docker-compose.yml

services:
  rectify:
    build: .
    container_name: rectify
    #ports:
    #  - "8000:8000" #uncomment for public access or local dev
    environment:
      # Expects a reverse proxy (Nginx, Traefik, HAProxy, etc.) to handle HTTPS
      # and inject X-Forwarded-* headers (X-Forwarded-For, X-Forwarded-Proto, etc.)
      - APP_ENV=production # Set to development for local dev
      #- SECRET_KEY=${SECRET_KEY:-change-me-in-production} # Set up your own secret key for production. Random is generated at build time if not provided.
    volumes:
      - type: tmpfs
        target: /tmp
        tmpfs:
          size: 64M
      - type: tmpfs
        target: /app/uploads
        tmpfs:
          size: 512M
    read_only: true
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; req = urllib.request.Request('http://localhost:8000/', headers={'X-Forwarded-Proto': 'https'}); urllib.request.urlopen(req)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s