name: tapm

services:
  broker:
    build: .
    image: tai/tapm-deployment-broker:local
    env_file:
      - path: .env
        required: false
    restart: unless-stopped
    init: true
    read_only: true
    networks:
      - edge
    volumes:
      - ./config/broker:/data
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp:size=16m,mode=1777
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8080/health/ready"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

  nginx:
    image: nginx:1.28-alpine
    restart: unless-stopped
    networks:
      - edge
    ports:
      - "${HTTP_PORT:-8680}:80"
      - "${HTTPS_PORT:-8643}:443"
    volumes:
      - ./deploy/nginx/templates/bootstrap.conf.template:/etc/nginx/templates/default.conf.template:ro
      - ./config/letsencrypt:/etc/letsencrypt:ro
      - ./config/certbot-webroot:/var/www/certbot:ro
    environment:
      BROKER_DOMAIN: ${BROKER_DOMAIN}
      GITEA_DOMAIN: ${GITEA_DOMAIN}
    security_opt:
      - no-new-privileges:true

  certbot:
    image: certbot/certbot:v5.7.0
    profiles: ["tools"]
    volumes:
      - ./config/letsencrypt:/etc/letsencrypt
      - ./config/certbot-webroot:/var/www/certbot

networks:
  edge:
    name: tapm-edge