services:
  auth:
    build: .
    security_opt:
      - apparmor=unconfined
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
      - DOMAIN=${DOMAIN}
      - ADMIN_EMAIL=${ADMIN_EMAIL}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
      - OFFICE_IP_CHECK=${OFFICE_IP_CHECK:-disabled}
      - SESSION_DAYS=${SESSION_DAYS:-30}
      - NODE_ENV=production
    ports:
      - "3001:3001"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3001/health || exit 1"]
      interval: 10s
      retries: 5
      start_period: 20s
    restart: unless-stopped