services:
  app:
    build: .
    restart: unless-stopped
    init: true
    read_only: true
    tmpfs:
      - /tmp:size=128m,mode=1777
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    environment:
      NODE_ENV: production
      PORT: 3000
      APP_ORIGIN: ${APP_ORIGIN:?required}
      MCP_OAUTH_ENABLED: ${MCP_OAUTH_ENABLED:-false}
      FEEDBACKS_MAIL_PROVIDER: ${FEEDBACKS_MAIL_PROVIDER:-}
      MAIL_FROM_EMAIL: ${MAIL_FROM_EMAIL:-}
      MAIL_FROM_NAME: ${MAIL_FROM_NAME:-}
      MAIL_REPLY_TO: ${MAIL_REPLY_TO:-}
      MAIL_SMTP_HOST: ${MAIL_SMTP_HOST:-}
      MAIL_SMTP_PORT: ${MAIL_SMTP_PORT:-}
      MAIL_SMTP_USER: ${MAIL_SMTP_USER:-}
      MAIL_SMTP_PASSWORD: ${MAIL_SMTP_PASSWORD:-}
      MAILJET_API_KEY: ${MAILJET_API_KEY:-}
      MAILJET_API_SECRET: ${MAILJET_API_SECRET:-}
      MAIL_SES_REGION: ${MAIL_SES_REGION:-}
      MAIL_SES_ACCESS_KEY_ID: ${MAIL_SES_ACCESS_KEY_ID:-}
      MAIL_SES_SECRET_ACCESS_KEY: ${MAIL_SES_SECRET_ACCESS_KEY:-}
      MAIL_SES_SESSION_TOKEN: ${MAIL_SES_SESSION_TOKEN:-}
      MAIL_SES_CONFIGURATION_SET: ${MAIL_SES_CONFIGURATION_SET:-}
      TRACKER_OAUTH_BROKER_URL: ${TRACKER_OAUTH_BROKER_URL:-}
      TRACKER_OAUTH_INSTALLATION_KEY: ${TRACKER_OAUTH_INSTALLATION_KEY:-}
      OPENPROJECT_ALLOWED_ORIGINS: ${OPENPROJECT_ALLOWED_ORIGINS:-}
      DATABASE_URL: postgresql://feedbacks:${POSTGRES_PASSWORD:?required}@postgres:5432/feedbacks
      DATABASE_POOL_MAX: ${DATABASE_POOL_MAX:-10}
      TRUST_PROXY_HOPS: ${TRUST_PROXY_HOPS:-1}
      ASSET_DRIVER: s3
      ORGANIZATION_ID: ${ORGANIZATION_ID:?required}
      S3_ENDPOINT: ${S3_ENDPOINT:?required}
      S3_REGION: ${S3_REGION:?required}
      S3_BUCKET: ${S3_BUCKET:?required}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:?required}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:?required}
      TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY:-}
      TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY:-}
      GITHUB_APPS_JSON: ${GITHUB_APPS_JSON:-}
      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
      GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-}
      GITHUB_APP_PRIVATE_KEY_BASE64: ${GITHUB_APP_PRIVATE_KEY_BASE64:-}
    expose: ["3000"]
    depends_on:
      postgres:
        condition: service_healthy
    stop_grace_period: 15s
  postgres:
    image: postgres:17-bookworm
    restart: unless-stopped
    environment:
      POSTGRES_USER: feedbacks
      POSTGRES_DB: feedbacks
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?required}
    volumes: ["feedbacks-postgres:/var/lib/postgresql/data"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U feedbacks -d feedbacks"]
      interval: 10s
      timeout: 5s
      retries: 10
volumes:
  feedbacks-postgres: