init

docker-compose.yml

@@ -0,0 +1,35 @@
+services:
+  syncbot:
+    image: ghcr.io/OWNER/syncbot:latest
+    container_name: syncbot
+    restart: unless-stopped
+
+    volumes:
+      # The config is re-read while running — edit it in place, no restart.
+      - ./config.toml:/etc/syncbot/config.toml:ro
+      # Deploy keys. Read-only 0644 mounts are fine; syncbot stages a 0600 copy.
+      - ./keys:/etc/syncbot/keys:ro
+      # Local mirrors. Persisting these avoids re-cloning after every restart.
+      - syncbot-data:/var/lib/syncbot
+
+    # Only needed if you want to reach /healthz, /status or /metrics.
+    ports:
+      - "127.0.0.1:8080:8080"
+
+    # Requires `listen` to be set in config.toml.
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+    # git is the only thing that needs real memory here; cap it to taste and
+    # keep `concurrency` in config.toml in line with whatever you allow.
+    mem_limit: 512m
+
+    security_opt:
+      - no-new-privileges:true
+
+volumes:
+  syncbot-data: