services:
  contact-form:
    build: .
    container_name: contact-form
    restart: unless-stopped

    # Only expose to localhost - nginx will proxy
    ports:
      - "127.0.0.1:7000:7000"

    env_file:
      - .env

    # Security hardening
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp

    networks:
      contact-form-net:
      mailcow-network:
        ipv4_address: 172.22.1.243

    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 128M
        reservations:
          memory: 64M

    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1",
             "--spider", "http://localhost:7000/v1/demo"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

networks:
  contact-form-net:
    driver: bridge
  mailcow-network:
    external: true
    name: mailcowdockerized_mailcow-network