services:
  db:
    image: postgres:18-alpine
    environment:
      POSTGRES_USER: gocov
      POSTGRES_PASSWORD: gocov
      POSTGRES_DB: gocov
    volumes:
      # Postgres 18 images store data under /var/lib/postgresql/<major>/…
      # and declare the volume at /var/lib/postgresql (not /data), so the
      # mount must sit there for the data to persist. See docker-library
      # postgres#1259.
      - pgdata:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U gocov -d gocov"]
      interval: 2s
      timeout: 3s
      retries: 15

  server:
    build: .
    environment:
      DATABASE_URL: postgres://gocov:gocov@db:5432/gocov
      GOCOV_ADDR: ":8080"
      # Public URL of this instance — used for links in PR comments,
      # build statuses and the web UI. Override in a .env file next to
      # this compose file, e.g. GOCOV_BASE_URL=http://192.168.18.174:8080
      GOCOV_BASE_URL: ${GOCOV_BASE_URL:-http://localhost:8080}
      GOCOV_GITHUB_APP_ID: ${GOCOV_GITHUB_APP_ID:-}
      GOCOV_GITHUB_APP_PRIVATE_KEY: ${GOCOV_GITHUB_APP_PRIVATE_KEY:-}
      GOCOV_SECRET_KEY: ${GOCOV_SECRET_KEY:-}
      # Optional OAuth credentials; setting a pair turns on (and from
      # then on requires) web UI sign-in with that forge. See
      # docs/sign-in.md.
      GOCOV_OAUTH_BITBUCKET_KEY: ${GOCOV_OAUTH_BITBUCKET_KEY:-}
      GOCOV_OAUTH_BITBUCKET_SECRET: ${GOCOV_OAUTH_BITBUCKET_SECRET:-}
      GOCOV_OAUTH_GITHUB_KEY: ${GOCOV_OAUTH_GITHUB_KEY:-}
      GOCOV_OAUTH_GITHUB_SECRET: ${GOCOV_OAUTH_GITHUB_SECRET:-}
      GOCOV_OAUTH_GITLAB_KEY: ${GOCOV_OAUTH_GITLAB_KEY:-}
      GOCOV_OAUTH_GITLAB_SECRET: ${GOCOV_OAUTH_GITLAB_SECRET:-}
      GOCOV_ALLOWED_WORKSPACES: ${GOCOV_ALLOWED_WORKSPACES:-}
      # private (default) restricts sign-in to tracked-workspace members;
      # hosted opens self-service registration. See "Hosted mode" in
      # docs/sign-in.md.
      GOCOV_MODE: ${GOCOV_MODE:-private}
    ports:
      - "8080:8080"
    healthcheck:
      # The runtime image is distroless — no wget, no shell — so the
      # binary probes its own /healthz.
      test: ["CMD", "/usr/local/bin/gocov-server", "healthcheck"]
      interval: 10s
      # Must stay above healthProbeTimeout in cmd/gocov-server, so a failing
      # probe reports its own error instead of being killed here.
      timeout: 3s
      retries: 3
    depends_on:
      db:
        condition: service_healthy

volumes:
  pgdata: