name: tapm

x-default-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

services:
  broker:
    container_name: tapm-broker
    build: .
    image: tai/tapm-deployment-broker:local
    env_file:
      - path: .env
        required: false
    restart: unless-stopped
    init: true
    pids_limit: 128
    logging: *default-logging
    read_only: true
    networks:
      - edge
    volumes:
      - ./config/broker:/data
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp:size=16m,mode=1777
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8080/health/ready"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

  gitea:
    container_name: tapm-gitea
    image: docker.gitea.com/gitea:1.26.4-rootless
    restart: unless-stopped
    pids_limit: 512
    logging: *default-logging
    networks:
      - edge
    volumes:
      - ./config/gitea/data:/var/lib/gitea
      - ./config/gitea/config:/etc/gitea
    environment:
      GITEA__database__DB_TYPE: sqlite3
      GITEA__database__PATH: /var/lib/gitea/data/gitea.db
      GITEA__server__DOMAIN: ${GITEA_DOMAIN}
      GITEA__server__ROOT_URL: https://${GITEA_DOMAIN}/
      GITEA__server__HTTP_ADDR: 0.0.0.0
      GITEA__server__HTTP_PORT: "3000"
      GITEA__server__DISABLE_SSH: "true"
      GITEA__session__COOKIE_SECURE: "true"
      GITEA__service__DISABLE_REGISTRATION: "true"
      GITEA__security__INSTALL_LOCK: "true"
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:3000/api/healthz"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s

  nginx:
    container_name: tapm-nginx
    image: nginx:1.28-alpine
    restart: unless-stopped
    read_only: true
    pids_limit: 128
    logging: *default-logging
    networks:
      - edge
    ports:
      - "${HTTP_PORT:-8680}:80"
      - "${HTTPS_PORT:-8643}:443"
    volumes:
      - ./deploy/nginx/templates/bootstrap.conf.template:/etc/nginx/templates/default.conf.template:ro
      - ./config/certbot-webroot:/var/www/certbot:ro
    environment:
      BROKER_DOMAIN: ${BROKER_DOMAIN}
      GITEA_DOMAIN: ${GITEA_DOMAIN}
      SSL_CERTIFICATE_FILE: ${SSL_CERTIFICATE_FILE:-fullchain.pem}
      SSL_CERTIFICATE_KEY_FILE: ${SSL_CERTIFICATE_KEY_FILE:-privkey.pem}
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /etc/nginx/conf.d:size=1m,mode=0755
      - /var/cache/nginx:size=32m,mode=0755
      - /var/run:size=1m,mode=0755

  certbot:
    image: certbot/certbot:v5.7.0
    profiles: ["tools"]
    pids_limit: 128
    logging: *default-logging
    volumes:
      - ./config/letsencrypt:/etc/letsencrypt
      - ./config/certbot-webroot:/var/www/certbot

networks:
  edge:
    external: true
    name: tapm-edge