# Deploy separately behind a proper TLS proxy. No publication credentials.
# Example: docker compose -f compose.yaml -f compose.s3-gateway.example.yaml up -d --build
services:
  s3-site-gateway:
    image: siteforge/web:8.21.0-dev.1
    depends_on:
      siteforge: {condition: service_started}
    command: ["python", "-m", "uvicorn", "app.s3_gateway:app", "--host", "0.0.0.0", "--port", "8791"]
    restart: unless-stopped
    environment:
      SITEFORGE_S3_GATEWAY_BUCKET: ${SITEFORGE_PRODUCTION_S3_BUCKET:?Set S3 bucket}
      SITEFORGE_S3_GATEWAY_REGION: ${SITEFORGE_PRODUCTION_S3_REGION:?Set region}
      SITEFORGE_S3_GATEWAY_PREFIX: ${SITEFORGE_PRODUCTION_S3_PREFIX:-siteforge}
      # Supply read-only IAM role via workload identity; do not put keys in source files.
    ports:
      - "127.0.0.1:${SITEFORGE_GATEWAY_PORT:-8791}:8791"
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]
    pids_limit: 64
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8791/health', timeout=3)"]
      interval: 30s
      timeout: 5s
      retries: 3