services:
  database:
    image: postgres:17.6
    environment:
      POSTGRES_USER: opennexus
      POSTGRES_DB: opennexus
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?required}
    volumes:
      - postgres:/var/lib/postgresql/data
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U opennexus -d opennexus"]
      interval: 5s
      retries: 20
  objects:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    command: server /data
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:?required}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?required}
    volumes:
      - objects:/data
  initialize:
    build:
      context: .
      args:
        OPENNEXUS_SYNC_VERSION: ${OPENNEXUS_SYNC_TAG:-0.3.2-alpha.1}
    image: opennexus-sync:${OPENNEXUS_SYNC_TAG:-0.3.2-alpha.1}
    command: ["/service/.venv/bin/python", "-m", "sync_server", "initialize"]
    environment:
      SYNC_DATABASE_URL: ${SYNC_DATABASE_URL:?required}
      SYNC_S3_ENDPOINT: http://objects:9000
      SYNC_S3_BUCKET: ${SYNC_S3_BUCKET:-opennexus}
      AWS_ACCESS_KEY_ID: ${MINIO_ROOT_USER:?required}
      AWS_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD:?required}
      AWS_DEFAULT_REGION: us-east-1
    depends_on:
      database:
        condition: service_healthy
      objects:
        condition: service_started
    restart: "no"
  sync:
    build:
      context: .
      args:
        OPENNEXUS_SYNC_VERSION: ${OPENNEXUS_SYNC_TAG:-0.3.2-alpha.1}
    image: opennexus-sync:${OPENNEXUS_SYNC_TAG:-0.3.2-alpha.1}
    environment:
      SYNC_DATABASE_URL: ${SYNC_DATABASE_URL:?required}
      SYNC_S3_ENDPOINT: http://objects:9000
      SYNC_S3_BUCKET: ${SYNC_S3_BUCKET:-opennexus}
      AWS_ACCESS_KEY_ID: ${SYNC_ACCESS_KEY_ID:?required}
      AWS_SECRET_ACCESS_KEY: ${SYNC_SECRET_ACCESS_KEY:?required}
      AWS_DEFAULT_REGION: us-east-1
    depends_on:
      initialize:
        condition: service_completed_successfully
    volumes:
      - staging:/staging
    ports:
      - "${SYNC_BIND_ADDRESS:-127.0.0.1}:${SYNC_PORT:-8080}:8080"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop: [ALL]
    healthcheck:
      test: ["CMD", "/service/.venv/bin/python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/ready', timeout=3).read()"]
      interval: 15s
      timeout: 5s
      retries: 8
      start_period: 20s
volumes:
  postgres:
  objects:
  staging: