services:
  postgres:
    image: postgres:16.14-bookworm
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    ports:
      - "${TOSS_BIND_ADDRESS:-127.0.0.1}:${POSTGRES_HOST_PORT:-5432}:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 3s
      retries: 10

  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    ports:
      - "${TOSS_BIND_ADDRESS:-127.0.0.1}:${MINIO_API_PORT:-9000}:9000"
      - "${TOSS_BIND_ADDRESS:-127.0.0.1}:${MINIO_CONSOLE_PORT:-9001}:9001"
    volumes:
      - minio-data:/data

  minio-init:
    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      S3_BUCKET: ${S3_BUCKET}
    depends_on:
      minio:
        condition: service_started
    entrypoint:
      - /bin/sh
      - -c
      - |
        if [ -z "$${S3_BUCKET}" ]; then
          exit 0
        fi
        until /usr/bin/mc alias set local http://minio:9000 "$${MINIO_ROOT_USER}" "$${MINIO_ROOT_PASSWORD}" && \
          /usr/bin/mc mb --ignore-existing "local/$${S3_BUCKET}"; do
          sleep 1
        done

  core-api:
    build:
      context: .
      dockerfile: backend/Dockerfile
      args:
        TOSS_DISTRIBUTION: ${TOSS_DISTRIBUTION:-community}
    restart: unless-stopped
    stop_grace_period: 35s
    env_file:
      - ${TOSS_ENV_FILE:-.env}
    environment:
      # Keep internal service endpoints stable; *_HOST_PORT configures only
      # the host-side ports published by this source-build stack.
      CORE_API_PORT: 8080
      WEB_STATIC_DIR: /app/web-dist
      DATA_DIR: /data
      TOSS_CONFIG: /app/distributions/${TOSS_DISTRIBUTION:-community}/toss.json
      TOSS_DEPLOYMENT_CONFIG: /app/config/deployment.toml
    depends_on:
      postgres:
        condition: service_healthy
      minio:
        condition: service_started
      minio-init:
        condition: service_completed_successfully
    ports:
      - "${TOSS_BIND_ADDRESS:-127.0.0.1}:${CORE_HOST_PORT:-8080}:8080"
    volumes:
      - app-data:/data
      - ${TOSS_DEPLOYMENT_CONFIG_DIR:-./config}:/app/config:ro

  latex-worker:
    profiles: ["processing"]
    build:
      context: .
      dockerfile: workers/latex/Dockerfile
    image: toss-latex-worker:local
    restart: unless-stopped
    environment:
      PROCESSING_CORE_URL: http://core-api:8080
      PROCESSING_WORKER_TOKEN_FILE: /app/config/worker.token
      PROCESSING_WORKER_INSTANCE: ${PROCESSING_WORKER_INSTANCE:-community-latex-local}
      PROCESSING_LATEX_SLOTS: ${PROCESSING_LATEX_SLOTS:-1}
      PROCESSING_LATEX_EXECUTOR: bubblewrap
      RUST_LOG: ${PROCESSING_WORKER_LOG:-toss_processing_sdk=info,toss_latex_worker=info}
    depends_on:
      core-api:
        condition: service_started
    security_opt:
      - no-new-privileges:true
      - seccomp=unconfined
      - apparmor=${PROCESSING_APPARMOR_PROFILE:-toss-latex-worker}
    cap_drop:
      - ALL
    tmpfs:
      - /work:size=4g,mode=0700,uid=10001,gid=10001
    volumes:
      - ${TOSS_DEPLOYMENT_CONFIG_DIR:-./config}:/app/config:ro

volumes:
  app-data:
  minio-data:
  postgres-data: