services:
  postgres:
    image: postgres:16-bookworm
    restart: unless-stopped
    environment:
      POSTGRES_DB: pk_lab
      POSTGRES_USER: pk_lab
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U pk_lab -d pk_lab"]
      interval: 5s
      timeout: 5s
      retries: 30
    security_opt: [no-new-privileges:true]
    mem_limit: 512m

  api:
    image: ${DEPLOY_IMAGE:?Set DEPLOY_IMAGE}
    restart: unless-stopped
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    tmpfs: [/tmp:rw,noexec,nosuid,size=64m]
    mem_limit: 512m
    pids_limit: 128
    ports:
      - "${DEPLOY_BIND_IP:-0.0.0.0}:${DEPLOY_PORT:-18082}:8000"
    environment:
      DATABASE_URL: postgresql+psycopg://pk_lab:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/pk_lab
      TOKEN_SECRET: ${TOKEN_SECRET:?Set TOKEN_SECRET}
      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:18082}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000,http://localhost:3002}
      TEST_AUTH_ENABLED: ${TEST_AUTH_ENABLED:-false}
      XHS_HUB_APP_ID: ${XHS_HUB_APP_ID:-}
      XHS_HUB_APP_SECRET: ${XHS_HUB_APP_SECRET:-}
      XHS_RICE_APP_ID: ${XHS_RICE_APP_ID:-}
      XHS_RICE_APP_SECRET: ${XHS_RICE_APP_SECRET:-}
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  postgres-data:
    name: pk-lab-postgres-data