Security and deployment

Read-only config mounts, secrets handling, reverse proxy, SSO, and production compose.

Mount config.yml read-only (:ro)
Do not commit tokens to git. use env or secret files
Put Pulse behind VPN or reverse proxy with HTTPS
Pulse does not implement SSO, use OAuth2 Proxy, Authelia, Azure AD app proxy, etc.

Production compose:

services:
  pulse:
    image: pulse:1.0.0
    ports: ["8080:8080"]
    volumes:
      - ./config.yml:/app/config.yml:ro
    restart: unless-stopped

Health check: GET /health