name: vacatureradar

x-app: &app
  build:
    context: .
  image: vacatureradar:local
  user: "10001:10001"
  read_only: true
  tmpfs:
    - /tmp:rw,noexec,nosuid,size=128m
    - /var/tmp:rw,noexec,nosuid,size=128m
    - /app/.cache:rw,noexec,nosuid,size=128m
  env_file:
    - ${VACATURERADAR_ENV_FILE:-.env}
  restart: unless-stopped
  environment:
    CACHE_URL: ${CACHE_URL:-redis://redis:6379/1}
    HEALTHCHECK_REQUIRE_CACHE: ${HEALTHCHECK_REQUIRE_CACHE:-1}
  security_opt:
    - no-new-privileges:true
  volumes:
    - ./local/media:/app/media
    - ./local/logs:/app/logs
    - ./local:/app/local
  networks:
    - internal
  depends_on:
    postgres:
      condition: service_healthy
    redis:
      condition: service_healthy

services:
  web:
    <<: *app
    ports:
      - "0.0.0.0:1226:8080"
    healthcheck:
      test: ["CMD", "python", "scripts/healthcheck.py", "http://127.0.0.1:8080/health/ready/"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s

  worker:
    <<: *app
    environment:
      VACATURERADAR_RUN_MIGRATIONS: "0"
      CACHE_URL: ${CACHE_URL:-redis://redis:6379/1}
      HEALTHCHECK_REQUIRE_CACHE: ${HEALTHCHECK_REQUIRE_CACHE:-1}
    cap_drop:
      - ALL
    command: ["celery", "-A", "config", "worker", "-l", "INFO", "-Q", "high,default,low", "--concurrency=2"]
    healthcheck:
      test: ["CMD-SHELL", "celery -A config inspect ping -d celery@$$HOSTNAME --timeout=5 | grep -q pong"]
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 45s

  scheduler:
    <<: *app
    environment:
      VACATURERADAR_RUN_MIGRATIONS: "0"
      CACHE_URL: ${CACHE_URL:-redis://redis:6379/1}
      HEALTHCHECK_REQUIRE_CACHE: ${HEALTHCHECK_REQUIRE_CACHE:-1}
    cap_drop:
      - ALL
    command: ["celery", "-A", "config", "beat", "-l", "INFO", "--schedule", "/tmp/celerybeat-schedule"]

  postgres:
    image: postgres:17.5-bookworm
    restart: unless-stopped
    environment:
      POSTGRES_DB: vacatureradar
      POSTGRES_USER: vacatureradar
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-CHANGE_ME}
    volumes:
      - ./local/postgres:/var/lib/postgresql/data
    networks:
      - internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U vacatureradar -d vacatureradar"]
      interval: 10s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7.4.2-alpine
    restart: unless-stopped
    command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"]
    volumes:
      - ./local/redis:/data
    networks:
      - internal
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 10

  ollama:
    image: ollama/ollama:0.9.6
    profiles: ["ai"]
    restart: unless-stopped
    volumes:
      - ./local/ollama:/root/.ollama
    networks:
      - internal

networks:
  internal:
    driver: bridge
    internal: false