services:
  message:
    build: ..
    image: message-native:local
    restart: unless-stopped
    read_only: true
    init: true
    tmpfs:
      - /tmp:size=256m,mode=1777
    ports:
      - "127.0.0.1:7860:7860"
    environment:
      MESSAGE_DATA_DIR: /var/lib/message
      MESSAGE_AUTH_MODE: supabase
      SUPABASE_URL: ${SUPABASE_URL:-}
      SUPABASE_PUBLISHABLE_KEY: ${SUPABASE_PUBLISHABLE_KEY:-}
      MESSAGE_PUBLIC_ORIGIN: ${MESSAGE_PUBLIC_ORIGIN:?请设置外部HTTPS源}
      MESSAGE_DATA_PERSISTENT: "true"
      MESSAGE_PLUGIN_ENV_ALLOWLIST_JSON: ${MESSAGE_PLUGIN_ENV_ALLOWLIST_JSON:?请显式设置插件变量允许名单JSON，不使用时填空对象}
      MESSAGE_ALLOWED_HOSTS: ${MESSAGE_ALLOWED_HOSTS:?请设置外部域名及127.0.0.1}
      MESSAGE_ALLOWED_ORIGINS: ${MESSAGE_ALLOWED_ORIGINS:?请设置允许的HTTPS界面源}
    volumes:
      - message-data:/var/lib/message
    stop_grace_period: 45s
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
volumes:
  message-data: