docker-compose.yaml

services:
  electrumx:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: electrumx_server
    restart: unless-stopped
    ports:
      - "50010:50010"   # Port for TCP connections
      - "50011:50011"   # Port for WSS connections (Photonic wallet)
      - "50012:50012"   # Port for SSL connections
      # Operator/admin RPC (rpc://127.0.0.1:8000) is intentionally NOT published.
      # It must stay loopback-only; never expose it off-host.
    cap_add:
      - SYS_PTRACE
    environment:
      - DAEMON_URL=${DAEMON_URL}
      - COIN=${COIN}
      - NET=${NET}
      - REQUEST_TIMEOUT=${REQUEST_TIMEOUT}
      - DB_DIRECTORY=${DB_DIRECTORY}
      - DB_ENGINE=${DB_ENGINE}
      - SERVICES=${SERVICES}
      - SSL_CERTFILE=${SSL_CERTFILE}
      - SSL_KEYFILE=${SSL_KEYFILE}
      - ALLOW_ROOT=${ALLOW_ROOT}
      - CACHE_MB=${CACHE_MB}
      - MAX_SESSIONS=${MAX_SESSIONS}
      - MAX_SEND=${MAX_SEND}
      - MAX_RECV=${MAX_RECV}
    # NOTE: host networking is deliberately NOT used. With network_mode: host the
    # `ports:` mapping is ignored and EVERY bound service (including the operator
    # RPC on 127.0.0.1:8000) is published on the host, defeating the loopback
    # pinning above. Keep bridge networking so only the ports listed above are
    # reachable off-host.
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 50010 || exit 1"]
      interval: 60s
      timeout: 5s
      retries: 3
      start_period: 300s
    stop_signal: SIGTERM
    stop_grace_period: 180s
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
    deploy:
      resources:
        reservations:
          memory: 4G
    volumes:
      - ./electrumdb:/root/electrumdb   # Mount local directory for database and SSL keys
    entrypoint: ["python3", "electrumx_server"]