services:
  db:
    image: postgres:17-bookworm
    environment:
      POSTGRES_DB: hamham
      POSTGRES_USER: hamham
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
    volumes:
      - database:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U hamham -d hamham']
      interval: 5s
      timeout: 5s
      retries: 20
    restart: unless-stopped
    stop_grace_period: 30s
  app:
    build: .
    environment:
      DATABASE_URL: postgres://hamham:${POSTGRES_PASSWORD}@db:5432/hamham
      APP_ORIGIN: ${APP_ORIGIN:-http://localhost:3000}
      COOKIE_SECURE: ${COOKIE_SECURE:-false}
      TRUST_PROXY: ${TRUST_PROXY:-false}
      UPLOAD_DIR: /app/uploads
    ports:
      - '${HOST_PORT:-3000}:3000'
    volumes:
      - images:/app/uploads
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test:
        [
          'CMD',
          'node',
          '-e',
          "fetch('http://localhost:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 10s
      start_period: 45s
      retries: 3
    restart: unless-stopped
    stop_grace_period: 30s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
volumes:
  database:
  images: