services:
  portal:
    build: .
    env_file: .env
    ports:
      - "8000:8000"
    volumes:
      - data:/data
      - backups:/backups
      - ${CA_FILE_HOST:?set CA_FILE_HOST in .env}:/certs/ca.pem:ro
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped

volumes:
  data:
  backups: