services:
  pocket-id:
    image: ghcr.io/pocket-id/pocket-id
    container_name: pocket-id
    restart: unless-stopped
    env_file: .env
    ports:
      - 3002:80
    volumes:
      - "${DATA_MNT}:/app/data"
    networks:
      - proxy
    healthcheck:
      test: "curl --fail http://localhost/health"
      interval: 1m30s
      timeout: 5s
      retries: 2
      start_period: 10s
    security_opt:
      - no-new-privileges:true

networks:
  proxy:
    external: true