services:
  app:
    build: .
    restart: unless-stopped
    ports:
      - "8606:80"
    expose:
      - "3000"
    env_file:
      - .env

  nginx:
    image: nginx:alpine
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - app
    network_mode: "service:app"
    restart: unless-stopped

  secret-scan:
    image: ghcr.io/gitleaks/gitleaks:v8.30.1
    profiles:
      - tools
    working_dir: /repo
    volumes:
      - .:/repo:ro
    command:
      - git
      - --redact
      - --no-banner
      - .