services:
  awcc:
    build: .
    restart: unless-stopped
    ports:
      # Only reachable from the server itself; the reverse proxy (nginx) is the public entrance.
      # Docker bypasses firewall rules for published ports, so never publish this on 0.0.0.0.
      - "127.0.0.1:${AW_PORT:-8090}:8000"
    security_opt:
      - no-new-privileges:true
    environment:
      # Code that new users must enter to create an account (set it in the .env file next to this file).
      # Empty = registration is disabled.
      AW_REGISTRATION_CODE: ${AW_REGISTRATION_CODE:-}
      # Who may use the rules editor: comma separated usernames. Empty = only the first account that was ever created.
      AW_ADMINS: ${AW_ADMINS:-}
      # Set to 1 when a reverse proxy (nginx, Caddy, Traefik) in front sets X-Forwarded-* headers.
      AW_TRUST_PROXY: ${AW_TRUST_PROXY:-0}
    volumes:
      - ./db:/db             # SQLite database (users, characters, presets)
      - ./backend/data:/app/data:ro   # rules.json: edit, reload the page, done