services:
  syncbot:
    image: ghcr.io/OWNER/syncbot:latest
    container_name: syncbot
    restart: unless-stopped

    volumes:
      # The config is re-read while running — edit it in place, no restart.
      - ./config.toml:/etc/syncbot/config.toml:ro
      # Deploy keys. Read-only 0644 mounts are fine; syncbot stages a 0600 copy.
      - ./keys:/etc/syncbot/keys:ro
      # Local mirrors. Persisting these avoids re-cloning after every restart.
      - syncbot-data:/var/lib/syncbot

    # Only needed if you want to reach /healthz, /status or /metrics.
    ports:
      - "127.0.0.1:8080:8080"

    # Requires `listen` to be set in config.toml.
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

    # git is the only thing that needs real memory here; cap it to taste and
    # keep `concurrency` in config.toml in line with whatever you allow.
    mem_limit: 512m

    security_opt:
      - no-new-privileges:true

volumes:
  syncbot-data: