# Optyra production stack (report 02prd §2/§7): one box, Postgres in Docker, worker image
# from GHCR, zero inbound exposure except the healthz port bound to localhost/Tailscale.
# Owned by DevOps — app changes should not be needed here.

services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-optyra}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
      POSTGRES_DB: ${POSTGRES_DB:-optyra}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-optyra} -d ${POSTGRES_DB:-optyra}"]
      interval: 10s
      timeout: 5s
      retries: 6
    # No public port: reachable only from inside the compose network.
    # For manual psql access over SSH/Tailscale, uncomment:
    # ports:
    #   - "127.0.0.1:5432:5432"

  worker:
    image: ${OPTYRA_IMAGE:-ghcr.io/CHANGE_ME/optyra:latest}
    restart: unless-stopped
    env_file: ../.env
    environment:
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-optyra}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-optyra}
      CONFIG_PATH: /app/config
    volumes:
      # layout per runbook: /opt/optyra/{.env,config/,deploy/}
      - ../config:/app/config:ro
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      # healthz — loopback only; reach it over Tailscale/SSH, never expose publicly
      - "127.0.0.1:8080:8080"

volumes:
  pgdata: