services:
  rastro:
    build: .
    restart: unless-stopped
    # All configuration lives in .env (single source of truth for prod).
    env_file: .env
    volumes:
      - ./data:/app/data
    ports:
      # host 10359 (localhost only) -> container 8090; reverse proxy fronts TLS
      - "127.0.0.1:10359:8090"
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8090/healthz', timeout=3)",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 25s
    stop_grace_period: 20s