services:
  chimera:
    build: .
    ports: ["127.0.0.1:6967:6967"]
    environment:
      HOST: 0.0.0.0
      PORT: "6967"
      CHIMERA_DATA_DIR: /data
      CHIMERA_PUBLIC_ORIGIN: ${CHIMERA_PUBLIC_ORIGIN:?Set the HTTPS reverse proxy origin}
      CHIMERA_ALLOWED_HOSTS: ${CHIMERA_ALLOWED_HOSTS:?Set the public host plus localhost}
      CHIMERA_COOKIE_SECURE: "1"
      CHIMERA_TRUST_PROXY: "1"
      APP_SECRET_KEY_FILE: /run/secrets/master_key
      CHIMERA_BOOTSTRAP_TOKEN_FILE: /run/secrets/bootstrap_token
    volumes: ["chimera-data:/data"]
    secrets: [master_key, bootstrap_token]
    read_only: true
    tmpfs: ["/tmp"]
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]
    restart: unless-stopped
secrets:
  master_key:
    file: ${CHIMERA_SECRET_KEY_PATH:?Set an external master key file}
  bootstrap_token:
    file: ${CHIMERA_BOOTSTRAP_TOKEN_PATH:?Set an external bootstrap token file}
volumes:
  chimera-data: