services:
  cryptotracker-certgen:
    build:
      context: ./mcp
      dockerfile: Dockerfile
      args:
        BUILD_HASH: ${BUILD_HASH:-unknown}
    user: "10001:10001"
    command: ["node", "scripts/generate-certificate.mjs"]
    restart: "no"
    environment:
      CRYPTOTRACKER_CERT_PATH: ${CRYPTOTRACKER_SHARED_CERT_PATH:-/app/data/certs/server.crt}
      CRYPTOTRACKER_KEY_PATH: ${CRYPTOTRACKER_SHARED_KEY_PATH:-/app/data/certs/server.key}
    volumes:
      - cryptotracker-certs:/app/data/certs

  cryptotracker:
    env_file:
      - path: .env
        required: false
    build:
      context: .
      dockerfile: dockerfiles/cryptotracker.Dockerfile
      args:
        BUILD_HASH: ${BUILD_HASH:-}
    restart: unless-stopped
    init: true
    environment:
      CRYPTOTRACKER_CONFIG_PATH: /app/config/cryptotracker.config.json5
      CRYPTOTRACKER_SECRETS_PATH: /app/config/cryptotracker.secrets.json5
      CRYPTOTRACKER_DB_KIND: ${CRYPTOTRACKER_DB_KIND:-sqlite}
      CRYPTOTRACKER_SQLITE_PATH: /app/data/cryptotracker.sqlite
      CRYPTOTRACKER_PUBLIC_BASE_URL: ${CRYPTOTRACKER_PUBLIC_BASE_URL:-http://localhost:8192}
      CRYPTOTRACKER_API_KEY_ENABLED: "true"
      CRYPTOTRACKER_API_KEY: ${CRYPTOTRACKER_MCP_UPSTREAM_API_KEY:-}
      CRYPTOTRACKER_API_KEY_NAME: cryptotracker-mcp
      CRYPTOTRACKER_API_KEY_ROLE: readwrite
      CRYPTOTRACKER_HTTPS_ENABLED: "true"
      CRYPTOTRACKER_HTTPS_PORT: "8194"
      CRYPTOTRACKER_HTTPS_CERT_PATH: ${CRYPTOTRACKER_SHARED_CERT_PATH:-/app/data/certs/server.crt}
      CRYPTOTRACKER_HTTPS_KEY_PATH: ${CRYPTOTRACKER_SHARED_KEY_PATH:-/app/data/certs/server.key}
      CRYPTOTRACKER_HTTPS_GENERATE_SELF_SIGNED: "false"
      TMPDIR: /tmp/cryptotracker
      LOG_K8S_METADATA_ENABLED: "false"
    volumes:
      - ./config/cryptotracker.config.json5:/app/config/cryptotracker.config.json5:ro
      - ./config/cryptotracker.secrets.json5:/app/config/cryptotracker.secrets.json5:ro
      - cryptotracker-data:/app/data
      - cryptotracker-certs:/app/data/certs
      - type: tmpfs
        target: /tmp/cryptotracker
    ports:
      - "8192:8192"
      - "8194:8194"
    read_only: true
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8192/readyz').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    depends_on:
      cryptotracker-certgen:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
        required: false

