services:
  card-grader:
    build: .
    container_name: card-grader
    restart: unless-stopped
    # Bound to 127.0.0.1 deliberately: nginx (running on the Unraid host,
    # or in its own container sharing the host network) is the only thing
    # that should reach this port directly. Nothing on the LAN or internet
    # can hit :8778 without going through nginx's TLS termination.
    ports:
      - "127.0.0.1:8778:8778"
    volumes:
      - ./data:/data
    environment:
      # Refuses settings writes from anyone but you, so a visitor can't
      # overwrite your API key or switch to a pricier model. Set your key
      # via the container's own console the first time (see README), then
      # leave this on.
      - CARD_GRADER_LOCK=1