name: wealthledger

x-backend: &backend
  image: ${BACKEND_IMAGE:?Set versioned backend image in release.env}
  environment:
    NODE_ENV: production
    PORT: '3000'
    DATABASE_URL: file:/data/wealthledger.db
    TBANK_CA_CERT_PATH: ${TBANK_CA_CERT_PATH:-/certs/tbank-ca.pem}
    FRONTEND_ORIGIN: ${FRONTEND_ORIGIN:?Set browser-visible HTTPS origin}
    JWT_SECRET: ${JWT_SECRET:?Keep the existing JWT secret}
    TOKEN_ENCRYPTION_KEY: ${TOKEN_ENCRYPTION_KEY:?Keep the existing encryption key}
    LOG_LEVEL: ${LOG_LEVEL:-info}
  volumes:
    - type: bind
      source: ${DATA_DIRECTORY:?Set existing absolute data directory}
      target: /data
      bind:
        create_host_path: false
    - type: bind
      source: ${TBANK_CA_CERT_FILE:?Set existing absolute CA certificate filename}
      target: ${TBANK_CA_CERT_PATH:-/certs/tbank-ca.pem}
      read_only: true
      bind:
        create_host_path: false
  read_only: true
  init: true
  security_opt: [no-new-privileges:true]
  cap_drop: [ALL]

services:
  migration:
    <<: *backend
    command: [node, node_modules/prisma/build/index.js, migrate, deploy]
    restart: 'no'
    healthcheck:
      disable: true

  backend:
    <<: *backend
    scale: 1
    restart: unless-stopped
    depends_on:
      migration:
        condition: service_completed_successfully

  frontend:
    image: ${FRONTEND_IMAGE:?Set versioned frontend image in release.env}
    ports:
      - '127.0.0.1:${FRONTEND_PORT:-8080}:8080'
    read_only: true
    tmpfs: [/tmp]
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    restart: unless-stopped
    depends_on:
      backend:
        condition: service_healthy