  cryptotracker-mcp:
    env_file:
      - path: .env
        required: false
    build:
      context: ./mcp
      dockerfile: Dockerfile
      args:
        BUILD_HASH: ${BUILD_HASH:-unknown}
    restart: unless-stopped
    init: true
    environment:
      CRYPTOTRACKER_MCP_ENABLED: ${CRYPTOTRACKER_MCP_ENABLED:-true}
      CRYPTOTRACKER_MCP_READ_ONLY: ${CRYPTOTRACKER_MCP_READ_ONLY:-false}
      CRYPTOTRACKER_MCP_HTTP_ENABLED: ${CRYPTOTRACKER_MCP_HTTP_ENABLED:-false}
      CRYPTOTRACKER_MCP_HTTP_HOST: 0.0.0.0
      CRYPTOTRACKER_MCP_HTTP_PORT: ${CRYPTOTRACKER_MCP_HTTP_PORT:-8195}
      CRYPTOTRACKER_MCP_HTTPS_ENABLED: ${CRYPTOTRACKER_MCP_HTTPS_ENABLED:-true}
      CRYPTOTRACKER_MCP_HTTPS_HOST: 0.0.0.0
      CRYPTOTRACKER_MCP_HTTPS_PORT: ${CRYPTOTRACKER_MCP_HTTPS_PORT:-8193}
      CRYPTOTRACKER_MCP_HTTPS_CERT_PATH: ${CRYPTOTRACKER_SHARED_CERT_PATH:-/app/data/certs/server.crt}
      CRYPTOTRACKER_MCP_HTTPS_KEY_PATH: ${CRYPTOTRACKER_SHARED_KEY_PATH:-/app/data/certs/server.key}
      CRYPTOTRACKER_MCP_HTTPS_GENERATE_SELF_SIGNED: "false"
      CRYPTOTRACKER_MCP_UPSTREAM_BASE_URL: ${CRYPTOTRACKER_MCP_UPSTREAM_BASE_URL:-http://cryptotracker:8192}
      CRYPTOTRACKER_MCP_UPSTREAM_API_KEY_HEADER: X-API-Key
      CRYPTOTRACKER_MCP_UPSTREAM_API_KEY: ${CRYPTOTRACKER_MCP_UPSTREAM_API_KEY:-}
      CRYPTOTRACKER_MCP_UPSTREAM_VERIFY_TLS: ${CRYPTOTRACKER_MCP_UPSTREAM_VERIFY_TLS:-true}
      CRYPTOTRACKER_MCP_UPSTREAM_CA_CERT_PATH: ${CRYPTOTRACKER_SHARED_CERT_PATH:-/app/data/certs/server.crt}
      CRYPTOTRACKER_MCP_READ_CLIENT_API_KEYS: ${CRYPTOTRACKER_MCP_READ_CLIENT_API_KEYS:-}
      CRYPTOTRACKER_MCP_READWRITE_CLIENT_API_KEYS: ${CRYPTOTRACKER_MCP_READWRITE_CLIENT_API_KEYS:-}
      CRYPTOTRACKER_MCP_HISTORY_PATH: /app/data/mcp-history.json
      TMPDIR: /tmp/cryptotracker-mcp
    volumes:
      - cryptotracker-mcp-data:/app/data
      - cryptotracker-certs:/app/data/certs
      - type: tmpfs
        target: /tmp/cryptotracker-mcp
    ports:
      - "${CRYPTOTRACKER_MCP_HTTPS_PORT:-8193}:${CRYPTOTRACKER_MCP_HTTPS_PORT:-8193}"
      - "${CRYPTOTRACKER_MCP_HTTP_PORT:-8195}:${CRYPTOTRACKER_MCP_HTTP_PORT:-8195}"
    read_only: true
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "scripts/healthcheck.mjs"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 20s
    depends_on:
      cryptotracker-certgen:
        condition: service_completed_successfully
      cryptotracker:
        condition: service_healthy

  postgres:
    image: postgres:17.6-bookworm
    profiles: ["postgres"]
    restart: unless-stopped
    environment:
      POSTGRES_DB: cryptotracker
      POSTGRES_USER: cryptotracker
      POSTGRES_PASSWORD: ${CRYPTOTRACKER_POSTGRES_PASSWORD:-change-me}
    volumes:
      - cryptotracker-postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U cryptotracker -d cryptotracker"]
      interval: 5s
      timeout: 5s
      retries: 20

volumes:
  cryptotracker-data:
  cryptotracker-mcp-data:
  cryptotracker-certs:
  cryptotracker-postgres: