# Standalone Compose file for the Pi.
#
# If you already run Caddy and PostgreSQL from another Compose project, either
# merge the `schulcloud-mcp` service below into that project's file, or keep
# this file separate and attach it to the existing Caddy network — see the
# `networks` block at the bottom and deploy/Caddyfile.snippet.

services:
  schulcloud-mcp:
    build: .
    image: schulcloud-mcp:latest
    container_name: schulcloud-mcp
    restart: unless-stopped
    env_file: .env
    environment:
      PORT: 8080
      BIND_HOST: 0.0.0.0
    # No ports are published to the host: Caddy reaches the container over the
    # shared Docker network, so the only way in from the internet is through
    # Caddy's TLS and this server's bearer check.
    expose:
      - "8080"
    networks:
      - caddy
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL

networks:
  caddy:
    # Set to true once this joins the network your existing Caddy already uses,
    # and change the name to match (`docker network ls` to find it).
    external: false
    name: caddy