services:
  postgres:
    image: ${POSTGRES_IMAGE_REF:-pgvector/pgvector:pg16@sha256:ccc6e83d6e35e931dc7c5def2022729d5a6c370318d099181995567ff1fb4d6b}
    restart: always
    entrypoint:
      - /bin/sh
      - -ec
      - |
        install -o postgres -g postgres -m 600 /run/tls/postgres.key /var/lib/postgresql/server.key
        install -o postgres -g postgres -m 644 /run/tls/postgres.crt /var/lib/postgresql/server.crt
        exec docker-entrypoint.sh postgres -c ssl=on -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key
    command: []
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-gochat_production}
      POSTGRES_USER: ${POSTGRES_USER:-gochat}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD for the smoke database}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
    networks:
      default:
        aliases: [db.smoke.test]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 20
    deploy:
      resources:
        limits:
          memory: 1G
    logging:
      driver: fluentd
      options:
        fluentd-address: 127.0.0.1:24224
        fluentd-async: "true"
        fluentd-buffer-limit: "65536"
        tag: gochat.{{.Name}}

  redis:
    image: ${REDIS_IMAGE_REF:-redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf}
    restart: always
    entrypoint:
      - /bin/sh
      - -ec
      - |
        install -o redis -g redis -m 600 /run/tls/redis.key /data/redis.key
        install -o redis -g redis -m 644 /run/tls/redis.crt /data/redis.crt
        exec /usr/bin/setpriv --reuid redis --regid redis --clear-groups redis-server --port 0 --tls-port 6379 --tls-cert-file /data/redis.crt --tls-key-file /data/redis.key --tls-ca-cert-file /run/tls/ca.crt --tls-auth-clients no --requirepass "$${REDIS_PASSWORD}" --appendonly yes
    command: []
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?set REDIS_PASSWORD for smoke Redis}
    volumes:
      - redis_data:/data
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "redis-cli --tls --cacert /run/tls/ca.crt -h redis -a '$${REDIS_PASSWORD}' ping",
        ]
      interval: 5s
      timeout: 5s
      retries: 20
    deploy:
      resources:
        limits:
          memory: 512M
    logging:
      driver: fluentd
      options:
        fluentd-address: 127.0.0.1:24224
        fluentd-async: "true"
        fluentd-buffer-limit: "65536"
        tag: gochat.{{.Name}}

  gochat:
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      SSL_CERT_FILE: /run/tls/ca.crt
    volumes:
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro

  worker:
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      SSL_CERT_FILE: /run/tls/ca.crt
    volumes:
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro

  migrate:
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      SSL_CERT_FILE: /run/tls/ca.crt
    volumes:
      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro

  backup:
    depends_on:
      postgres:
        condition: service_healthy

  restore:
    depends_on:
      postgres:
        condition: service_healthy

  postgres-exporter:
    depends_on:
      postgres:
        condition: service_healthy

  redis-exporter:
    depends_on:
      redis:
        condition: service_healthy

volumes:
  postgres_data:
  redis_data: