name: accp-m1

services:
  postgres:
    image: postgres:17@sha256:67f41722b7a8cbdb868a44a4995c846eddfdc2973bccb291ce937dce88ad5675
    environment:
      POSTGRES_DB: accp
      POSTGRES_USER: accp
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Run node scripts/dev-env.mjs first}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U accp -d accp"]
      interval: 2s
      timeout: 3s
      retries: 30
  migrate:
    image: accp:local
    build: .
    command: [migrate]
    environment: &database
      DATABASE_URL: postgres://accp:${POSTGRES_PASSWORD:?Missing database password}@postgres:5432/accp?sslmode=disable
    depends_on:
      postgres:
        condition: service_healthy
  api:
    image: accp:local
    build: .
    command: [serve]
    environment:
      <<: *database
      ACCP_LISTEN_ADDR: 0.0.0.0:8080
      ACCP_METRICS_ADDR: 0.0.0.0:9090
      ACCP_DATABASE_MAX_CONNS: ${ACCP_DATABASE_MAX_CONNS:-10}
      ACCP_ENV: ${ACCP_ENV:-production}
      ACCP_AUTH_MODE: ${ACCP_AUTH_MODE:-oidc}
      ACCP_OIDC_ISSUER: ${ACCP_OIDC_ISSUER:-}
      ACCP_OIDC_CLIENT_ID: ${ACCP_OIDC_CLIENT_ID:-}
      ACCP_OIDC_AUDIENCE: ${ACCP_OIDC_AUDIENCE:-}
      ACCP_SESSION_KEY: ${ACCP_SESSION_KEY:?Generate or upgrade local configuration}
      ACCP_PUBLIC_URL: ${ACCP_PUBLIC_URL:?Set the externally reachable API origin}
      ACCP_TOOLS_FILE: /etc/accp/tools.json
      ACCP_GITHUB_TOKEN: ${ACCP_GITHUB_TOKEN:-}
      ACCP_WEBHOOK_ALLOWLIST: ${ACCP_WEBHOOK_ALLOWLIST:-}
    volumes:
      - ${ACCP_TOOLS_CONFIG:-./configs/tools.json}:/etc/accp/tools.json:ro
    ports:
      - 127.0.0.1:${ACCP_HTTP_PORT:-8080}:8080
      - 127.0.0.1:${ACCP_METRICS_PORT:-19091}:9090
    depends_on:
      migrate:
        condition: service_completed_successfully
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
  bootstrap:
    image: accp:local
    command: [bootstrap, -development, -output, /local/dev-users.json]
    profiles: [tools]
    # Only the explicit operator command receives the ignored credential directory.
    user: "${LOCAL_UID:-1000}:${LOCAL_GID:-1000}"
    environment:
      <<: *database
      ACCP_ENV: ${ACCP_ENV:-production}
      ACCP_AUTH_MODE: ${ACCP_AUTH_MODE:-oidc}
    volumes:
      - ./.accp-local:/local
    depends_on:
      migrate:
        condition: service_completed_successfully
  nats:
    image: nats:2.11.9-alpine@sha256:777787bbb4c7c4083ec2213b0b8b14151617610a3e0d85776bd995cd46599c73
    command: [-c, /etc/nats/accp.conf]
    environment:
      ACCP_NATS_TOKEN: ${ACCP_NATS_TOKEN:?Generate or upgrade local configuration}
    volumes:
      - ./configs/nats.conf:/etc/nats/accp.conf:ro
      - nats-data:/data
    healthcheck:
      test: [CMD, wget, -q, -O, /dev/null, http://127.0.0.1:8222/healthz]
      interval: 2s
      timeout: 3s
      retries: 30
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
  worker:
    image: accp:local
    build: .
    command: [worker]
    environment:
      <<: *database
      ACCP_DATABASE_MAX_CONNS: ${ACCP_DATABASE_MAX_CONNS:-10}
      ACCP_ENV: ${ACCP_ENV:-production}
      ACCP_SESSION_KEY: ${ACCP_SESSION_KEY:?Generate or upgrade local configuration}
      ACCP_PUBLIC_URL: ${ACCP_PUBLIC_URL:?Set the externally reachable API origin}
      ACCP_NATS_URL: nats://nats:4222
      ACCP_NATS_TOKEN: ${ACCP_NATS_TOKEN:?Generate or upgrade local configuration}
      ACCP_TOOLS_FILE: /etc/accp/tools.json
      ACCP_GITHUB_TOKEN: ${ACCP_GITHUB_TOKEN:-}
      ACCP_WEBHOOK_ALLOWLIST: ${ACCP_WEBHOOK_ALLOWLIST:-}
    volumes:
      - ${ACCP_TOOLS_CONFIG:-./configs/tools.json}:/etc/accp/tools.json:ro
    depends_on:
      migrate:
        condition: service_completed_successfully
      nats:
        condition: service_healthy
    restart: unless-stopped
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]

volumes:
  postgres-data:
  nats-data: