services:
  postgres:
    image: postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-kita_planer}
      POSTGRES_USER: ${POSTGRES_USER:-kita_planer}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
    volumes:
      - kita_planer_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 10
    restart: unless-stopped

  app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:?}
        NEXT_PUBLIC_UMAMI_SCRIPT_URL: ${NEXT_PUBLIC_UMAMI_SCRIPT_URL:-}
        NEXT_PUBLIC_UMAMI_WEBSITE_ID: ${NEXT_PUBLIC_UMAMI_WEBSITE_ID:-}
        NEXT_PUBLIC_UMAMI_DOMAINS: ${NEXT_PUBLIC_UMAMI_DOMAINS:-}
    environment:
      NODE_ENV: production
      PORT: 3000
      HOSTNAME: 0.0.0.0
      # A nonempty sentinel survives hosting Compose parsers and blocks global env_file credentials.
      DATABASE_URL: "unavailable-in-app"
      MIGRATION_DATABASE_URL: "unavailable-in-app"
      APP_DATABASE_PASSWORD: "unavailable-in-app"
      POSTGRES_PASSWORD: "unavailable-in-app"
      PGADMIN_DEFAULT_PASSWORD: "unavailable-in-app"
      APP_DATABASE_PASSWORD_FILE: /app/runtime-secrets/database-password
      APP_DATABASE_NAME: ${POSTGRES_DB:-kita_planer}
      AUTH_SECRET: ${AUTH_SECRET:?}
      AUTH_URL: ${AUTH_URL:?}
      NEXTAUTH_URL: ${NEXTAUTH_URL:?}
      NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:?}
      NEXT_PUBLIC_UMAMI_SCRIPT_URL: ${NEXT_PUBLIC_UMAMI_SCRIPT_URL:-}
      NEXT_PUBLIC_UMAMI_WEBSITE_ID: ${NEXT_PUBLIC_UMAMI_WEBSITE_ID:-}
      NEXT_PUBLIC_UMAMI_DOMAINS: ${NEXT_PUBLIC_UMAMI_DOMAINS:-}
      RESEND_API_KEY: ${RESEND_API_KEY:?}
      EMAIL_FROM: ${EMAIL_FROM:?}
      ADMIN_EMAIL: ${ADMIN_EMAIL:?}
      NOTDIENST_JOB_SECRET: ${NOTDIENST_JOB_SECRET:?}
      UPLOAD_DIR: /app/uploads/announcements
      UPLOAD_TENANT_QUOTA_BYTES: ${UPLOAD_TENANT_QUOTA_BYTES:-268435456}
      UPLOAD_GLOBAL_QUOTA_BYTES: ${UPLOAD_GLOBAL_QUOTA_BYTES:-10737418240}
      TRUSTED_CLIENT_IP_HEADER: ${TRUSTED_CLIENT_IP_HEADER:-}
    volumes:
      - kita_planer_uploads:/app/uploads
      - kita_planer_next_cache:/app/.next/cache
      - kita_planer_runtime_secrets:/app/runtime-secrets:ro
    depends_on:
      postgres:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    expose:
      - "3000"
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    pids_limit: 256
    mem_limit: 1g
    cpus: "1.0"
    restart: unless-stopped

  migrate:
    build:
      context: .
      dockerfile: Dockerfile
      target: migrator
      args:
        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:?}
    environment:
      NODE_ENV: production
      POSTGRES_DB: ${POSTGRES_DB:-kita_planer}
      POSTGRES_USER: ${POSTGRES_USER:-kita_planer}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
      APP_DATABASE_PASSWORD_FILE: /app/runtime-secrets/database-password
      UPLOAD_DIR: /app/uploads/announcements
    command: ["node", "scripts/initialize-production.mjs"]
    volumes:
      - kita_planer_uploads:/app/uploads
      - kita_planer_next_cache:/app/runtime-cache
      - kita_planer_runtime_secrets:/app/runtime-secrets
    depends_on:
      postgres:
        condition: service_healthy
    restart: "no"

  pgadmin:
    profiles: ["maintenance"]
    image: dpage/pgadmin4@sha256:c332c5f6dfba995d9ebc4af261d93506d6876085d712eaaa3defc8dd1a3f26de
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL:?}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD:?}
      PGADMIN_CONFIG_ENHANCED_COOKIE_PROTECTION: "True"
      PGADMIN_CONFIG_CONSOLE_LOG_LEVEL: 30
    volumes:
      - kita_planer_pgadmin_data:/var/lib/pgadmin
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "127.0.0.1:5050:80"
    restart: unless-stopped

volumes:
  kita_planer_postgres_data:
  kita_planer_uploads:
  kita_planer_next_cache:
  kita_planer_runtime_secrets:
  kita_planer_pgadmin_data: