services:
  app:
    image: ${DEVPUSH_PRODUCTION_IMAGE:-devpush-app:local}
    build:
      context: ..
      dockerfile: deploy/Dockerfile.app
      args:
        VITE_DEVPUSH_BACKUPS_ENABLED: ${DEVPUSH_BACKUPS_ENABLED:-false}
    restart: unless-stopped
    depends_on:
      migrate:
        condition: service_completed_successfully
    ports:
      - "${DEVPUSH_HTTP_PORT:-7429}:3000"
    volumes:
      - app_uploads:/repo/app/public/uploads
      - control_plane_data:/app/storage
    environment:
      DEVPUSH_DATABASE_PATH: ${DEVPUSH_DATABASE_PATH:-/app/storage/devpush.sqlite}
      DEVPUSH_LOG_DATABASE_PATH: ${DEVPUSH_LOG_DATABASE_PATH:-/app/storage/logs.sqlite}
      DEVPUSH_DATABASE_URL: ${DEVPUSH_DATABASE_URL:-}
      DEVPUSH_LOG_DATABASE_URL: ${DEVPUSH_LOG_DATABASE_URL:-}
      DEVPUSH_DATABASE_AUTH_TOKEN: ${DEVPUSH_DATABASE_AUTH_TOKEN:-}
      DEVPUSH_LOG_DATABASE_AUTH_TOKEN: ${DEVPUSH_LOG_DATABASE_AUTH_TOKEN:-}
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:?BETTER_AUTH_SECRET is required}
      DEVPUSH_BASE_URL: ${DEVPUSH_BASE_URL:?DEVPUSH_BASE_URL is required}
      DEVPUSH_TRUST_PROXY: ${DEVPUSH_TRUST_PROXY:-false}
      DEVPUSH_CLIENT_IP_HEADER: ${DEVPUSH_CLIENT_IP_HEADER:-x-forwarded-for}
      DEVPUSH_DEPLOYMENT_QUEUE_TTL_HOURS: ${DEVPUSH_DEPLOYMENT_QUEUE_TTL_HOURS:-24}
      DEVPUSH_DEPLOYMENT_LOG_MAX_LINES: ${DEVPUSH_DEPLOYMENT_LOG_MAX_LINES:-5000}
      DEVPUSH_DEPLOYMENT_LOG_LINE_BYTES: ${DEVPUSH_DEPLOYMENT_LOG_LINE_BYTES:-2048}
      DEVPUSH_MONITORING_RETENTION_DAYS: ${DEVPUSH_MONITORING_RETENTION_DAYS:-7}
      DEVPUSH_ADMIN_EMAIL: ${DEVPUSH_ADMIN_EMAIL:-}
      BETTER_AUTH_URL: ${BETTER_AUTH_URL:-}
      DEVPUSH_MCP_URL: ${DEVPUSH_MCP_URL:-}
      EMAIL_FROM: ${EMAIL_FROM:-}
      RESEND_API_KEY: ${RESEND_API_KEY:-}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GITHUB_APP_CLIENT_ID: ${GITHUB_APP_CLIENT_ID:-}
      GITHUB_APP_CLIENT_SECRET: ${GITHUB_APP_CLIENT_SECRET:-}
      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
      GITHUB_APP_NAME: ${GITHUB_APP_NAME:-}
      GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
      GITHUB_APP_WEBHOOK_SECRET: ${GITHUB_APP_WEBHOOK_SECRET:-}
      DEVPUSH_TRAEFIK_EMAIL: ${DEVPUSH_TRAEFIK_EMAIL:-}
      DEVPUSH_BACKUPS_ENABLED: ${DEVPUSH_BACKUPS_ENABLED:-false}
      DEVPUSH_AGENT_AUTO_UPDATE: ${DEVPUSH_AGENT_AUTO_UPDATE:-false}
      DEVPUSH_RECOMMENDED_AGENT_VERSION: ${DEVPUSH_RECOMMENDED_AGENT_VERSION:-}
      DEVPUSH_CRON_SECRET: ${DEVPUSH_CRON_SECRET:-}
      DEVPUSH_SECRET_ENCRYPTION_KEY: ${DEVPUSH_SECRET_ENCRYPTION_KEY:?DEVPUSH_SECRET_ENCRYPTION_KEY is required}
      DEVPUSH_STORAGE_ENDPOINT: ${DEVPUSH_STORAGE_ENDPOINT:-}
      DEVPUSH_STORAGE_REGION: ${DEVPUSH_STORAGE_REGION:-}
      DEVPUSH_STORAGE_BUCKET: ${DEVPUSH_STORAGE_BUCKET:-}
      DEVPUSH_STORAGE_ACCESS_KEY_ID: ${DEVPUSH_STORAGE_ACCESS_KEY_ID:-}
      DEVPUSH_STORAGE_SECRET_ACCESS_KEY: ${DEVPUSH_STORAGE_SECRET_ACCESS_KEY:-}
    healthcheck:
      test:
        ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/api/health >/dev/null"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 30s

