services:
  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: agenttrial
      POSTGRES_USER: agenttrial
      POSTGRES_PASSWORD: agenttrial-local
    volumes: [agenttrial-data:/var/lib/postgresql/data]
    ports: ["127.0.0.1:${AGENTTRIAL_DB_PORT:-55432}:5432"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U agenttrial"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks: [backend]
    shm_size: 128mb
    deploy:
      resources:
        limits: { cpus: "1.0", memory: 512M }
  web:
    build:
      context: .
      args:
        AGENTTRIAL_BUILD_COMMIT: ${AGENTTRIAL_BUILD_COMMIT:-development}
        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-https://agenttrial.tangvu.dev}
    restart: unless-stopped
    init: true
    ports: ["127.0.0.1:${AGENTTRIAL_PORT:-4179}:3000"]
    environment:
      NODE_ENV: production
      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-https://agenttrial.tangvu.dev}
      DATABASE_URL: postgres://agenttrial:agenttrial-local@postgres:5432/agenttrial
      AGENTTRIAL_CLOUDFLARE_TUNNEL: "true"
      AGENTTRIAL_BUILD_COMMIT: ${AGENTTRIAL_BUILD_COMMIT:-development}
    depends_on:
      postgres:
        condition: service_healthy
    read_only: true
    tmpfs: [/tmp]
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://127.0.0.1:3000/api/health').then(r=>{if(!r.ok)process.exit(1)})",
        ]
      interval: 15s
      timeout: 5s
      retries: 5
    networks: [backend, egress]
    deploy:
      resources:
        limits: { cpus: "1.0", memory: 512M, pids: 128 }
  worker:
    build:
      context: .
      target: worker
      args:
        AGENTTRIAL_BUILD_COMMIT: ${AGENTTRIAL_BUILD_COMMIT:-development}
    environment:
      NODE_ENV: production
      DATABASE_URL: postgres://agenttrial:agenttrial-local@postgres:5432/agenttrial
      AGENTTRIAL_EXECUTION_ONLY: "true"
      AGENTTRIAL_BUILD_COMMIT: ${AGENTTRIAL_BUILD_COMMIT:-development}
    depends_on:
      postgres:
        condition: service_healthy
    read_only: true
    tmpfs: [/tmp]
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    deploy:
      resources:
        limits: { cpus: "1.0", memory: 768M, pids: 128 }
    networks: [backend, egress]
    restart: unless-stopped
    init: true
  signer:
    build:
      context: .
      target: signer
      args:
        AGENTTRIAL_BUILD_COMMIT: ${AGENTTRIAL_BUILD_COMMIT:-development}
    environment:
      NODE_ENV: production
      DATABASE_URL: postgres://agenttrial:agenttrial-local@postgres:5432/agenttrial
      AGENTTRIAL_SIGNING_SEED: ${AGENTTRIAL_SIGNING_SEED:?Generate a stable 64-character hex seed}
      AGENTTRIAL_BUILD_COMMIT: ${AGENTTRIAL_BUILD_COMMIT:-development}
    depends_on:
      postgres:
        condition: service_healthy
    read_only: true
    tmpfs: [/tmp]
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    deploy:
      resources:
        limits: { cpus: "0.5", memory: 512M, pids: 128 }
    networks: [backend]
    restart: unless-stopped
    init: true

volumes:
  agenttrial-data:

networks:
  backend:
    internal: true
  egress: