name: sprag

# Production-oriented Compose stack for the released container image.
#
# Defaults:
# - App image: ghcr.io/elcamino/sprag:latest
# - TLS reverse proxy: Caddy with automatic HTTPS
# - App state: named Docker volume at /data
#
# Pin a release for reproducible deploys:
#   SPRAG_IMAGE=ghcr.io/elcamino/sprag:1.6.1 docker compose up -d
#
# Test a locally built image without changing this file:
#   docker build -t sprag:local .
#   SPRAG_IMAGE=sprag:local SPRAG_PULL_POLICY=never docker compose up -d

services:
  sprag-app:
    image: ${SPRAG_IMAGE:-ghcr.io/elcamino/sprag:latest}
    pull_policy: ${SPRAG_PULL_POLICY:-missing}
    init: true
    env_file:
      - .env
    environment:
      PORT: "8080"
      DB_PATH: /data/sprag.db
    volumes:
      - sprag-data:/data
    networks:
      - sprag-net
    expose:
      - "8080"
    restart: unless-stopped
    stop_grace_period: 30s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "/sprag", "healthcheck", "http://127.0.0.1:8080/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  caddy:
    image: caddy:2
    depends_on:
      sprag-app:
        condition: service_healthy
    environment:
      SPRAG_DOMAIN: ${SPRAG_DOMAIN:-localhost}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - type: bind
        source: ./Caddyfile
        target: /etc/caddy/Caddyfile
        read_only: true
      - caddy-data:/data
      - caddy-config:/config
    networks:
      - sprag-net
    restart: unless-stopped
    stop_grace_period: 30s
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "caddy", "validate", "--config", "/etc/caddy/Caddyfile"]
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 10s

networks:
  sprag-net:
    driver: bridge

volumes:
  sprag-data:
  caddy-data:
  caddy-config: