services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: packages
      POSTGRES_PASSWORD: packages
      POSTGRES_DB: packages
    volumes:
      - pgdata:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U packages"]
      interval: 5s
      retries: 10

  app:
    build: .
    ports:
      - "8000:8000"
    environment:
      DATABASE_URL: postgres://packages:packages@db:5432/packages
      STORAGE_DIR: /data
      AUTH_TOKEN_FILE: /secrets/tokens
      RUST_LOG: info
      # Upstream pull-through (disabled by default; uncomment to enable):
      # UPSTREAM_URL: https://pypi.org/simple/
      # Upstream quarantine policy (read once at startup; uncomment to enable):
      # POLICY_FILE: /config/policy.json  # also mount a /config volume with policy.json (see below)
      # OIDC JWT auth (disabled by default; uncomment to enable):
      # OIDC_ISSUER_URL: https://accounts.example.com
      # OIDC_AUDIENCE: <audience>
    volumes:
      - ./data:/data
      - ./dev.tokens:/secrets/tokens:ro
      # - ./policy.json:/config/policy.json:ro  # required when POLICY_FILE is set
    depends_on:
      db:
        condition: service_healthy

  # Optional S3 backend: `docker compose --profile s3 up s3mock`, then
  # set STORAGE_BACKEND=s3, S3_BUCKET=packages,
  # S3_ENDPOINT_URL=http://s3mock:9090, AWS_ACCESS_KEY_ID=test, and
  # AWS_SECRET_ACCESS_KEY=test on the app service. S3Mock is an
  # in-memory S3-compatible endpoint for development only; swap in
  # MinIO or AWS S3 for anything real.
  s3mock:
    image: adobe/s3mock:latest
    profiles: [s3]
    environment:
      COM_ADOBE_TESTING_S3MOCK_STORE_INITIALBUCKETS: packages
    ports:
      - "9000:9090"

volumes:
  pgdata: