docker-compose.yml

version: '3.8'

services:
  app:
    image: ghcr.io/gleb619/knca-signer:latest
    ports:
      - "8080:8080"
    volumes:
      # Mount certificate directories
      # IMPORTANT: Ensure host directories ./certs and ./lib are owned by UID 100:GID 1000
      # Run: sudo chown -R 100:1000 ./certs ./lib
      # This matches the container's appuser UID/GID for proper volume write permissions
      - ./certs:/app/certs:ro
      - ./backend/lib:/app/lib:ro
    environment:
      - APP_LOGGING_LEVEL=INFO
#      - JAVA_OPTS=-Xmx512m -Djava.security.egd=file:/dev/urandom
#      - VERTX_CONFIG_PATH=/app/resources/application.yaml
#      - APP_HTTP_PORT=8080
#      - APP_HTTP_HOST=0.0.0.0
#      - APP_CORS_ALLOWEDORIGINS=*
#      - APP_CORS_ALLOWEDMETHODS=GET,POST,PUT,DELETE
#      - APP_CORS_ALLOWEDHEADERS=Content-Type,Authorization
#      - APP_STATICCONFIG_WEBROOT=static
#      - APP_CERTIFICATE_CERTSPATH=certs/
#      - APP_CERTIFICATE_CACERTPATH=certs/ca.crt
#      - APP_CERTIFICATE_KEYSIZE=2048
#      - APP_CERTIFICATE_KEYFACTORYTYPE=RSA
#      - APP_CERTIFICATE_SIGNATUREALGORITHM=1.2.840.113549.1.1.11
#      - APP_CERTIFICATE_KEYSTOREPASSWORD=123456
#      - APP_CERTIFICATE_CAVALIDITYYEARS=10
#      - APP_CERTIFICATE_USERVALIDITYYEARS=1
#    restart: unless-stopped
#    healthcheck:
#      test: [ "CMD", "curl", "-f", "http://localhost:8080/health" ]
#      interval: 30s
#      timeout: 10s
#      retries: 3
#      start_period: 40s