name: randomayzer-production
services:
  postgres:
    image: postgres:16-alpine
    container_name: randomayzer-postgres
    user: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: randomayzer
      POSTGRES_DB: randomayzer
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in the 0600 environment file}
    volumes:
      - database:/var/lib/postgresql/data
    networks: [database]
    mem_limit: 512m
    cpus: 1.0
    security_opt: [no-new-privileges:true]
    healthcheck:
      test: [CMD-SHELL, pg_isready -U randomayzer -d randomayzer]
      interval: 5s
      timeout: 3s
      retries: 30
  app:
    image: ${RANDOMAYZER_IMAGE:-randomayzer-app:stage1}
    build: .
    container_name: randomayzer-app
    user: node
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    env_file: ${RANDOMAYZER_ENV_FILE:?Set absolute path to a 0600 environment file}
    environment:
      NODE_ENV: production
      STORAGE_DRIVER: prisma
      DATABASE_URL: postgresql://randomayzer:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/randomayzer
      DEPLOYMENT_PROFILE: local-single-user
      APP_BASE_URL: http://localhost:3100
      VK_REDIRECT_URI: http://localhost:3100/api/auth/vk/callback
      TRUSTED_PROXY_IP: ""
      ALLOW_MEMORY_IDEMPOTENCY: "true"
      ALLOW_MEMORY_RATE_LIMITER: "true"
      PORT: "3100"
      BIND_ADDRESS: 0.0.0.0
    ports:
      - "127.0.0.1:${RANDOMAYZER_PORT:-3100}:3100"
    networks: [database, egress]
    mem_limit: 1g
    cpus: 1.5
    pids_limit: 256
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    healthcheck:
      test: [CMD, node, -e, "fetch('http://127.0.0.1:3100/api/auth/me').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 12
volumes:
  database:
    name: randomayzer-database
networks:
  database:
    name: randomayzer-database
    internal: true
  egress:
    name: randomayzer-egress