services:
  app:
    build: .
    env_file: .env
    ports: ["8080:8080"]
    depends_on:
      postgres: { condition: service_healthy }
      redis: { condition: service_healthy }
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    security_opt: ["no-new-privileges:true"]
  migrate:
    build: { context: ., target: build }
    env_file: .env
    command: ["node", "scripts/migrate.mjs", "up"]
    depends_on:
      postgres: { condition: service_healthy }
    profiles: ["tools"]
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_DB: krona_staff
      POSTGRES_USER: krona_staff
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-local-development-only}
    volumes: ["postgres-data:/var/lib/postgresql/data"]
    healthcheck: { test: ["CMD-SHELL", "pg_isready -U krona_staff -d krona_staff"], interval: 5s, timeout: 3s, retries: 20 }
  redis:
    image: redis:7-alpine
    command: ["redis-server", "--appendonly", "yes"]
    volumes: ["redis-data:/data"]
    healthcheck: { test: ["CMD", "redis-cli", "ping"], interval: 5s, timeout: 3s, retries: 20 }
volumes:
  postgres-data:
  redis-data: