name: n3xremiza

x-app-environment: &app-environment
  N3XREMIZA_DATABASE_PASSWORD_FILE: /run/n3xremiza/database_password
  N3XREMIZA_GEOCODING_BASE_URL: ${N3XREMIZA_GEOCODING_BASE_URL:-https://photon.komoot.io}
  N3XREMIZA_GEOCODING_BBOX: ${N3XREMIZA_GEOCODING_BBOX:-14.122,49.002,24.145,54.835}
  N3XREMIZA_TRUST_PROXY_HOPS: ${N3XREMIZA_TRUST_PROXY_HOPS:-0}
  N3XREMIZA_AUTH_AUDIT_RETENTION_DAYS: ${N3XREMIZA_AUTH_AUDIT_RETENTION_DAYS:-365}
  TZ: Europe/Warsaw

x-app-security: &app-security
  read_only: true
  security_opt:
    - no-new-privileges:true
  cap_drop:
    - ALL
  tmpfs:
    - /tmp:size=64m,mode=1777
    - /app/.next/cache:size=128m,mode=0700,uid=1001,gid=1001

services:
  bootstrap:
    image: alpine:3.22
    restart: "no"
    command:
      - /bin/sh
      - -ec
      - |
        umask 077
        if [ ! -s /run/n3xremiza/database_password ]; then
          od -An -N32 -tx1 /dev/urandom | tr -d ' \n' > /run/n3xremiza/database_password
        fi
        chmod 0444 /run/n3xremiza/database_password
    volumes:
      - runtime_secrets:/run/n3xremiza
    networks:
      - backend
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  web:
    image: ghcr.io/nexitpl/n3xremiza:latest
    pull_policy: always
    restart: unless-stopped
    depends_on:
      bootstrap:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    environment: *app-environment
    volumes:
      - runtime_secrets:/run/n3xremiza:ro
      - attachments_data:/app/data/attachments
    ports:
      # Keep this port behind a host firewall until the owner account exists.
      # For Internet access, place the app behind an HTTPS reverse proxy.
      - "0.0.0.0:8791:3000"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/api/health"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - frontend
      - backend
    <<: *app-security

  worker:
    image: ghcr.io/nexitpl/n3xremiza:latest
    pull_policy: always
    restart: unless-stopped
    depends_on:
      bootstrap:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      web:
        condition: service_healthy
    environment: *app-environment
    volumes:
      - runtime_secrets:/run/n3xremiza:ro
    command: ["node", "dist/worker.mjs"]
    networks:
      - backend
    <<: *app-security

  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    depends_on:
      bootstrap:
        condition: service_completed_successfully
    environment:
      POSTGRES_DB: n3xremiza
      POSTGRES_USER: n3xremiza
      POSTGRES_PASSWORD_FILE: /run/n3xremiza/database_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - runtime_secrets:/run/n3xremiza:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n3xremiza -d n3xremiza"]
      interval: 5s
      timeout: 5s
      retries: 12
    networks:
      - backend

networks:
  frontend:
  backend:
    internal: true

volumes:
  postgres_data:
  runtime_secrets:
  attachments_data: