WeatherTool/deploy/vps/compose.yml

name: weathertool-uat

services:
  postgres:
    image: postgres:16.1
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in .env.staging}
      POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in .env.staging}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env.staging}
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - backend
    security_opt:
      - no-new-privileges:true

  app:
    image: ${WEATHERTOOL_IMAGE:?set WEATHERTOOL_IMAGE in .env.staging}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_HOST: postgres
      ENABLE_SCHEDULED_JOBS: "true"
      # Briefly "true" on 2026-08-23, reverted same night: the ltv account
      # fails to authenticate from the VPS specifically (works fine from
      # Rocky), which crash-looped the whole app in-process via parMapN
      # before this was caught and reverted. Leave false until the VPS-side
      # auth failure is diagnosed and re-verified — see docs/UPDATE_ROADMAP.md.
      ENABLE_LVGMC_FTP_JOBS: "false"
      ENABLE_HARMONIE_JOBS: "false"
      DEBUG: "false"
      # LVGMC_* read real values from .env.staging (real FTP credentials
      # obtained 2026-08-23). HARMONIE stays on inert placeholders until real
      # DMI credentials exist — the provider service is still constructed at
      # startup even with its scheduled job off, so it needs some value.
      LVGMC_USER: ${LVGMC_USER}
      LVGMC_PASSWORD: ${LVGMC_PASSWORD}
      LVGMC_URL: ${LVGMC_URL}
      HARMONIE_EDR_API_KEY: disabled
      HARMONIE_EDR_URL: https://invalid.local/
      HARMONIE_STAC_API_KEY: disabled
      HARMONIE_STAC_URL: https://invalid.local/
    ports:
      - "127.0.0.1:${WEATHERTOOL_PORT:-8002}:8080"
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
      - /app/data:size=256m,mode=0770,uid=100,gid=101
    networks:
      - backend
      - edge
    security_opt:
      - no-new-privileges:true

  authelia:
    image: authelia/authelia:4.39.20
    restart: unless-stopped
    environment:
      AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: /run/secrets/jwt_secret
      AUTHELIA_SESSION_SECRET_FILE: /run/secrets/session_secret
      AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /run/secrets/storage_encryption_key
    ports:
      - "127.0.0.1:${AUTHELIA_PORT:-9091}:9091"
    volumes:
      - ./config/authelia:/config:ro
      - ./data/authelia:/var/lib/authelia
      - ./secrets/jwt_secret:/run/secrets/jwt_secret:ro
      - ./secrets/session_secret:/run/secrets/session_secret:ro
      - ./secrets/storage_encryption_key:/run/secrets/storage_encryption_key:ro
    networks:
      - edge
    security_opt:
      - no-new-privileges:true

networks:
  backend:
    driver: bridge
    internal: true
  edge:
    driver: bridge