name: krona-staff-pilot

services:
  app:
    build:
      context: ../..
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: 8080
      LOG_LEVEL: info
      STAFF_RUNTIME_MODE: standalone
      STANDALONE_ACCESS: employee
      STANDALONE_MANAGER_TOKEN: ${STANDALONE_MANAGER_TOKEN:?STANDALONE_MANAGER_TOKEN is required}
      STANDALONE_TERMINAL_TOKEN: ${STANDALONE_TERMINAL_TOKEN:?STANDALONE_TERMINAL_TOKEN is required}
      STANDALONE_TENANT_ID: ${STANDALONE_TENANT_ID:?STANDALONE_TENANT_ID is required}
      STANDALONE_ACTOR_ID: ${STANDALONE_ACTOR_ID:?STANDALONE_ACTOR_ID is required}
      STANDALONE_TERMINAL_ACTOR_ID: ${STANDALONE_TERMINAL_ACTOR_ID:?STANDALONE_TERMINAL_ACTOR_ID is required}
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:?VAPID_PUBLIC_KEY is required}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:?VAPID_PRIVATE_KEY is required}
      VAPID_SUBJECT: ${VAPID_SUBJECT:?VAPID_SUBJECT is required}
      DATABASE_URL: postgres://krona_staff_app:${POSTGRES_APP_PASSWORD:?POSTGRES_APP_PASSWORD is required}@postgres:5432/krona_staff
      HTTPS_PFX_PATH: /run/secrets/staff.pfx
      HTTPS_PFX_PASSPHRASE: ${HTTPS_PFX_PASSPHRASE:?HTTPS_PFX_PASSPHRASE is required}
    ports:
      - '192.168.1.81:8453:8080'
    volumes:
      - ./secrets/staff.pfx:/run/secrets/staff.pfx:ro
    user: '1000:1000'
    depends_on:
      migrate: { condition: service_completed_successfully }
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    security_opt: ['no-new-privileges:true']
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'wget --no-check-certificate -q -O - https://127.0.0.1:8080/api/v1/staff/live || exit 1',
        ]
      interval: 30s
      timeout: 3s
      retries: 3

  db-role:
    build:
      context: ../..
      target: build
    environment:
      DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}@postgres:5432/krona_staff
      POSTGRES_APP_PASSWORD: ${POSTGRES_APP_PASSWORD:?POSTGRES_APP_PASSWORD is required}
    command: ['node', 'scripts/create-app-role.mjs']
    depends_on:
      postgres: { condition: service_healthy }
    restart: 'no'

  migrate:
    build:
      context: ../..
      target: build
    environment:
      DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}@postgres:5432/krona_staff
    command: ['node', 'scripts/migrate.mjs', 'up']
    depends_on:
      db-role: { condition: service_completed_successfully }
    restart: 'no'

  postgres:
    image: postgres:17-alpine@sha256:18cfe3ef5e6815560c98237d6216d1e5119702fb0f3894c8785dd58b8bbe5d73
    environment:
      POSTGRES_DB: krona_staff
      POSTGRES_USER: krona_migrator
      POSTGRES_PASSWORD: ${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U krona_migrator -d krona_staff']
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

volumes:
  postgres-data: