services:
  rebalio:
    image: ${REBALIO_IMAGE:-ghcr.io/digitalcentral/rebalio:latest}
    restart: unless-stopped
    stop_grace_period: 75s
    ports:
      - "127.0.0.1:${REBALIO_PORT:-8088}:8088"
    environment:
      REBALIO_SESSION_COOKIE_NAME: ${REBALIO_SESSION_COOKIE_NAME:?Required}
      REBALIO_MASTER_KEY: ${REBALIO_MASTER_KEY:?Required}
      REBALIO_ORIGIN: ${REBALIO_ORIGIN:-http://127.0.0.1:${REBALIO_PORT:-8088}}
    volumes:
      - rebalio-data:/data
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

volumes:
  rebalio-data: