name: hashistack-healthcare-studio

services:
  postgres:
    image: postgres:16.4-bookworm
    environment:
      POSTGRES_DB: studio
      POSTGRES_USER: studio
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-local-studio-only}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U studio -d studio"]
      interval: 2s
      timeout: 3s
      retries: 30
    volumes:
      - studio-postgres:/var/lib/postgresql/data
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true

  studio:
    build:
      context: .
    image: ${STUDIO_IMAGE:-hashistack-healthcare-studio:local}
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      APP_BIND: 0.0.0.0:3000
      CONTROL_DB_URL: postgres://studio:${POSTGRES_PASSWORD:-local-studio-only}@postgres:5432/studio
      AUDIT_FILE: /var/lib/studio/audit.jsonl
      IDENTITIES_FILE: /run/config/identities.hcl
      SESSION_IDLE_SECS: "900"
      ANON_SESSION_HMAC_KEY: ${ANON_SESSION_HMAC_KEY:-}
      ANON_NETLIFY_PREVIEW_SITE: ${ANON_NETLIFY_PREVIEW_SITE:-}
      CLERK_PUBLISHABLE_KEY: ${CLERK_PUBLISHABLE_KEY:-}
      CLERK_ISSUER: ${CLERK_ISSUER:-}
      CLERK_JWKS_URL: ${CLERK_JWKS_URL:-}
      CLERK_AUTHORIZED_PARTIES: ${CLERK_AUTHORIZED_PARTIES:-}
      CLERK_SUBJECT_MAP: ${CLERK_SUBJECT_MAP:-}
      CLERK_DEVELOPMENT_DEFAULT_PRINCIPAL: ${CLERK_DEVELOPMENT_DEFAULT_PRINCIPAL:-}
      WORKSPACE_AGENT_PROVIDER: ${WORKSPACE_AGENT_PROVIDER:-deterministic}
      DIGITALOCEAN_PLANNER_ENDPOINT: ${DIGITALOCEAN_PLANNER_ENDPOINT:-}
      DIGITALOCEAN_PLANNER_ACCESS_KEY: ${DIGITALOCEAN_PLANNER_ACCESS_KEY:-}
      DIGITALOCEAN_PLANNER_VERSION: ${DIGITALOCEAN_PLANNER_VERSION:-}
      WORKSPACE_AGENT_TIMEOUT_SECS: ${WORKSPACE_AGENT_TIMEOUT_SECS:-45}
      WORKSPACE_AGENT_MAX_RESPONSE_BYTES: ${WORKSPACE_AGENT_MAX_RESPONSE_BYTES:-600000}
      WORKSPACE_VERIFIER_IMAGE: ${WORKSPACE_VERIFIER_IMAGE:-}
      WORKSPACE_VERIFIER_RUNTIME: ${WORKSPACE_VERIFIER_RUNTIME:-docker}
      WORKSPACE_VERIFIER_TIMEOUT_SECS: ${WORKSPACE_VERIFIER_TIMEOUT_SECS:-180}
      WORKSPACE_VERIFIER_MAX_CONCURRENCY: ${WORKSPACE_VERIFIER_MAX_CONCURRENCY:-2}
    ports:
      - "127.0.0.1:${STUDIO_PORT:-3000}:3000"
    volumes:
      - studio-audit:/var/lib/studio
      - ./staging/identities.hcl:/run/config/identities.hcl:ro
    healthcheck:
      test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:3000/health"]
      interval: 5s
      timeout: 3s
      retries: 20
    read_only: true
    tmpfs:
      - /tmp:size=32m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped

volumes:
  studio-postgres:
  studio-audit: