services:
  app:
    build: .
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      PORT: ${PORT:-8080}
      HOST: 0.0.0.0
      LOG_LEVEL: ${LOG_LEVEL:-info}
      STAFF_RUNTIME_MODE: ${STAFF_RUNTIME_MODE:-standalone}
      STANDALONE_ACCESS: ${STANDALONE_ACCESS:-employee}
      DATABASE_URL: postgres://krona_staff_app:${POSTGRES_APP_PASSWORD:-local-app-only}@postgres:5432/krona_staff
      PLATFORM_GATEWAY_URL: ${PLATFORM_GATEWAY_URL:-}
      PLATFORM_JWT_ISSUER: ${PLATFORM_JWT_ISSUER:-}
      PLATFORM_JWT_AUDIENCE: ${PLATFORM_JWT_AUDIENCE:-}
      PLATFORM_JWKS_URL: ${PLATFORM_JWKS_URL:-}
      STANDALONE_TENANT_ID: ${STANDALONE_TENANT_ID:?Set STANDALONE_TENANT_ID to the platform organization ID}
      STANDALONE_ACTOR_ID: ${STANDALONE_ACTOR_ID:-01J00000000000000000000001}
    ports: ['8080:8080']
    depends_on:
      migrate: { condition: service_completed_successfully }
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    security_opt: ['no-new-privileges:true']
    healthcheck:
      test: ['CMD-SHELL', 'wget -q -O - http://127.0.0.1:8080/api/v1/staff/live || exit 1']
      interval: 30s
      timeout: 3s
      retries: 3
  db-role:
    build: { context: ., target: build }
    environment:
      DATABASE_MIGRATION_URL: postgres://${POSTGRES_MIGRATION_USER:-krona_migrator}:${POSTGRES_MIGRATION_PASSWORD:-local-migration-only}@postgres:5432/krona_staff
      POSTGRES_APP_PASSWORD: ${POSTGRES_APP_PASSWORD:-local-app-only}
    command: ['node', 'scripts/create-app-role.mjs']
    depends_on:
      postgres: { condition: service_healthy }
    restart: 'no'
  migrate:
    build: { context: ., target: build }
    environment:
      DATABASE_MIGRATION_URL: postgres://${POSTGRES_MIGRATION_USER:-krona_migrator}:${POSTGRES_MIGRATION_PASSWORD:-local-migration-only}@postgres:5432/krona_staff
    command: ['node', 'scripts/migrate.mjs', 'up']
    depends_on:
      db-role: { condition: service_completed_successfully }
    restart: 'no'
  postgres:
    image: postgres:17-alpine@sha256:18cfe3ef5e6815560c98237d6216d1e5119702fb0f3894c8785dd58b8bbe5d73
    environment:
      POSTGRES_DB: krona_staff
      POSTGRES_USER: ${POSTGRES_MIGRATION_USER:-krona_migrator}
      POSTGRES_PASSWORD: ${POSTGRES_MIGRATION_PASSWORD:-local-migration-only}
      POSTGRES_APP_PASSWORD: ${POSTGRES_APP_PASSWORD:-local-app-only}
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./docker/postgres/init-app-role.sh:/docker-entrypoint-initdb.d/10-app-role.sh:ro
    healthcheck:
      {
        test:
          ['CMD-SHELL', 'pg_isready -U ${POSTGRES_MIGRATION_USER:-krona_migrator} -d krona_staff'],
        interval: 5s,
        timeout: 3s,
        retries: 20,
      }
volumes:
  postgres-data: