services:
  app:
    image: git.send.nrw/sendnrw/ai-disclosure-standard:latest
    env_file:
      - .env
    ports:
      - "8080:8080"
    volumes:
      - license-cache:/data
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "/ai-disclosure", "--healthcheck"]
      interval: 15s
      timeout: 3s
      retries: 3
      start_period: 5s

volumes:
  license-cache: