services:
  webssh:
    build:
      context: ..
      dockerfile: deployment/Dockerfile
    container_name: webssh-backend
    restart: unless-stopped
    # WebSSH runs internal services; integrated Caddy will expose port 8080 to the host
    ports:
      - "8080:8080"
    environment:
      - TZ=Europe/Sofia
      - PYTHONUNBUFFERED=1
      - LOG_LEVEL=INFO
      # Configure users: format is username:password,username2:password2
      - WEBSSH_USERS=admin:admin
      # Max upload size, enforced by both Caddy and the backend (e.g. "30MB", "512KB")
      - MAX_UPLOAD_SIZE=30MB
      # Session Recording Configuration
      - RECORDING_ENABLED=true
      - RECORDING_RETENTION_DAYS=30
    # Security hardening
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    volumes:
      - webssh_data:/data
    # Optionally expose code to other services (read-only)
    # - ./:/srv/webssh:ro
    healthcheck:
      test: ["CMD", "python", "-c", "import sys, urllib.request; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8080/', timeout=5).getcode() == 200 else 1)"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
 

volumes:
  webssh_data: