name: vos

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-vos}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vos}
      POSTGRES_DB: ${POSTGRES_DB:-vos}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\""]
      interval: 5s
      timeout: 3s
      retries: 30
    volumes:
      - ${VOS_POSTGRES_DATA:-./.vos-data/postgres}:/var/lib/postgresql/data
    networks:
      - control

  redis:
    image: redis:7-alpine
    command:
      - sh
      - -lc
      - |
        if [ -n "$${REDIS_PASSWORD}" ]; then
          exec redis-server --appendonly yes --requirepass "$${REDIS_PASSWORD}"
        fi
        exec redis-server --appendonly yes
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:-vos}
    healthcheck:
      test: ["CMD-SHELL", "redis-cli --no-auth-warning -a \"$${REDIS_PASSWORD}\" ping | grep -q PONG"]
      interval: 5s
      timeout: 3s
      retries: 30
    volumes:
      - ${VOS_REDIS_DATA:-./.vos-data/redis}:/data
    networks:
      - control

  controller:
    build:
      context: .
      dockerfile: Dockerfile.controller
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER:-vos}:${POSTGRES_PASSWORD:-vos}@postgres:5432/${POSTGRES_DB:-vos}
      REDIS_URL: redis://:${REDIS_PASSWORD:-vos}@redis:6379
      VOS_PUBLIC_URL: ${VOS_PUBLIC_URL:-http://localhost:${VOS_HTTP_PORT:-8080}}
      VOS_CADDY_SITE: ${VOS_CADDY_SITE:-}
      VOS_TRUSTED_PROXY_CIDRS: ${VOS_TRUSTED_PROXY_CIDRS:-}
      VOS_ROOT_DOMAIN: ${VOS_ROOT_DOMAIN:-localhost}
      VOS_PRODUCTION_ROOT_DOMAIN: ${VOS_PRODUCTION_ROOT_DOMAIN:-}
      VOS_IMMUTABLE_ROOT_DOMAIN: ${VOS_IMMUTABLE_ROOT_DOMAIN:-}
      VOS_PREVIEW_ROOT_DOMAIN: ${VOS_PREVIEW_ROOT_DOMAIN:-}
      VOS_PULL_REQUEST_PREVIEW_ROOT_DOMAIN: ${VOS_PULL_REQUEST_PREVIEW_ROOT_DOMAIN:-}
      VOS_CREATE_PULL_REQUEST_PREVIEW_ALIAS: ${VOS_CREATE_PULL_REQUEST_PREVIEW_ALIAS:-}
      VOS_DOMAIN_TLS_FRONT_DOOR_HOSTS: ${VOS_DOMAIN_TLS_FRONT_DOOR_HOSTS:-}
      VOS_TLS_FRONT_DOOR_HOSTS: ${VOS_TLS_FRONT_DOOR_HOSTS:-}
      VOS_DATA_DIR: /data
      VOS_DEFAULT_PROJECT: ${VOS_DEFAULT_PROJECT:-default}
      VOS_CONTROL_NETWORK: ${VOS_CONTROL_NETWORK:-vos-control-net}
      VOS_RUNTIME_NETWORK: ${VOS_RUNTIME_NETWORK:-vos-runtime-net}
      VOS_RUNTIME_MEMORY: ${VOS_RUNTIME_MEMORY:-1536m}
      VOS_RUNTIME_CPUS: ${VOS_RUNTIME_CPUS:-1.5}
      VOS_RUNTIME_USER: ${VOS_RUNTIME_USER:-1000:1000}
      VOS_RUNTIME_PIDS_LIMIT: ${VOS_RUNTIME_PIDS_LIMIT:-256}
      VOS_RUNTIME_READ_ONLY: ${VOS_RUNTIME_READ_ONLY:-1}
      VOS_RUNTIME_TMPFS: ${VOS_RUNTIME_TMPFS:-}
      VOS_RUNTIME_EXTRA_TMPFS: ${VOS_RUNTIME_EXTRA_TMPFS:-}
      NODE_ENV: ${NODE_ENV:-production}
      VOS_NODE_BASE_IMAGE: ${VOS_NODE_BASE_IMAGE:-}
      VOS_DEPLOYMENT_SKIP_IMAGE_BOOTSTRAP: ${VOS_DEPLOYMENT_SKIP_IMAGE_BOOTSTRAP:-}
      VOS_DEPLOYMENT_ENV_SCRATCH_DIR: ${VOS_DEPLOYMENT_ENV_SCRATCH_DIR:-/tmp/vos-deployment-env}
      VOS_BUILD_QUEUE_WORKER: ${VOS_BUILD_QUEUE_WORKER:-1}
      VOS_BUILD_WORKER_ID: ${VOS_BUILD_WORKER_ID:-}
      VOS_BUILD_CONCURRENCY: ${VOS_BUILD_CONCURRENCY:-2}
      VOS_BUILD_QUEUE_POLL_MS: ${VOS_BUILD_QUEUE_POLL_MS:-1000}
      VOS_BUILD_LEASE_MS: ${VOS_BUILD_LEASE_MS:-60000}
      VOS_BUILD_TIMEOUT_MS: ${VOS_BUILD_TIMEOUT_MS:-1200000}
