services:
  creator-hub:
    build: .
    environment:
      DATABASE_URL: postgres://creatorhub@postgres/creatorhub?sslmode=disable
      CONTROL_PLANE_USERNAME: ${CONTROL_PLANE_USERNAME:?required}
      CONTROL_PLANE_PASSWORD: ${CONTROL_PLANE_PASSWORD:?required}
      CREATORHUB_CREDENTIAL_MASTER_KEY: ${CREATORHUB_CREDENTIAL_MASTER_KEY:?required}
    ports:
      - "${CREATORHUB_PORT:-8080}:8080"
    read_only: true
    volumes:
      - creatorhub_credentials:/var/lib/creatorhub/credentials
    tmpfs:
      - /tmp:size=16m,noexec,nosuid,nodev
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    depends_on:
      docker-gateway:
        condition: service_healthy
      postgres:
        condition: service_healthy
    networks: [control]
    restart: unless-stopped

  postgres:
    image: postgres:17-alpine@sha256:18cfe3ef5e6815560c98237d6216d1e5119702fb0f3894c8785dd58b8bbe5d73
    environment:
      POSTGRES_DB: creatorhub
      POSTGRES_USER: creatorhub
      POSTGRES_HOST_AUTH_METHOD: trust
    healthcheck:
      test: [CMD-SHELL, pg_isready -h 127.0.0.1 -U creatorhub -d creatorhub]
      interval: 2s
      timeout: 2s
      retries: 15
    volumes:
      - creatorhub_postgres:/var/lib/postgresql/data
    read_only: true
    tmpfs:
      - /run/postgresql:size=1m,nosuid,nodev
      - /tmp:size=16m,nosuid,nodev
    cap_drop: [ALL]
    cap_add: [CHOWN, FOWNER, DAC_OVERRIDE, SETUID, SETGID]
    security_opt: [no-new-privileges:true]
    networks: [control]
    restart: unless-stopped

  docker-gateway:
    build: .
    command: ["/app/docker-gateway"]
    labels:
      io.creatorhub.gateway-member: "true"
    environment:
      BROWSER_NETWORK: creatorhub_browser
      GATEWAY_TOKEN: ${GATEWAY_TOKEN:-dev-creatorhub-gateway-token}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    group_add:
      - "${DOCKER_GID:-999}"
    healthcheck:
      test: [CMD, wget, -q, -O, /dev/null, http://127.0.0.1:8081/healthz]
      interval: 2s
      timeout: 2s
      retries: 15
    read_only: true
    tmpfs:
      - /tmp:size=16m,noexec,nosuid,nodev
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    networks: [control]
    restart: unless-stopped

networks:
  control:
    name: creatorhub_control
volumes:
  creatorhub_postgres:
  creatorhub_credentials: