services:
  docuseal:
    # 3.3.5, per Digest gepinnt am 2026-11-09 - Updates nur bewusst von Hand (siehe .no-auto-update)
    image: docuseal/docuseal@sha256:d3fb5bd51509aac293e858c37e113882a70d5b97975fa44bfbf232bbfb17175d
    container_name: docuseal
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    ports:
      - "127.0.0.1:3003:3000"
    volumes:
      - ./data:/data
      - ./branding:/app/public/branding:ro
      - ./overrides/mailer.html.erb:/app/app/views/layouts/mailer.html.erb:ro
      - ./overrides/redis_server.rb:/app/lib/puma/plugin/redis_server.rb:ro
      - ./overrides/_attribution.html.erb:/app/app/views/shared/_attribution.html.erb:ro
      - ./overrides/form-layout.html.erb:/app/app/views/layouts/form.html.erb:ro
      - ./health.sh:/usr/local/bin/ds-health:ro
    environment:
      - FORCE_SSL=false
      - SECRET_KEY_BASE=<eigener-Wert>
    healthcheck:
      test: ["CMD", "/bin/sh", "/usr/local/bin/ds-health"]
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 120s