services:
  db:
    image: postgres:16.15-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685
    restart: unless-stopped
    environment:
      POSTGRES_USER: skillbox
      POSTGRES_DB: skillbox
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U skillbox -d skillbox"]
      interval: 5s
      timeout: 3s
      retries: 15
    mem_limit: 512m
  app:
    image: ${SKILLBOX_IMAGE:-skillbox:local}
    build: .
    init: true
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      DATABASE_URL: postgres://skillbox:${POSTGRES_PASSWORD}@db:5432/skillbox
      SKILLBOX_ADMIN_TOKEN: ${SKILLBOX_ADMIN_TOKEN:?Set SKILLBOX_ADMIN_TOKEN}
      SKILLBOX_ORIGIN: ${SKILLBOX_ORIGIN:-http://127.0.0.1:4791}
      SKILLBOX_ALLOWED_ORIGINS: ${SKILLBOX_ALLOWED_ORIGINS:-}
      SKILLBOX_EXECUTOR_RESOURCE_ALIASES: ${SKILLBOX_EXECUTOR_RESOURCE_ALIASES:-}
    ports:
      - "${SKILLBOX_BIND_ADDRESS:-127.0.0.1}:${SKILLBOX_PORT:-4791}:4791"
    volumes:
      - app-data:/app/data
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    mem_limit: 512m
    healthcheck:
      test:
        [
          "CMD",
          "bun",
          "-e",
          "fetch('http://127.0.0.1:4791/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 20s
      timeout: 5s
      retries: 3
volumes:
  postgres-data:
  app-data: