docker-compose.yml

services:
  democratic-linux:
    build: .
    ports:
      - "${HTTP_PORT:-80}:80"
      - "${HTTPS_PORT:-443}:443"
    volumes:
      - vm-data:/app/vm
      - ./certs:/app/certs    # writable — needed for auto-generated self-signed cert
    security_opt:
      - label:disable
    privileged: true
    restart: on-failure:3
    environment:
      - HTTP_PORT=80
      - HTTPS_PORT=443
      - QEMU_MEM=512M
      - QEMU_CPUS=1
      # Set to 1 to block external network access inside the VM (recommended for public deployments).
      # SSH forwarding still works so browser tabs are unaffected.
      - BLOCK_NETWORK=1
      # SSL is opt-in. To enable HTTPS set SSL_CERT and SSL_KEY to PEM file paths
      # and optionally set GENERATE_SELF_SIGNED_CERT=true to auto-generate a cert.
      # Example:
      #   SSL_CERT=/app/certs/cert.pem
      #   SSL_KEY=/app/certs/key.pem
      #   GENERATE_SELF_SIGNED_CERT=true

volumes:
  vm-data: