services:
  app:
    image: ${IMAGE}
    container_name: keep
    restart: unless-stopped
    pull_policy: always
    ports:
      - "${HOST_PORT:-3050}:3050"
    environment:
      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
      - REQUEST_MAX_SKEW_SECONDS=${REQUEST_MAX_SKEW_SECONDS:-300}
    volumes:
      # Named volume, not a bind mount — the SQLite DB holding vaults,
      # recipients, and grants must survive redeploys.
      - keep-data:/app/data

volumes:
  keep-data: