services:
  backend:
    image: registry.oeo.one/${MOSHIRO_IMAGE_NAMESPACE:-moshiro}/moshiro-backend:${MOSHIRO_VERSION:-0.1.1}
    container_name: moshiro-backend
    restart: unless-stopped
    init: true
    ports:
      - "127.0.0.1:8080:8080"
    environment:
      ASPNETCORE_HTTP_PORTS: "8080"
      MoShiro__DataDirectory: /data
      MoShiro__UpdateChannel: ${MOSHIRO_UPDATE_CHANNEL:-auto}
      MoShiro__ImageNamespace: ${MOSHIRO_IMAGE_NAMESPACE:-moshiro}
      MoShiro__InitialAdminUser: ${MOSHIRO_ADMIN_USER:-admin}
      MoShiro__InitialAdminPassword: "${MOSHIRO_ADMIN_PASSWORD:?Set MOSHIRO_ADMIN_PASSWORD in the environment}"
    volumes:
      - moshiro-backend-data:/data
      - moshiro-backend-status:/data/update-status:ro
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    stop_grace_period: 30s

volumes:
  moshiro-backend-data:
    name: moshiro-backend-data
  moshiro-backend-status:
    name: moshiro-backend-status