name: ${COMPOSE_PROJECT_NAME:-hermes}

services:
  app:
    build:
      context: .
      target: production
    restart: unless-stopped
    environment:
      HERMES_APP_ENV: production
      HERMES_DATABASE_HOST: postgres
      HERMES_DATABASE_PORT: 5432
      HERMES_DATABASE_NAME: ${POSTGRES_DB:-hermes}
      HERMES_DATABASE_USER: ${POSTGRES_USER:-hermes}
      HERMES_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
      HERMES_DATABASE_ECHO: ${HERMES_DATABASE_ECHO:-false}
      HERMES_COOKIE_SECURE: ${HERMES_COOKIE_SECURE:-true}
      HERMES_SESSION_LIFETIME_DAYS: ${HERMES_SESSION_LIFETIME_DAYS:-7}
      HERMES_SESSION_IDLE_MINUTES: ${HERMES_SESSION_IDLE_MINUTES:-30}
      HERMES_LOGIN_FAILURE_LIMIT: ${HERMES_LOGIN_FAILURE_LIMIT:-5}
      HERMES_LOGIN_FAILURE_WINDOW_MINUTES: ${HERMES_LOGIN_FAILURE_WINDOW_MINUTES:-15}
      HERMES_LOGIN_BLOCK_MINUTES: ${HERMES_LOGIN_BLOCK_MINUTES:-15}
      HERMES_LOGIN_ADMISSION_INTERVAL_MS: ${HERMES_LOGIN_ADMISSION_INTERVAL_MS:-250}
      HERMES_TRUSTED_PROXY_NETWORKS: ${HERMES_TRUSTED_PROXY_NETWORKS:-[]}
    ports:
      - "${APP_BIND_ADDRESS:-127.0.0.1}:${APP_PORT:-8000}:8000"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/v1/health', timeout=2)",
        ]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 15s

  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-hermes}
      POSTGRES_USER: ${POSTGRES_USER:-hermes}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 10s

volumes:
  postgres_data: