name: n3xmarket

# Infrastructure settings that cannot be changed safely by a running web app
# live in this file: image versions, host bind/port, Docker networks, volumes
# and database service identity. Provider keys, AI, alerts, public URL and time
# zone are configured after first start in the authenticated web panel.
# No .env values are referenced or required by this stack.

x-app-environment: &app-environment
  N3XMARKET_DATABASE_PASSWORD_FILE: /run/n3xmarket/database_password

x-app-security: &app-security
  read_only: true
  security_opt:
    - no-new-privileges:true
  cap_drop:
    - ALL
  tmpfs:
    - /tmp:size=64m,mode=1777
    # Next.js image optimization writes a runtime cache even with a read-only
    # root filesystem. Keep it writable, private and ephemeral.
    - /app/.next/cache:size=128m,mode=0700,uid=1001,gid=1001

services:
  bootstrap:
    image: alpine:3.22
    restart: "no"
    environment:
      # Upgrade from N3XMarket 0.1 only: put the former PostgreSQL password
      # between these single quotes for the first upgraded start, then change
      # it back to an empty string. New installations must leave this empty.
      LEGACY_POSTGRES_PASSWORD: ''
    command:
      - /bin/sh
      - -ec
      - |
        umask 077
        if [ -n "$${LEGACY_POSTGRES_PASSWORD:-}" ]; then
          printf '%s' "$$LEGACY_POSTGRES_PASSWORD" > /run/n3xmarket/database_password
        elif [ ! -s /run/n3xmarket/database_password ]; then
          od -An -N32 -tx1 /dev/urandom | tr -d ' \n' > /run/n3xmarket/database_password
        fi
        if [ ! -s /run/n3xmarket/settings_key ]; then
          od -An -N32 -tx1 /dev/urandom | tr -d ' \n' > /run/n3xmarket/settings_key
        fi
        chmod 0444 /run/n3xmarket/database_password /run/n3xmarket/settings_key
    volumes:
      - runtime_secrets:/run/n3xmarket
    networks:
      - backend
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  web:
    image: ghcr.io/nexitpl/n3xmarket:latest
    pull_policy: always
    restart: unless-stopped
    depends_on:
      bootstrap:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    environment: *app-environment
    volumes:
      - runtime_secrets:/run/n3xmarket:ro
    ports:
      # Ready for first-run access from the LAN and for a reverse proxy in
      # another container or host. Restrict 8790 with the host firewall and
      # create the owner account before exposing this port to the Internet.
      - "0.0.0.0:8790:3000"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/api/health"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - frontend
      - backend
    <<: *app-security

  worker:
    image: ghcr.io/nexitpl/n3xmarket:latest
    pull_policy: always
    restart: unless-stopped
    depends_on:
      bootstrap:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      web:
        condition: service_healthy
    environment: *app-environment
    volumes:
      - runtime_secrets:/run/n3xmarket:ro
    command: ["node", "dist/worker.mjs"]
    networks:
      - backend
    <<: *app-security

  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    depends_on:
      bootstrap:
        condition: service_completed_successfully
    environment:
      POSTGRES_DB: n3xmarket
      POSTGRES_USER: n3xmarket
      POSTGRES_PASSWORD_FILE: /run/n3xmarket/database_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - runtime_secrets:/run/n3xmarket:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n3xmarket -d n3xmarket"]
      interval: 5s
      timeout: 5s
      retries: 12
    networks:
      - backend

networks:
  frontend:
  backend:
    internal: true

volumes:
  postgres_data:
  runtime_secrets: