services:
  journal:
    build: .
    ports:
      - "3000:3000"
    volumes:
      - ./data:/data
    environment:
      # Optional: require a password (recommended when exposed beyond localhost)
      # JOURNAL_PASSWORD: change-me
      # Optional: stable encryption secret for broker credentials at rest
      # JOURNAL_SECRET: change-me-too
      JOURNAL_DATA_DIR: /data
    restart: unless-stopped