services:
  saraview:
    build: .
    container_name: SaraView
    ports:
      # Bind to your Tailscale IP only, e.g. "100.x.x.x:8420:8420",
      # so the app is reachable over the tailnet and nothing else.
      - "8420:8420"
    volumes:
      # Your own config, overriding the one baked into the image — edit
      # Roots and SaraTag.CoreModulePath to match your real paths below.
      - ./SaraViewConf.toml:/App/Backend/SaraViewConf.toml:ro
      # Persistent app data: Settings.toml + Themes/. A named volume (not a
      # host path) is fine here — nothing outside SaraView needs to touch it,
      # and this is what keeps it structurally unreachable from the file
      # browser regardless of any hidden-file setting.
      - saraview_data:/data/SaraViewData
      # One mount per root you declare in SaraViewConf.toml's [Roots] table.
      - /path/to/your/notes:/data/notes:ro
      # SaraTag's internal folder, for read-only Book resolution.
      - /path/to/SaraTag/.saratag:/data/SaraTag/.saratag:ro
    restart: unless-stopped

volumes:
  saraview_data: