services:
  portal:
    build: .
    env_file: .env
    ports:
      - "8000:8000"
    volumes:
      - data:/data
      - backups:/backups
      - ${CA_FILE_HOST:?set CA_FILE_HOST in .env}:/certs/ca.pem:ro
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped

  # Opt-in checks against the test OU. Reads the LDAP_* values from .env; the test user's
  # current password comes from the shell:
  #   LIVE_LDAP_TEST_PASSWORD=... docker compose --profile test run --rm live-test
  live-test:
    profiles: ["test"]
    build:
      context: .
      target: test
    environment:
      PORTAL_LIVE_LDAP: "1"
      LIVE_LDAP_SERVER: ${LDAP_SERVER:-}
      LIVE_LDAP_USER_OU_DN: ${LDAP_USER_OU_DN:-}
      LIVE_LDAP_BIND_DN: ${LDAP_BIND_DN:-}
      LIVE_LDAP_BIND_PASSWORD: ${LDAP_BIND_PASSWORD:-}
      LIVE_LDAP_CA_FILE: /certs/ca.pem
      LIVE_LDAP_PUBLISHER_GROUP_DN: ${LDAP_PUBLISHER_GROUP_DN:-}
      LIVE_LDAP_ADMIN_GROUP_DN: ${LDAP_ADMIN_GROUP_DN:-}
      LIVE_LDAP_TEST_PASSWORD:
    volumes:
      - ${CA_FILE_HOST:?set CA_FILE_HOST in .env}:/certs/ca.pem:ro

volumes:
  data:
  backups: