---
# NOTE(d1): adapted from the following upstream docker-compose.yml
# https://github.com/coopdevs/timeoverflow/blob/develop/docker-compose.yml

services:
  app:
    image: git.coopcloud.tech/coop-cloud-chaos-patchs/timeoverflow:v5.4.2
    environment:
      - ADMINS
      - ALLOWED_HOSTS="localhost ${DOMAIN} www.${DOMAIN}"
      - FORCE_SSL=false
      - RAILS_ENV=production
      - RAILS_LOG_LEVEL
      - RAILS_LOG_TO_STDOUT=true
      - RAILS_SERVE_STATIC_FILES=true
      - REDIS_URL=redis://cache:6379/0
      - STORAGE_PROVIDER=local
      - TIMEOVERFLOW_DB_PASSWORD_FILE=/run/secrets/db_password
      - TIMEOVERFLOW_SECRET_KEY_BASE_FILE=/run/secrets/secret_key_base
    volumes:
      - storage:/app/storage
    secrets:
      - secret_key_base
      - db_password
    configs:
      - source: app_entrypoint
        target: /app/entrypoint.sh
        mode: 0555
    entrypoint: /app/entrypoint.sh
    command: /usr/bin/supervisord
    networks:
      - proxy
      - internal
    deploy:
      update_config:
        failure_action: rollback
        order: start-first
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.services.${STACK_NAME}_web.loadbalancer.server.port=3000"
        - "traefik.http.routers.${STACK_NAME}_web.rule=Host(`${DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}_web.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}_web.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "coop-cloud.${STACK_NAME}.version=0.1.0+v5.4.2"

  worker:
    image: git.coopcloud.tech/coop-cloud-chaos-patchs/timeoverflow:v5.4.2
    networks:
      - internal
    environment:
      - ADMINS
      - ALLOWED_HOSTS="localhost ${DOMAIN} www.${DOMAIN}"
      - FORCE_SSL=false
      - RAILS_ENV=production
      - RAILS_LOG_LEVEL
      - RAILS_LOG_TO_STDOUT=true
      - RAILS_SERVE_STATIC_FILES=true
      - REDIS_URL=redis://cache:6379/0
      - RUN_SIDEKIQ=true
      - STORAGE_PROVIDER=local
      - TIMEOVERFLOW_DB_PASSWORD_FILE=/run/secrets/db_password
      - TIMEOVERFLOW_SECRET_KEY_BASE_FILE=/run/secrets/secret_key_base
    volumes:
      - storage:/app/storage
    secrets:
      - secret_key_base
      - db_password
    configs:
      - source: app_entrypoint
        target: /app/entrypoint.sh
        mode: 0555
    entrypoint: /app/entrypoint.sh
    command: /usr/bin/supervisord

  db:
    image: pgautoupgrade/pgautoupgrade:14-alpine
    environment:
      - POSTGRES_USER=timeoverflow
      - POSTGRES_DB=timeoverflow
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
      - PGDATA=/pgdata
    secrets:
      - db_password
    networks:
      - internal
    volumes:
      - postgres:/pgdata
    healthcheck:
      test: pg_isready -q -U timeoverflow -d timeoverflow
      interval: 10s
      timeout: 5s
      retries: 10

  cache:
    image: redis:8.4-alpine
    networks:
      - internal
    volumes:
      - redis:/data
    healthcheck:
      test: redis-cli ping
      interval: 10s
      timeout: 5s
      retries: 10

volumes:
  redis:
  postgres:
  storage:

configs:
  app_entrypoint:
    name: ${STACK_NAME}_app_entrypoint_${APP_ENTRYPOINT_VERSION}
    file: entrypoint.sh.tmpl
    template_driver: golang

secrets:
  db_password:
    external: true
    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
  secret_key_base:
    external: true
    name: ${STACK_NAME}_secret_key_base_${SECRET_SECRET_KEY_BASE_VERSION}

networks:
  internal:
  proxy:
    external: true