services:
  postgres:
    image: postgres:16-alpine
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB_FILE: /run/secrets/postgres_db
      POSTGRES_USER_FILE: /run/secrets/postgres_user
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      POSTGRES_INITDB_ARGS: "--auth-host=scram-sha-256 --auth-local=scram-sha-256"
    secrets:
      - postgres_db
      - postgres_user
      - postgres_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - open-reception-internal
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -U $$(cat /run/secrets/postgres_user) -d $$(cat /run/secrets/postgres_db)",
        ]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 60s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    tmpfs:
      - /tmp
      - /var/run/postgresql
    read_only: true

  app:
    # use specific version here to watch for breaking changes
    image: openreception/open-reception:latest
    container_name: app
    restart: unless-stopped
    user: "1001:1001"
    environment:
      NODE_ENV: production
    secrets:
      - postgres_db
      - postgres_user
      - postgres_password
      - smtp_host
      - smtp_port
      - smtp_secure
      - smtp_user
      - smtp_pass
      - smtp_from_name
      - smtp_from_email
      - jwt_secret
      - management_domain
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - open-reception-internal
    healthcheck:
      test:
        ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    command: >
      sh -c "
        export POSTGRES_DB=$$(cat /run/secrets/postgres_db)
        export POSTGRES_USER=$$(cat /run/secrets/postgres_user)
        export POSTGRES_PASSWORD=$$(cat /run/secrets/postgres_password)
        export DATABASE_URL=\"postgres://$$POSTGRES_USER:$$POSTGRES_PASSWORD@postgres:5432/$$POSTGRES_DB\"
        export SMTP_HOST=$$(cat /run/secrets/smtp_host)
        export SMTP_PORT=$$(cat /run/secrets/smtp_port)
        export SMTP_SECURE=$$(cat /run/secrets/smtp_secure)
        export SMTP_USER=$$(cat /run/secrets/smtp_user)
        export SMTP_PASS=$$(cat /run/secrets/smtp_pass)
        export SMTP_FROM_NAME=$$(cat /run/secrets/smtp_from_name)
        export SMTP_FROM_EMAIL=$$(cat /run/secrets/smtp_from_email)
        export JWT_SECRET=$$(cat /run/secrets/jwt_secret)
        export MANAGEMENT_DOMAIN=$$(cat /run/secrets/management_domain)
        exec node build/index.js
      "
    read_only: true

  caddy:
    image: caddy:2
    container_name: caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data"
    networks:
      - open-reception-internal
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

secrets:
  postgres_db:
    file: ./secrets/postgres_db.txt
  postgres_user:
    file: ./secrets/postgres_user.txt
  postgres_password:
    file: ./secrets/postgres_password.txt
  smtp_host:
    file: ./secrets/smtp_host.txt
  smtp_port:
    file: ./secrets/smtp_port.txt
  smtp_secure:
    file: ./secrets/smtp_secure.txt
  smtp_user:
    file: ./secrets/smtp_user.txt
  smtp_pass:
    file: ./secrets/smtp_pass.txt
  smtp_from_name:
    file: ./secrets/smtp_from_name.txt
  smtp_from_email:
    file: ./secrets/smtp_from_email.txt
  jwt_secret:
    file: ./secrets/jwt_secret.txt

volumes:
  postgres_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /opt/openreception/postgres
  caddy-data:
    driver: local
    driver_opts:
      type: "none"
      o: "bind"
      device: "/opt/openreception/caddy/data"

networks:
  open-reception-internal:
    driver: bridge
    internal: false