name: suchi

services:
  suchi:
    # The moving latest tag is a local/evaluation default. Production operators
    # must set SUCHI_IMAGE to the selected release's published image digest.
    image: ${SUCHI_IMAGE:-ghcr.io/johnnybravo-xyz/suchi:latest}
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    environment:
      PUBLIC_URL: ${PUBLIC_URL:-http://127.0.0.1:8000}
    ports:
      - "${SUCHI_BIND_ADDRESS:-127.0.0.1}:${SUCHI_PORT:-8000}:8000"
    extra_hosts:
      - "host.suchi.local:host-gateway"
    volumes:
      - suchi-data:/data

volumes:
  suchi-data: