1 files changed, 59 insertions, 0 deletions
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..df4f9ec
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,59 @@
+version: '3.8'
+
+# =============================================================================
+# VAPORDROP - Zero-Knowledge Dead Drop
+# Stack: Go + Tor + X25519 + XChaCha20 + BLAKE3 (all non-NIST)
+# =============================================================================
+
+services:
+  vapordrop:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: vapordrop
+    restart: unless-stopped
+    
+    # Key from file (create .env with: VAPOR_KEY=your-passphrase)
+    env_file:
+      - .env
+    
+    volumes:
+      # Persistent Tor keys (same onion address across restarts)
+      - tor-data:/app/.tor
+      # File storage (ephemeral, but survives container restart)
+      - file-storage:/app/file_storage
+    
+    # Security hardening
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - NET_BIND_SERVICE  # For Tor
+    
+    # Read-only root filesystem
+    read_only: true
+    tmpfs:
+      - /tmp:size=256M,mode=1777
+    
+    # Resource limits
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+          cpus: '1.0'
+        reservations:
+          memory: 128M
+    
+    # Logging (minimal for privacy)
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+volumes:
+  tor-data:
+    driver: local
+  file-storage:
+    driver: local