---
version: "3.8"

services:
  app:
    image: ${CONTAINER_REGISTRY:-bonfirenetworks/bonfire}:${APP_VERSION:-1.0.5}-${APP_FLAVOUR:-social}-${APP_PLATFORM:-amd64}
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "10"
    depends_on:
      - db
    environment:
      - PUBLIC_PORT=443
      - MIX_ENV=prod
      
      - HOSTNAME=${DOMAIN}
      - INSTANCE_DESCRIPTION
      - DISABLE_DB_AUTOMIGRATION
      - UPLOAD_LIMIT
      - INVITE_KEY
      - LANG=${LANG:-en_US.UTF-8}
      - SEEDS_USER=${SEEDS_USER:-root}
      - REPLACE_OS_VARS=${REPLACE_OS_VARS:-true}
      - LIVEVIEW_ENABLED=${LIVEVIEW_ENABLED:-true}
      - APP_NAME=${APP_NAME:-Bonfire}
      - PLUG_SERVER
      - WITH_LV_NATIVE=${WITH_LV_NATIVE:-0}
      - WITH_IMAGE_VIX=${WITH_IMAGE_VIX:-1}
      - WITH_AI=${WITH_AI:-0}
      - LIVE_DASHBOARD_LOGGER=${LIVE_DASHBOARD_LOGGER:-false}
      - IFRAME_ALLOWED_ORIGINS
      - RELEASE_DISTRIBUTION
      - RELEASE_NODE
      - RELEASE_MODE
      
      - DB_SLOW_QUERY_MS
      - DB_STATEMENT_TIMEOUT
      - DB_QUERY_TIMEOUT
      - DB_JIT
      - DB_MIGRATE_INDEXES_CONCURRENTLY
      - PROD_LOG_LEVEL

      - SENTRY_DSN

      - GEOLOCATE_OPENCAGEDATA
      
      - ENABLE_SSO_PROVIDER
      - OAUTH_ISSUER

      - SECRET_KEY_BASE_FILE=/run/secrets/secret_key_base
      - SIGNING_SALT_FILE=/run/secrets/signing_salt
      - ENCRYPTION_SALT_FILE=/run/secrets/encryption_salt
      - SEEDS_PW_FILE=/run/secrets/seeds_pw
      - LIVEBOOK_PASSWORD_FILE=/run/secrets/livebook_password
      - RELEASE_COOKIE_FILE=/run/secrets/release_cookie

    secrets:
      - secret_key_base
      - signing_salt
      - encryption_salt
      - seeds_pw
      - livebook_password
      - release_cookie
    volumes:
      - upload-data:/opt/app/data/uploads
    networks:
      - proxy
      - internal
    entrypoint: ["/docker-entrypoint.sh", "./bin/bonfire", "start"]
    configs:
      - source: app_entrypoint
        target: /docker-entrypoint.sh
        mode: 0555
    deploy:
      restart_policy:
        condition: on-failure
      labels:
        # how long abra waits for the deploy to converge, as needs headroom for DB migrations on upgrades
        # and the db service's 2m stop_grace_period during redeploys
        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-300}"
        - "backupbot.backup=${ENABLE_BACKUPS:-true}"
        - "traefik.enable=true"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=4000"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "coop-cloud.${STACK_NAME}.version=1.0.0+1.0.5-social-amd64"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:4000"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 15s

volumes:
  upload-data:

networks:
  proxy:
    external: true
  internal:

configs:
  app_entrypoint:
    name: ${STACK_NAME}_app_entrypoint_${APP_ENTRYPOINT_VERSION:-v3}
    file: entrypoint.sh.tmpl
    template_driver: golang

secrets:
  secret_key_base:
    external: true
    name: ${STACK_NAME}_secret_key_base_${SECRET_SECRET_KEY_BASE_VERSION:-v1}
  signing_salt:
    external: true
    name: ${STACK_NAME}_signing_salt_${SECRET_SIGNING_SALT_VERSION:-v1}
  encryption_salt:
    external: true
    name: ${STACK_NAME}_encryption_salt_${SECRET_ENCRYPTION_SALT_VERSION:-v1}
  seeds_pw:
    external: true
    name: ${STACK_NAME}_seeds_pw_${SECRET_SEEDS_PW_VERSION:-v1}
  livebook_password:
    external: true
    name: ${STACK_NAME}_livebook_password_${SECRET_LIVEBOOK_PASSWORD_VERSION:-v1}
  release_cookie:
    external: true
    name: ${STACK_NAME}_release_cookie_${SECRET_RELEASE_COOKIE_VERSION:-v1}