docker-compose.yml

services:
  searxng:
    image: searxng/searxng:latest
    # AUDIT R8: localhost only — settings.yml ships limiter:false and a static
    # secret_key, so this port must never be reachable from outside the host.
    ports:
      - "127.0.0.1:8888:8080"
    volumes:
      - ./searxng/settings.yml:/etc/searxng/settings.yml:ro
      - ./searxng/limiter.toml:/etc/searxng/limiter.toml:ro
    environment:
      - SEARXNG_BASE_URL=http://localhost:8888
    restart: unless-stopped

  postgis:
    image: postgis/postgis:16-3.4
    # AUDIT R4: localhost only, and no default password — set POSTGRES_PASSWORD
    # in your environment or a .env file (see .env.example).
    ports:
      - "127.0.0.1:5432:5432"
    environment:
      - POSTGRES_DB=ravitools
      - POSTGRES_USER=ravitools
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    volumes:
      - postgis_data:/var/lib/postgresql/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ravitools -d ravitools"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  postgis_data: