# Optional server-only credentials mount. Combine with compose.yml after setup.
services:
  web:
    environment:
      GOOGLE_APPLICATION_CREDENTIALS: /run/secrets/firebase-service-account.json
    volumes:
      - type: bind
        source: ${FIREBASE_SERVICE_ACCOUNT_FILE:?Set an absolute path to this environment's Firebase service account JSON}
        target: /run/secrets/firebase-service-account.json
        read_only: true
        bind:
          create_host_path: false