services:
  lethe:
    build: .
    # Do NOT publish to the host: the trust model assumes a reverse proxy on
    # the host (Caddy/Traefik) that handles TLS + Authelia forward-auth and
    # forwards to lethe via this compose network.
    expose:
      - "8080"
    volumes:
      - ./data:/data
      - ./config.yaml:/config.yaml:ro
    restart: unless-stopped