name: devrunbook

x-app-environment: &app-environment
  DATABASE_URL: postgresql://devrunbook:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD to a URL-safe random value}@postgres:5432/devrunbook
  PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:?Set PUBLIC_BASE_URL to the exact externally visible URL}
  SESSION_SECRET: ${SESSION_SECRET:?Set SESSION_SECRET to at least 32 random bytes}
  INTEGRATION_ENCRYPTION_KEY: ${INTEGRATION_ENCRYPTION_KEY:?Set INTEGRATION_ENCRYPTION_KEY to a base64-encoded 32-byte key}
  INTEGRATION_ENCRYPTION_KEY_VERSION: ${INTEGRATION_ENCRYPTION_KEY_VERSION:-v1}
  INTEGRATION_ENCRYPTION_OLD_KEYS: '${INTEGRATION_ENCRYPTION_OLD_KEYS:-{}}'
  CONTENT_ROOT: /content
  ARTIFACT_ROOT: /artifacts
  BOOTSTRAP_TOKEN: ${BOOTSTRAP_TOKEN:?Set BOOTSTRAP_TOKEN to a random first-run token}
  REGISTRATION_MODE: ${REGISTRATION_MODE:-closed}
  TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-}
  MAINTENANCE_MODE: ${MAINTENANCE_MODE:-false}
  MAX_IMPORT_BYTES: ${MAX_IMPORT_BYTES:-10485760}
  MAX_EXPANDED_ARCHIVE_BYTES: ${MAX_EXPANDED_ARCHIVE_BYTES:-52428800}
  MAX_ARCHIVE_FILES: ${MAX_ARCHIVE_FILES:-500}
  MAX_SINGLE_FILE_BYTES: ${MAX_SINGLE_FILE_BYTES:-5242880}
  MAX_PROMPT_BYTES: ${MAX_PROMPT_BYTES:-2097152}
  MAX_EVIDENCE_BYTES: ${MAX_EVIDENCE_BYTES:-262144}
  MAX_ARTIFACT_BYTES: ${MAX_ARTIFACT_BYTES:-5242880}
  GITEA_PRIVATE_NETWORK_POLICY: ${GITEA_PRIVATE_NETWORK_POLICY:-deny}
  GITEA_ALLOWED_HOSTS: ${GITEA_ALLOWED_HOSTS:-}
  GITEA_REQUEST_TIMEOUT_MS: ${GITEA_REQUEST_TIMEOUT_MS:-15000}
  GITEA_MAX_REDIRECTS: ${GITEA_MAX_REDIRECTS:-3}
  GITEA_MAX_FILE_BYTES: ${GITEA_MAX_FILE_BYTES:-1048576}
  GITEA_MAX_FILES_PER_SNAPSHOT: ${GITEA_MAX_FILES_PER_SNAPSHOT:-200}
  ARTIFACT_RETENTION_DAYS: ${ARTIFACT_RETENTION_DAYS:-90}
  AUDIT_RETENTION_DAYS: ${AUDIT_RETENTION_DAYS:-180}
  LOG_RETENTION_DAYS: ${LOG_RETENTION_DAYS:-30}
  SNAPSHOT_RETENTION_COUNT: ${SNAPSHOT_RETENTION_COUNT:-20}
  LOG_LEVEL: ${LOG_LEVEL:-info}
  WORKER_POLL_INTERVAL_MS: ${WORKER_POLL_INTERVAL_MS:-2000}
  JOB_LEASE_SECONDS: ${JOB_LEASE_SECONDS:-60}
  REPOSITORY_REFRESH_SCHEDULE_MS: ${REPOSITORY_REFRESH_SCHEDULE_MS:-300000}
  REPOSITORY_STALE_AFTER_HOURS: ${REPOSITORY_STALE_AFTER_HOURS:-24}

x-app-security: &app-security
  init: true
  read_only: true
  pids_limit: 256
  mem_limit: 1g
  tmpfs:
    - /tmp:size=64m,mode=1777
  security_opt:
    - no-new-privileges:true
  cap_drop:
    - ALL

services:
  postgres:
    image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
    environment:
      POSTGRES_DB: devrunbook
      POSTGRES_USER: devrunbook
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD to a URL-safe random value}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'psql -U devrunbook -d devrunbook -tAc "select 1" | grep -qx 1',
        ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s
    restart: unless-stopped
    pids_limit: 256
    mem_limit: 1g
    security_opt:
      - no-new-privileges:true

  migrate:
    build:
      context: .
      target: migrate
    environment: *app-environment
    depends_on:
      postgres:
        condition: service_healthy
    restart: 'no'
    read_only: true
    pids_limit: 128
    mem_limit: 512m
    tmpfs:
      - /tmp:size=64m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  web:
    <<: *app-security
    build:
      context: .
      target: web
    environment: *app-environment
    depends_on:
      migrate:
        condition: service_completed_successfully
    ports:
      - '127.0.0.1:${DEVRUNBOOK_PORT:-3000}:3000'
    volumes:
      - operator-content:/operator-content:ro
      - artifacts:/artifacts
    restart: unless-stopped

  worker:
    <<: *app-security
    build:
      context: .
      target: worker
    environment: *app-environment
    depends_on:
      migrate:
        condition: service_completed_successfully
    volumes:
      - operator-content:/operator-content:ro
      - artifacts:/artifacts
    restart: unless-stopped

volumes:
  postgres-data:
  operator-content:
  artifacts: