:
  app:
    build: .
    image: eparcs
    ports:
      - "8000:8000"
    environment:
      EPARCS_BROWSER_WS_URL: ws://browser:3000?token=${BROWSERLESS_TOKEN:-eparcs-local}
    depends_on:
      - browser
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    mem_limit: 512m
    restart: unless-stopped

  browser:
    # Isolated Chromium for JS rendering; reachable only inside this
    # compose network (no host port mapping on purpose).
    image: ghcr.io/browserless/chromium:latest
    environment:
      TOKEN: ${BROWSERLESS_TOKEN:-eparcs-local}
      CONCURRENT: "5"
      TIMEOUT: "30000"
    shm_size: 1gb
    security_opt:
      - no-new-privileges:true
    mem_limit: 1g
    restart: unless-stopped