services:
  app:
    build: .
    restart: unless-stopped
    network_mode: host
    user: '${APP_UID:-1000}:${APP_GID:-1000}'
    read_only: true
    tmpfs:
      - /tmp:size=16m,noexec,nosuid,nodev
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    volumes:
      # 复制 config.toml.example 为 config.toml 并填入真实配置后再启动。
      - ./config.toml:/app/config.toml:ro
    healthcheck:
      test: ['CMD', 'curl', '--fail', '--silent', 'http://127.0.0.1:9719/health']
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s