  migrate:
    image: ${DEVPUSH_PRODUCTION_IMAGE:-devpush-app:local}
    build:
      context: ..
      dockerfile: deploy/Dockerfile.app
      args:
        VITE_DEVPUSH_BACKUPS_ENABLED: ${DEVPUSH_BACKUPS_ENABLED:-false}
    volumes:
      - control_plane_data:/app/storage
    environment:
      DEVPUSH_DATABASE_PATH: ${DEVPUSH_DATABASE_PATH:-/app/storage/devpush.sqlite}
      DEVPUSH_LOG_DATABASE_PATH: ${DEVPUSH_LOG_DATABASE_PATH:-/app/storage/logs.sqlite}
      DEVPUSH_DATABASE_URL: ${DEVPUSH_DATABASE_URL:-}
      DEVPUSH_LOG_DATABASE_URL: ${DEVPUSH_LOG_DATABASE_URL:-}
      DEVPUSH_DATABASE_AUTH_TOKEN: ${DEVPUSH_DATABASE_AUTH_TOKEN:-}
      DEVPUSH_LOG_DATABASE_AUTH_TOKEN: ${DEVPUSH_LOG_DATABASE_AUTH_TOKEN:-}
      DEVPUSH_STORAGE_ENDPOINT: ${DEVPUSH_STORAGE_ENDPOINT:-}
      DEVPUSH_STORAGE_REGION: ${DEVPUSH_STORAGE_REGION:-}
      DEVPUSH_STORAGE_BUCKET: ${DEVPUSH_STORAGE_BUCKET:-}
      DEVPUSH_STORAGE_ACCESS_KEY_ID: ${DEVPUSH_STORAGE_ACCESS_KEY_ID:-}
      DEVPUSH_STORAGE_SECRET_ACCESS_KEY: ${DEVPUSH_STORAGE_SECRET_ACCESS_KEY:-}
    command:
      [
        "sh",
        "-ec",
        "node --enable-source-maps /repo/app/.maintenance/migrate.mjs",
      ]
    restart: "no"

  db-backup:
    image: ${DEVPUSH_PRODUCTION_IMAGE:-devpush-app:local}
    profiles: ["backups"]
    restart: unless-stopped
    depends_on:
      app:
        condition: service_healthy
    environment:
      DEVPUSH_DATABASE_PATH: ${DEVPUSH_DATABASE_PATH:-/app/storage/devpush.sqlite}
      DEVPUSH_LOG_DATABASE_PATH: ${DEVPUSH_LOG_DATABASE_PATH:-/app/storage/logs.sqlite}
      DEVPUSH_DATABASE_URL: ${DEVPUSH_DATABASE_URL:-}
      DEVPUSH_LOG_DATABASE_URL: ${DEVPUSH_LOG_DATABASE_URL:-}
      DEVPUSH_DATABASE_AUTH_TOKEN: ${DEVPUSH_DATABASE_AUTH_TOKEN:-}
      DEVPUSH_LOG_DATABASE_AUTH_TOKEN: ${DEVPUSH_LOG_DATABASE_AUTH_TOKEN:-}
      BACKUP_RETENTION_DAYS: ${DEVPUSH_DB_BACKUP_RETENTION_DAYS:-7}
    volumes:
      - control_plane_data:/app/storage
      - control_plane_backups:/backups
    command:
      - /bin/sh
      - -ec
      - |
        while true; do
          node /repo/app/.maintenance/backup-sqlite.mjs
          sleep 86400
        done

volumes:
  control_plane_data:
  app_uploads:
  control_plane_backups: