services:
  nasdash-demo:
    build: .
    expose:
      - "2504"
    environment:
      NODE_ENV: production
      PORT: 2504
      HOSTNAME: 0.0.0.0
      NASDASH_DEMO_MODE: "true"
      NASDASH_JWT_SECRET: public-demo-authentication-is-disabled
    read_only: true
    tmpfs:
      - /tmp:size=32m,mode=1777
      - /app/.next/cache:uid=1001,gid=1001,mode=0750
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - demo-internal
    restart: unless-stopped

  demo-proxy:
    image: nginxinc/nginx-unprivileged:1.29-alpine
    ports:
      - "${NASDASH_DEMO_BIND_ADDRESS:-127.0.0.1}:2505:2505"
    volumes:
      - ./demo/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      nasdash-demo:
        condition: service_healthy
    read_only: true
    tmpfs:
      - /tmp:uid=101,gid=101,mode=0750
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - demo-internal
      - demo-public
    restart: unless-stopped

networks:
  demo-internal:
    internal: true
  demo-public: