services:
  bitmessage:
    build:
      context: ./docker
      dockerfile: Dockerfile
    image: registry.bitdeals.org/bitmessage
    environment:
      - BITMESSAGE_API_USER=bitmessage_api_user
      - BITMESSAGE_API_PASSWORD=bitmessage_api_password
      - BITMESSAGE_SEED_PHRASE=
      - BITMESSAGE_SEED_ADDRESSES=1
      - BITMESSAGE_TTL=172800
      - BITMESSAGE_STOPRESENDINGAFTERXDAYS=60
      - BITMESSAGE_MAXTOTALCONNECTIONS=40
    ports:
      # The API controls the daemon completely and has no TLS, so it never
      # leaves loopback -- the README has said so all along, this file did not.
      - 127.0.0.1:8442:8442
      # P2P. Only 8444:8444 works — the daemon announces its own configured
      # port to peers, not the one you mapped it to. Drop this line to run
      # outbound-only.
      - 8444:8444
    volumes:
      - bitmessage:/home/bitmessage
    # A clean shutdown does not fit in Docker's default ten seconds; the last
    # notes in the README explain this line and the five below it. The image
    # runs as its own unprivileged user and needs no capability at all, so the
    # drop is unconditional -- but what the root filesystem and the process
    # count allow is the caller's to set, and nobody else's.
    stop_grace_period: 90s
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=64m
      - /run:rw,noexec,nosuid,nodev,size=8m
    pids_limit: 200
    mem_limit: 1g
    cpus: 2
volumes:
  bitmessage: