services:
  app:
    build:
      context: .
      target: runner
    restart: unless-stopped
    init: true
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: "3000"
      COFFER_DATA_DIR: /app/data
      COFFER_TRUST_PROXY: "${COFFER_TRUST_PROXY:-0}"
      COFFER_OIDC_ISSUER_URL: "${COFFER_OIDC_ISSUER_URL:-}"
      COFFER_OIDC_CLIENT_ID: "${COFFER_OIDC_CLIENT_ID:-}"
      COFFER_OIDC_CLIENT_SECRET: "${COFFER_OIDC_CLIENT_SECRET:-}"
      COFFER_OIDC_CLIENT_AUTH_METHOD: "${COFFER_OIDC_CLIENT_AUTH_METHOD:-}"
      COFFER_OIDC_PROVIDER_NAME: "${COFFER_OIDC_PROVIDER_NAME:-}"
      COFFER_OIDC_SCOPES: "${COFFER_OIDC_SCOPES:-}"
      COFFER_OIDC_REDIRECT_URI: "${COFFER_OIDC_REDIRECT_URI:-}"
      COFFER_PUBLIC_URL: "${COFFER_PUBLIC_URL:-}"
      COFFER_SMTP_HOST: "${COFFER_SMTP_HOST:-}"
      COFFER_SMTP_PORT: "${COFFER_SMTP_PORT:-587}"
      COFFER_SMTP_SECURE: "${COFFER_SMTP_SECURE:-0}"
      COFFER_SMTP_USER: "${COFFER_SMTP_USER:-}"
      COFFER_SMTP_PASSWORD: "${COFFER_SMTP_PASSWORD:-}"
      COFFER_SMTP_FROM: "${COFFER_SMTP_FROM:-}"
    ports:
      - "${APP_HOST:-127.0.0.1}:${APP_PORT:-3000}:3000"
    networks:
      - app_network
    volumes:
      - type: bind
        source: ./data
        target: /app/data
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    pids_limit: 256
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - >-
          fetch('http://127.0.0.1:' + process.env.PORT + '/', { redirect: 'manual' }).then((response) => { if (response.status >= 400) process.exit(1) }).catch(() => process.exit(1))
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3
    stop_grace_period: 10s

networks:
  app_network: