services:
  postgres:
    entrypoint:
      - /bin/sh
      - -ec
      - |
        install -o postgres -g postgres -m 600 /run/tls/postgres.key /var/lib/postgresql/server.key
        install -o postgres -g postgres -m 644 /run/tls/postgres.crt /var/lib/postgresql/server.crt
        exec docker-entrypoint.sh postgres -c ssl=on -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key
    command: []
    volumes:
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro

  redis:
    entrypoint:
      - /bin/sh
      - -ec
      - |
        install -o redis -g redis -m 600 /run/tls/redis.key /data/redis.key
        install -o redis -g redis -m 644 /run/tls/redis.crt /data/redis.crt
        exec /usr/bin/setpriv --reuid redis --regid redis --clear-groups redis-server --port 0 --tls-port 6379 --tls-cert-file /data/redis.crt --tls-key-file /data/redis.key --tls-ca-cert-file /run/tls/ca.crt --tls-auth-clients no --requirepass "$${REDIS_PASSWORD}" --appendonly yes
    command: []
    volumes:
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "redis-cli --tls --cacert /run/tls/ca.crt -h redis -a '$${REDIS_PASSWORD}' ping",
        ]

  gochat:
    environment:
      SSL_CERT_FILE: /run/tls/ca.crt
    volumes:
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro

  worker:
    environment:
      SSL_CERT_FILE: /run/tls/ca.crt
    volumes:
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro

  migrate:
    environment:
      SSL_CERT_FILE: /run/tls/ca.crt
    volumes:
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro