services:
  wikideck:
    build:
      context: .
      target: runtime
      args:
        WIKIDECK_NETWORK: mainnet
        WIKIDECK_GENESIS_TIME: "${WIKIDECK_GENESIS_TIME:-1793491200}"
    ports:
      # Loopback only; terminate reviewed HTTPS at the operator's edge.
      - "127.0.0.1:${WIKIDECK_MAINNET_PORT:-3201}:3001"
    environment:
      WIKIDECK_NETWORK: mainnet
      WIKIDECK_GENESIS_TIME: "${WIKIDECK_GENESIS_TIME:-1793491200}"
      PUBLIC_ORIGIN: "${WIKIDECK_MAINNET_ORIGIN:-}"
      WIKIDECK_PEERS: "${WIKIDECK_MAINNET_PEERS:-}"
      WIKIDECK_MAINNET_LAUNCH: "${WIKIDECK_MAINNET_LAUNCH:-}"
      WIKIDECK_MAINNET_RISK_ACK: "${WIKIDECK_MAINNET_RISK_ACK:-}"
      WIKIDECK_ALLOW_PRIVATE_PEERS: "0"
      WIKIDECK_TRUSTED_PROXIES: "${WIKIDECK_TRUSTED_PROXIES:-}"
    volumes:
      - wikideck-mainnet-data:/app/data
    init: true
    restart: "no"
    read_only: true
    tmpfs:
      - /tmp:size=32m,mode=1777,noexec,nosuid
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    mem_limit: 1g
    cpus: 1.0
    stop_grace_period: 30s

volumes:
  wikideck-mainnet-data: