services:
  gods-eye-view:
    build: .
    # Everything the app writes (.env with your keys, .gev-cache, .gev-logs)
    # lands in the bind-mounted repo, so run as you, not root. UID/GID are
    # unset on Docker Desktop, where the 1000 fallback is ignored anyway.
    user: "${UID:-1000}:${GID:-1000}"
    # Forward explicit shell/.env policy before the launcher discovers a gateway.
    # Unset values stay unset so the default loopback-only install still works.
    environment:
      - GEV_KEY_SETUP_TRUSTED_PEERS
      - GEV_ALLOWED_HOSTS
    ports:
      # Publish to loopback only. Docker's default ("4173:4173") would bind
      # every host interface, which quietly turns the LAN warning in the README
      # into the default: this server brokers whatever provider keys you have
      # configured to anyone who can reach it. Widen this deliberately, not by
      # accident.
      - "127.0.0.1:4173:4173"
    volumes:
      # Bind the source so edits hot-reload and so keys pasted into the setup
      # UI land in the .env on your host instead of vanishing with the
      # container. node_modules stays in the image: sharp and friends are
      # compiled for Linux and must not be shadowed by a host install.
      # `:z` relabels the checkout for containers on SELinux hosts (Fedora,
      # RHEL); without it the container cannot read /app at all and Node
      # reports the launcher as "Cannot find module". Elsewhere it is ignored.
      - .:/app:z
      - /app/node_modules