services:
  tripplan:
    build: .
    ports:
      - "3000:3000"
    volumes:
      # SQLite database lives in ./data next to this compose file and
      # persists across container rebuilds. The entrypoint fixes ownership
      # automatically (the app itself runs as the unprivileged `node` user).
      - ./data:/app/data
    environment:
      # CHANGE THIS: set a long random string before exposing the app.
      # e.g. `openssl rand -hex 32`
      SESSION_SECRET: "change-me-to-a-long-random-secret"
    restart: unless-stopped