version: '3.1'

services:

  ghost:
    image: ghost:5-alpine
    restart: always
    expose: 
      - "8084"
    ports:
      - 8084:2368
    environment:
      # see https://ghost.org/docs/config/#configuration-options
      database__client: mysql
      database__connection__host: db
      database__connection__user: ghost
      database__connection__password: 
      database__connection__database: ghostdb
      # this url value is just an example, and is likely wrong for your environment!
      url: https://blog.conorz.at/
      # contrary to the default mentioned in the linked documentation, this image defaults to NODE_ENV=production (so development mode needs to be explicitly specified if desired)
      #NODE_ENV: development
    volumes:
      - ./ghost:/var/lib/ghost/content

  db:
    image: ghcr.io/polarix-containers/mariadb:11.4-alpine
    restart: always
    environment:
        MYSQL_ROOT_PASSWORD: 
        MYSQL_USER: ghost
        MYSQL_PASSWORD:
        MYSQL_DATABASE: ghostdb
    volumes:
      - ./db:/var/lib/mysql
    user: "3005:3005"
    read_only: true
    tmpfs:
      - /var/tmp:mode=0770,uid=3005,gid=3005,noexec,nosuid,nodev
      - /run/mariadb:size=50M,mode=0770,uid=3005,gid=3005,noexec,nosuid,nodev
    security_opt:
      - "no-new-privileges=true"
    cap_drop:
      - ALL

volumes:
  ghost:
  db: