services:
  crowdsec:
    image: crowdsecurity/crowdsec:${CROWDSEC_VERSION:-v1.8.1}
    container_name: epicnext-crowdsec
    restart: unless-stopped
    profiles: ["security"]
    environment:
      DISABLE_AGENT: "true"
      BOUNCER_KEY_cms: ${CROWDSEC_LAPI_API_KEY:?CROWDSEC_LAPI_API_KEY must be set}
      DISABLE_ONLINE_API: "true"
      GID: "${CROWDSEC_GID:-0}"
      TZ: "${TZ:-UTC}"
    ports:
      - "${CROWDSEC_LAPI_BIND_HOST:-127.0.0.1}:${CROWDSEC_LAPI_PORT:-18080}:8080"
    volumes:
      - ./acquis.d:/etc/crowdsec/acquis.d:ro
      - ${CROWDSEC_NGINX_LOG_DIR:-/var/log/nginx}:/var/log/nginx:ro
      - crowdsec-config:/etc/crowdsec
      - crowdsec-data:/var/lib/crowdsec/data
    security_opt:
      - no-new-privileges:true
    pids_limit: 256
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -q -O - http://127.0.0.1:8080/health >/dev/null 2>&1",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s

volumes:
  crowdsec-config:
  crowdsec-data: