services:
  db:
    image: postgres:17-alpine
    restart: unless-stopped
    ports:
      - "127.0.0.1:15432:5432"
    environment:
      POSTGRES_DB: ${POSTGRES_DB:?Set POSTGRES_DB in .env}
      POSTGRES_USER: ${POSTGRES_USER:?Set POSTGRES_USER in .env}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 12

  web:
    build: .
    restart: unless-stopped
    env_file: .env
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - media_data:/app/media
      - static_data:/app/staticfiles
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; r=urllib.request.Request('http://127.0.0.1:8000/health/', headers={'X-Forwarded-Proto':'https'}); urllib.request.urlopen(r, timeout=3)"]
      interval: 15s
      timeout: 5s
      retries: 5

  traefik:
    image: traefik:v3.7.13
    restart: unless-stopped
    depends_on:
      web:
        condition: service_healthy
    environment:
      APP_HOST: ${APP_HOST:?Set APP_HOST in .env}
      TRAEFIK_CERT_RESOLVER: ${TRAEFIK_CERT_RESOLVER:-letsencrypt}
    command:
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http3=true
      - --entrypoints.traefik.address=:8080
      - --ping=true
      - --api.dashboard=false
      - --providers.file.directory=/etc/traefik/dynamic
      - --providers.file.watch=true
      - --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:-}
      - --certificatesresolvers.letsencrypt.acme.storage=/acme/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./traefik/dynamic:/etc/traefik/dynamic:ro
      - ./tls/certs:/certs:ro
      - traefik_acme:/acme
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 15s
      timeout: 5s
      retries: 5

  migration:
    profiles: ["tools"]
    build: .
    env_file: .env
    # Offline tools need access to the host backup directory. The web service
    # continues to run as the unprivileged app user.
    user: "0:0"
    entrypoint: ["python"]
    command: ["manage.py", "check"]
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - .:/legacy:ro
      - ./backups:/transfer
      - media_data:/app/media

volumes:
  postgres_data:
  media_data:
  static_data:
  traefik_acme: