name: siteforge-v8-10-enterprise
services:
  siteforge:
    build:
      context: .
      dockerfile: Dockerfile.enterprise
      args:
        SITEFORGE_GIT_SHA: ${SITEFORGE_GIT_SHA:-unknown}
    image: siteforge/web:8.10.0-dev.1
    init: true
    restart: unless-stopped
    ports:
      - '127.0.0.1:${SITEFORGE_PORT:-8787}:8787'
    environment:
      SITEFORGE_DATA_DIR: /data
      SITEFORGE_MAX_PENDING_JOBS: ${SITEFORGE_MAX_PENDING_JOBS:-100}
      SITEFORGE_MAX_PENDING_JOBS_PER_SITE: ${SITEFORGE_MAX_PENDING_JOBS_PER_SITE:-5}
      SITEFORGE_OUTBOUND_PORTS: ${SITEFORGE_OUTBOUND_PORTS:-80,443}
      SITEFORGE_MYSQL_ALLOWED_HOSTS: ${SITEFORGE_MYSQL_ALLOWED_HOSTS:-}
      SITEFORGE_MYSQL_ALLOWED_TABLES: ${SITEFORGE_MYSQL_ALLOWED_TABLES:-}
      SITEFORGE_DATABASE_URL: postgresql://${SITEFORGE_PG_USER:-siteforge}:${SITEFORGE_PG_PASSWORD:?Set strong PG password}@postgres:5432/${SITEFORGE_PG_DB:-siteforge}
      SITEFORGE_REDIS_URL: redis://redis:6379/0
      SITEFORGE_ADMIN_PASSWORD: ${SITEFORGE_ADMIN_PASSWORD:?Set admin password}
      SITEFORGE_SESSION_SECRET: ${SITEFORGE_SESSION_SECRET:?Set session secret}
      SITEFORGE_COOKIE_SECURE: ${SITEFORGE_COOKIE_SECURE:-false}
      SITEFORGE_PUBLISH_ROOT: /published
      SITEFORGE_REQUIRE_RELEASE_APPROVAL: 'true'
      SITEFORGE_DEPLOY_STAGING_URL: ${SITEFORGE_DEPLOY_STAGING_URL:-}
      SITEFORGE_DEPLOY_STAGING_SECRET: ${SITEFORGE_DEPLOY_STAGING_SECRET:-}
      SITEFORGE_DEPLOY_STAGING_SECRET_REF: ${SITEFORGE_DEPLOY_STAGING_SECRET_REF:-}
      SITEFORGE_DEPLOY_PRODUCTION_URL: ${SITEFORGE_DEPLOY_PRODUCTION_URL:-}
      SITEFORGE_DEPLOY_PRODUCTION_SECRET: ${SITEFORGE_DEPLOY_PRODUCTION_SECRET:-}
      SITEFORGE_DEPLOY_PRODUCTION_SECRET_REF: ${SITEFORGE_DEPLOY_PRODUCTION_SECRET_REF:-}
    depends_on:
      postgres: {condition: service_healthy}
      redis: {condition: service_healthy}
    volumes:
      - siteforge_data:/data
      - siteforge_published:/published
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: ['no-new-privileges:true']
    healthcheck:
      test: ['CMD','python','-c',"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8787/api/health',timeout=3)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
  worker:
    image: siteforge/web:8.10.0-dev.1
    command: ['python','-m','app.worker']
    init: true
    restart: unless-stopped
    environment:
      SITEFORGE_DATA_DIR: /data
      SITEFORGE_MAX_PENDING_JOBS: ${SITEFORGE_MAX_PENDING_JOBS:-100}
      SITEFORGE_MAX_PENDING_JOBS_PER_SITE: ${SITEFORGE_MAX_PENDING_JOBS_PER_SITE:-5}
      SITEFORGE_OUTBOUND_PORTS: ${SITEFORGE_OUTBOUND_PORTS:-80,443}
      SITEFORGE_MYSQL_ALLOWED_HOSTS: ${SITEFORGE_MYSQL_ALLOWED_HOSTS:-}
      SITEFORGE_MYSQL_ALLOWED_TABLES: ${SITEFORGE_MYSQL_ALLOWED_TABLES:-}
      SITEFORGE_MYSQL_CA_FILE: ${SITEFORGE_MYSQL_CA_FILE:-}
      SITEFORGE_MYSQL_READ_USER: ${SITEFORGE_MYSQL_READ_USER:-}
      SITEFORGE_MYSQL_READ_PASSWORD: ${SITEFORGE_MYSQL_READ_PASSWORD:-}
      SITEFORGE_DATABASE_URL: postgresql://${SITEFORGE_PG_USER:-siteforge}:${SITEFORGE_PG_PASSWORD:?Set PG password}@postgres:5432/${SITEFORGE_PG_DB:-siteforge}
      SITEFORGE_REDIS_URL: redis://redis:6379/0
      SITEFORGE_BUILD_TIMEOUT_SECONDS: ${SITEFORGE_BUILD_TIMEOUT_SECONDS:-300}
      SITEFORGE_BUILD_MAX_ATTEMPTS: ${SITEFORGE_BUILD_MAX_ATTEMPTS:-3}
    depends_on:
      siteforge: {condition: service_started}
      postgres: {condition: service_healthy}
      redis: {condition: service_healthy}
    volumes:
      - siteforge_data:/data
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: ['no-new-privileges:true']
    healthcheck:
      test: ["CMD", "python", "-m", "app.worker_health"]
      interval: 20s
      timeout: 5s
      retries: 3
      start_period: 30s
  postgres:
    image: postgres:16.9-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${SITEFORGE_PG_USER:-siteforge}
      POSTGRES_PASSWORD: ${SITEFORGE_PG_PASSWORD:?Set PG password}
      POSTGRES_DB: ${SITEFORGE_PG_DB:-siteforge}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL','pg_isready -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}"']
      interval: 10s
      timeout: 5s
      retries: 10
    security_opt: ['no-new-privileges:true']
  redis:
    image: redis:7.4.2-alpine
    restart: unless-stopped
    command: ['redis-server','--save','', '--appendonly','no', '--maxmemory','64mb','--maxmemory-policy','allkeys-lru']
    healthcheck:
      test: ['CMD','redis-cli','ping']
      interval: 10s
      timeout: 3s
      retries: 10
    security_opt: ['no-new-privileges:true']
volumes:
  postgres_data:
  siteforge_data:
  siteforge_published: