docker-compose.yml

# Springtale — Docker Compose for local development and production
#
# Usage:
#   docker compose up          # start springtaled
#   docker compose down        # stop and remove
#
# Before first run:
#   1. Create secrets: mkdir -p secrets && echo -n "your-passphrase" > secrets/passphrase.txt
#   2. Create a vault: docker compose run --rm springtaled springtale init
#
# Data persisted in ./data/ directory (vault.bin, springtale.db)
# Passphrase loaded from file (not env var) per security audit requirements.

secrets:
  springtale_passphrase:
    file: ./secrets/passphrase.txt

services:
  springtaled:
    build: .
    container_name: springtaled
    ports:
      - "8080:8080"
    volumes:
      - ./data:/data
      - ./springtale.toml:/etc/springtale/springtale.toml:ro
    secrets:
      - springtale_passphrase
    environment:
      # Passphrase loaded from Docker secret file (not env var).
      # boot.rs reads SPRINGTALE_PASSPHRASE_FILE first, falls back to SPRINGTALE_PASSPHRASE.
      - SPRINGTALE_PASSPHRASE_FILE=/run/secrets/springtale_passphrase
      # Double underscore (__) separates config nesting levels.
      - SPRINGTALE_STORE__PATH=/data/springtale.db
      - SPRINGTALE_CRYPTO__VAULT_PATH=/data/vault.bin
      - SPRINGTALE_TRANSPORT__SOCKET_PATH=/data/springtale.sock
      - SPRINGTALE_API__BIND=0.0.0.0:8080
      - RUST_LOG=info
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    # Resource caps — NIST SP 800-190 §4.3 + bound-the-damage on compromise.
    pids_limit: 200
    mem_limit: 1g
    cpus: 2.0
    # Healthcheck via the CLI subcommand — distroless has no shell tools,
    # so the binary itself is the healthcheck. Same /health path as before.
    healthcheck:
      test: ["CMD", "/usr/local/bin/springtale", "healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped