services:
  prodex-gateway:
    build:
      context: .
      dockerfile: Dockerfile
    image: prodex-gateway:local
    restart: unless-stopped
    entrypoint: ["/usr/local/bin/prodex-gateway"]
    environment:
      PRODEX_HOME: /var/lib/prodex
      PRODEX_RUNTIME_LOG_DIR: /var/log/prodex
    command: ["serve", "--listen", "0.0.0.0:4000"]
    ports:
      - "127.0.0.1:4000:4000"
    secrets:
      - source: prodex_gateway_token
        target: PRODEX_GATEWAY_TOKEN
      - source: openai_api_key
        target: OPENAI_API_KEY
      - source: prodex_gateway_postgres_url
        target: PRODEX_GATEWAY_POSTGRES_URL
      - source: prodex_gateway_redis_url
        target: PRODEX_GATEWAY_REDIS_URL
    volumes:
      - prodex-data:/var/lib/prodex
      - prodex-runtime-logs:/var/log/prodex
      - ./deploy/compose-gateway-policy.toml:/var/lib/prodex/policy.toml:ro
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS http://127.0.0.1:4000/readyz >/dev/null",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  postgres:
    # postgres:16-alpine; Dependabot updates the tag and digest together.
    image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
    profiles: ["postgres"]
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${PRODEX_POSTGRES_DB:-prodex}
      POSTGRES_USER: ${PRODEX_POSTGRES_USER:-prodex}
      POSTGRES_PASSWORD_FILE: /run/secrets/PRODEX_POSTGRES_PASSWORD
    secrets:
      - source: prodex_postgres_password
        target: PRODEX_POSTGRES_PASSWORD
    volumes:
      - prodex-postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  redis:
    # redis:7-alpine; Dependabot updates the tag and digest together.
    image: redis:7-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99
    profiles: ["redis"]
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - prodex-redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

volumes:
  prodex-data:
  prodex-runtime-logs:
  prodex-postgres:
  prodex-redis:

secrets:
  prodex_gateway_token:
    file: ${PRODEX_GATEWAY_TOKEN_FILE:?set PRODEX_GATEWAY_TOKEN_FILE}
  openai_api_key:
    file: ${OPENAI_API_KEY_FILE:?set OPENAI_API_KEY_FILE}
  prodex_gateway_postgres_url:
    file: ${PRODEX_GATEWAY_POSTGRES_URL_FILE:?set PRODEX_GATEWAY_POSTGRES_URL_FILE}
  prodex_gateway_redis_url:
    file: ${PRODEX_GATEWAY_REDIS_URL_FILE:?set PRODEX_GATEWAY_REDIS_URL_FILE}
  prodex_postgres_password:
    file: ${PRODEX_POSTGRES_PASSWORD_FILE:?set PRODEX_POSTGRES_PASSWORD_FILE}