docker-compose.yml

services:
  ppcollection:
    build: .
    container_name: ppcollection
    # Both sides follow PORT so the published port and the port the app listens
    # on can never drift apart. Change it in one place — `PORT=3008` in a `.env`
    # file next to this compose file, or in the environment you run `docker
    # compose` from — and the app, the mapping, and the health check all move
    # together. To keep the app on 3000 inside the container and only change the
    # host port, write the mapping literally instead: "3008:3000".
    ports:
      - "${PORT:-3000}:${PORT:-3000}"
    stop_grace_period: 15s
    environment:
      - PORT=${PORT:-3000}
      - DATABASE_PATH=/data/app.db
      # No credentials are required. On first start the app prints a one-time
      # setup code to the container logs (`docker compose logs ppcollection`);
      # open http://localhost:3000 (or your PORT) and create your administrator
      # there.
      #
      # SESSION_SECRET is optional. When unset the app generates a strong secret
      # on first start and stores it at /data/session-secret (mode 0600),
      # reusing it across restarts and image upgrades. Set it only to manage the
      # key yourself:
      # - SESSION_SECRET=${SESSION_SECRET}
      #
      # ADMIN_USERNAME / ADMIN_PASSWORD remain supported for unattended installs
      # that seed the account from the environment instead of the setup page.
      # Setting ADMIN_PASSWORD skips the wizard and forces a password change on
      # first login:
      # - ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
      # - ADMIN_PASSWORD=${ADMIN_PASSWORD}
      # Secure cookies are on by default in production (NODE_ENV=production)
      # is hard-set in the Dockerfile. Uncomment TRUST_PROXY when behind an
      # HTTPS reverse proxy so Express recognises the proxied request as HTTPS.
      # - TRUST_PROXY=true
      # If you intentionally serve the app on plain HTTP (no TLS), uncomment
      # the line below to disable secure cookies — otherwise the browser will
      # refuse to send the session cookie and login will not persist.
      # - SECURE_COOKIES=false
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:'+(process.env.PORT||3000)+'/health',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3
    volumes:
      # Persist the SQLite database across image updates. Keep this host path
      # stable; changing the compose project directory points ./data at a new
      # empty folder and makes the app look like a first-time install. Use an
      # absolute path (for example /srv/ppcollection/data:/data) if you update
      # from multiple directories or automation tools.
      - ./data:/data
    # Resource governance — sized for a single-user Express + SQLite workload.
    # Tune in docker-compose.override.yml if you run on a Pi or a busier host.
    mem_limit: 512m
    mem_reservation: 128m
    cpus: 1.0
    pids_limit: 256
    # Hardening: drop all capabilities, prevent privilege escalation, and run a
    # read-only rootfs. The app only writes to /data (bind mount) and /tmp.
    read_only: true
    tmpfs:
      - /tmp:size=64m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped