services:
  history-collector:
    build: .
    container_name: history-collector
    restart: unless-stopped
    env_file: .env
    ports:
      # Keep it bound to localhost unless you deliberately put it behind a reverse proxy/VPN.
      - 8080:8080
    volumes:
      - ./data:/data
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp