services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: keychain
      POSTGRES_USER: keychain_app
      POSTGRES_PASSWORD: ${KEYCHAIN_DB_PASSWORD:?KEYCHAIN_DB_PASSWORD is required}
    volumes:
      - keychain-postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keychain_app -d keychain"]
      interval: 5s
      timeout: 5s
      retries: 12
    security_opt:
      - no-new-privileges:true

  api:
    build:
      context: ../apps/api
    restart: unless-stopped
    environment:
      KEYCHAIN_ENV: production
      KEYCHAIN_DATABASE_URL: postgresql://keychain_app:${KEYCHAIN_DB_PASSWORD}@postgres:5432/keychain
      KEYCHAIN_ALLOWED_ORIGINS: https://keychain.agent.snw.su
      KEYCHAIN_EXTENSION_ID: ${KEYCHAIN_EXTENSION_ID:-}
      KEYCHAIN_COOKIE_SECURE: "true"
      KEYCHAIN_SESSION_TTL_SECONDS: "1209600"
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "127.0.0.1:8799:8000"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/health')"]
      interval: 10s
      timeout: 5s
      retries: 12
    security_opt:
      - no-new-privileges:true

volumes:
  keychain-postgres: