name: weathertool-uat

services:
  postgres:
    image: postgres:16.1
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in .env.staging}
      POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in .env.staging}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env.staging}
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - backend
    security_opt:
      - no-new-privileges:true

  app:
    image: ${WEATHERTOOL_IMAGE:?set WEATHERTOOL_IMAGE in .env.staging}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DB_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB}
      DB_USER: ${POSTGRES_USER}
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      ENABLE_SCHEDULED_JOBS: "false"
      DEBUG: "false"
    ports:
      - "127.0.0.1:${WEATHERTOOL_PORT:-8002}:8080"
    volumes:
      - ./data/app:/app/data
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    networks:
      - backend
    security_opt:
      - no-new-privileges:true

  authelia:
    image: authelia/authelia:4.39.20
    restart: unless-stopped
    environment:
      AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: /run/secrets/jwt_secret
      AUTHELIA_SESSION_SECRET_FILE: /run/secrets/session_secret
      AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /run/secrets/storage_encryption_key
    ports:
      - "127.0.0.1:${AUTHELIA_PORT:-9091}:9091"
    volumes:
      - ./config/authelia:/config:ro
      - ./data/authelia:/var/lib/authelia
      - ./secrets/jwt_secret:/run/secrets/jwt_secret:ro
      - ./secrets/session_secret:/run/secrets/session_secret:ro
      - ./secrets/storage_encryption_key:/run/secrets/storage_encryption_key:ro
    networks:
      - backend
    security_opt:
      - no-new-privileges:true

networks:
  backend:
    driver: bridge
    internal: true