services:
  strixwebssh:
    build:
      context: ..
      dockerfile: deployment/Dockerfile
    container_name: strixwebssh-backend
    restart: unless-stopped
    # StrixWebSSH runs internal services; integrated Caddy will expose port 8080 to the host
    ports:
      - "8080:8080"
    environment:
      - TZ=Europe/Sofia
      - PYTHONUNBUFFERED=1
      - LOG_LEVEL=INFO
      # Configure users: format is username:password,username2:password2
      - STRIXWEBSSH_USERS=admin:admin
      # Max upload size (supports format like "100M" for 100MB or "50M" for 50MB)
      - MAX_UPLOAD_SIZE=30M
      # Session Recording Configuration
      - RECORDING_ENABLED=true
      - RECORDING_RETENTION_DAYS=30
    # Security hardening
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    volumes:
      - strixwebssh_data:/data
    # Optionally expose code to other services (read-only)
    # - ./:/srv/strixwebssh:ro
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
 

volumes:
  strixwebssh_data: