services:
  mrwho-oidc:
    depends_on:
      mrwho-postgres:
        condition: service_healthy
      mrwho-redis:
        condition: service_healthy
    environment:
      ASPNETCORE_ENVIRONMENT: Production
      Redis__Enabled: ${REDIS_ENABLED:-true}
      Redis__ConnectionString: ${REDIS_CONNECTION_STRING:-mrwho-redis:6379,abortConnect=false}
      Redis__Database: ${REDIS_DATABASE:-0}
      Redis__InstanceName: ${REDIS_INSTANCE_NAME:-mrwho-prod}
      Logging__LogLevel__Default: ${LOGGING_LEVEL:-Information}
      Logging__LogLevel__Microsoft.AspNetCore: Warning
      Logging__LogLevel__Microsoft.EntityFrameworkCore: Warning
      Logging__Console__FormatterName: json
    user: "1000:1000"
    read_only: true
    tmpfs:
      - /tmp:mode=1777,size=100M
      - /var/tmp:mode=1777,size=50M
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '1.0'
          memory: 1G
    restart: always

  mrwho-postgres:
    user: "999:999"
    read_only: true
    tmpfs:
      - /tmp:mode=1777,size=200M
      - /var/run/postgresql:mode=1777,size=10M
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - FOWNER
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB && psql -U $$POSTGRES_USER -d $$POSTGRES_DB -c 'SELECT 1' > /dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    restart: always

  mrwho-redis:
    image: redis:7.2-alpine
    container_name: mrwho-redis
    command: redis-server --save 60 1 --loglevel warning --maxmemory 1gb --maxmemory-policy allkeys-lru
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 5s
    restart: always
    networks:
      - internal

volumes:
  redis-data:
    driver: local