services:
  trajectory-arena:
    build:
      context: .
    image: trajectory-arena:1.0.0
    restart: unless-stopped
    init: true
    read_only: true
    ports:
      - "127.0.0.1:3000:3000"
    environment:
      TRAJECTORY_DATA_DIR: /data
      TRAJECTORY_BASIC_AUTH_USER: ${TRAJECTORY_BASIC_AUTH_USER:?Set TRAJECTORY_BASIC_AUTH_USER}
      TRAJECTORY_BASIC_AUTH_PASSWORD: ${TRAJECTORY_BASIC_AUTH_PASSWORD:?Set TRAJECTORY_BASIC_AUTH_PASSWORD}
      TRAJECTORY_PUBLIC_ORIGIN: ${TRAJECTORY_PUBLIC_ORIGIN:-http://127.0.0.1:3000}
      TRAJECTORY_READ_ONLY: ${TRAJECTORY_READ_ONLY:-false}
      TRAJECTORY_ENABLE_SEED: ${TRAJECTORY_ENABLE_SEED:-false}
      TRAJECTORY_ALLOW_ORIGINLESS_MUTATIONS: ${TRAJECTORY_ALLOW_ORIGINLESS_MUTATIONS:-false}
    volumes:
      - trajectory-data:/data
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

volumes:
  trajectory-data: