docker-compose.yml

x-logging: &logging
  driver: local
  options:
    max-size: 100m
    max-file: 5

x-hardened: &hardened
  read_only: true
  security_opt:
    - no-new-privileges:true
  cap_drop:
    - ALL
  tmpfs:
    - /tmp
  logging: *logging

services:
  app:                          # stock node + mounted code, no image build; only ./cache is writable
    <<: *hardened
    image: node:alpine
    restart: unless-stopped
    user: "1000:1000"
    working_dir: /app
    command: ["node", "server/server.mjs"]
    env_file: .env
    environment:
      - PORT=80                 # the tunnel's ingress targets app:80 (unprivileged low ports are fine in a container netns)
    volumes:
      - ./server:/app/server:ro
      - ./public:/app/public:ro
      - ./cache:/app/cache

  tunnel:
    <<: *hardened
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    depends_on:
      - app
    command: tunnel run --token ${TUNNEL_TOKEN}
    environment:
      - TUNNEL_TOKEN=${TUNNEL_TOKEN}