      VOS_BUILD_QUEUE_MAX_PENDING: ${VOS_BUILD_QUEUE_MAX_PENDING:-100}
      VOS_BUILD_QUEUE_MAX_PENDING_PER_ORG: ${VOS_BUILD_QUEUE_MAX_PENDING_PER_ORG:-25}
      VOS_BUILD_MEMORY: ${VOS_BUILD_MEMORY:-2048m}
      VOS_BUILD_CPU_PERIOD: ${VOS_BUILD_CPU_PERIOD:-100000}
      VOS_BUILD_CPU_QUOTA: ${VOS_BUILD_CPU_QUOTA:-150000}
      VOS_BUILD_CPUSET_CPUS: ${VOS_BUILD_CPUSET_CPUS:-}
      VOS_BUILD_SHM_SIZE: ${VOS_BUILD_SHM_SIZE:-512m}
      VOS_BUILD_NETWORK: ${VOS_BUILD_NETWORK:-}
      VOS_DEPLOYMENT_ARTIFACT_STORAGE: ${VOS_DEPLOYMENT_ARTIFACT_STORAGE:-filesystem}
      BLOB_BACKEND: ${BLOB_BACKEND:-local}
      BLOB_ROOT: ${BLOB_ROOT:-/blob}
      BLOB_MAX_OBJECT_BYTES: ${BLOB_MAX_OBJECT_BYTES:-}
      BLOB_S3_PROVIDER: ${BLOB_S3_PROVIDER:-}
      BLOB_S3_REQUIRE_FILE_CREDENTIALS: ${BLOB_S3_REQUIRE_FILE_CREDENTIALS:-false}
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_BUCKET: ${S3_BUCKET:-}
      S3_REGION: ${S3_REGION:-}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-}
      S3_ACCESS_KEY_ID_FILE: ${S3_ACCESS_KEY_ID_FILE:-}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
      S3_SECRET_ACCESS_KEY_FILE: ${S3_SECRET_ACCESS_KEY_FILE:-}
      S3_PREFIX: ${S3_PREFIX:-}
      S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE:-}
      VOS_ADMIN_TOKEN: ${VOS_ADMIN_TOKEN:?set VOS_ADMIN_TOKEN in .env}
      VOS_KMS_PROVIDER: ${VOS_KMS_PROVIDER:-local-dev-env}
      VOS_KMS_KEY_ID: ${VOS_KMS_KEY_ID:-local-dev}
      VOS_KMS_KEY_VERSION: ${VOS_KMS_KEY_VERSION:-v1}
      VOS_LOCAL_DEV_KMS_PRODUCTION_ACK: ${VOS_LOCAL_DEV_KMS_PRODUCTION_ACK:-}
      VOS_SECRET_KEK_BASE64: ${VOS_SECRET_KEK_BASE64:-}
      VOS_ANALYTICS_SALT: ${VOS_ANALYTICS_SALT:?set VOS_ANALYTICS_SALT in .env}
      VOS_OTEL_EXPORTER_OTLP_ENDPOINT: ${VOS_OTEL_EXPORTER_OTLP_ENDPOINT:-}
      VOS_OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: ${VOS_OTEL_EXPORTER_OTLP_TRACES_ENDPOINT:-}
      VOS_OTEL_EXPORTER_OTLP_HEADERS: ${VOS_OTEL_EXPORTER_OTLP_HEADERS:-}
      VOS_GITHUB_INSTALL_URL: ${VOS_GITHUB_INSTALL_URL:-}
      VOS_GITHUB_APP_SLUG: ${VOS_GITHUB_APP_SLUG:-}
      VOS_GITHUB_APP_ID: ${VOS_GITHUB_APP_ID:-}
      VOS_GITHUB_APP_PRIVATE_KEY: ${VOS_GITHUB_APP_PRIVATE_KEY:-}
      VOS_GITHUB_APP_PRIVATE_KEY_FILE: ${VOS_GITHUB_APP_PRIVATE_KEY_FILE:-}
      VOS_GITHUB_API_BASE_URL: ${VOS_GITHUB_API_BASE_URL:-}
      VOS_GITHUB_WEBHOOK_SECRET: ${VOS_GITHUB_WEBHOOK_SECRET:-}
      GITHUB_WEBHOOK_SECRET: ${GITHUB_WEBHOOK_SECRET:-}
      VOS_GITHUB_AUTO_DEPLOY: ${VOS_GITHUB_AUTO_DEPLOY:-}
      VOS_GITHUB_AUTO_DEPLOY_PRIVATE_REPOS: ${VOS_GITHUB_AUTO_DEPLOY_PRIVATE_REPOS:-}
      VOS_GITHUB_AUTO_DEPLOY_FORK_PULL_REQUESTS: ${VOS_GITHUB_AUTO_DEPLOY_FORK_PULL_REQUESTS:-}
      VOS_GITHUB_CHECKOUT_ROOT: ${VOS_GITHUB_CHECKOUT_ROOT:-}
      PORT: 8080
      HOST: 0.0.0.0
    ports:
      - "${VOS_HTTP_PORT:-8080}:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${VOS_CONTROLLER_DATA:-./.vos-data/controller}:/data
      - ${VOS_SOURCE_ROOT:-/Users}:${VOS_SOURCE_ROOT:-/Users}:ro
    tmpfs:
      - /tmp:size=256m,mode=1777
    networks:
      - control
      - runtime
    restart: unless-stopped

networks:
  control:
    name: ${VOS_CONTROL_NETWORK:-vos-control-net}
  runtime:
    name: ${VOS_RUNTIME_NETWORK:-vos-runtime-net}