services:
  finance:
    build: .
    restart: unless-stopped
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - finance-data:/data
      # Mount your private key read-only if using Enable Banking:
      # - ./secrets/enablebanking.key:/run/secrets/enablebanking.key:ro
    environment:
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      ENABLEBANKING_APP_ID: ${ENABLEBANKING_APP_ID:-}
      ENABLEBANKING_KEY_FILE: ${ENABLEBANKING_KEY_FILE:-}
      ENABLEBANKING_REDIRECT_URL: ${ENABLEBANKING_REDIRECT_URL:-}
    command: ["-data", "/data", "-listen", "0.0.0.0:8080", "-public-url", "${FINANCE_PUBLIC_URL:-http://localhost:8080}"]
    read_only: true
    tmpfs:
      - /tmp:mode=1777,size=64m
    security_opt:
      - no-new-privileges:true
    cap_drop: [ALL]
volumes:
  finance-data: