services:
  api:
    image: registry.gitlab.com/duartesantos8/opengym/api:latest
    container_name: opengym-api
    hostname: opengym-api
    user: "1021:100"
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    environment:
      DATA_DIR: /data
      PORT: ${PORT:-3000}
      RP_ID: ${RP_ID:-localhost}
      ORIGIN: ${ORIGIN:-http://localhost:8080}
      RP_NAME: ${RP_NAME:-openGym}
      SESSION_DAYS: ${SESSION_DAYS:-90}
      ADMIN_UIDS: ${ADMIN_UIDS:-}
      INVITE_ONLY: ${INVITE_ONLY:-}
      ALLOW_GUEST: ${ALLOW_GUEST:-1}
      AUDIT_LOG: ${AUDIT_LOG:-1}
      AUDIT_IP: ${AUDIT_IP:-off}
      VAPID_SUBJECT: ${VAPID_SUBJECT:-}
      COACH_DISABLED: ${COACH_DISABLED:-1}
    volumes:
      - ./data:/data:rw
    networks:
      - opengym-net
    healthcheck:
      test: ["CMD-SHELL", "node -e \"require('http').get('http://127.0.0.1:${PORT:-3000}/', r => process.exit(r.statusCode < 500 ? 0 : 1)).on('error', () => process.exit(1))\""]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    restart: unless-stopped

  web:
    image: registry.gitlab.com/duartesantos8/opengym/web:1.3.7
    container_name: opengym-web
    hostname: opengym-web
    user: "1021:100"
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=32m
      - /var/cache/nginx:rw,noexec,nosuid,size=64m
      - /var/run:rw,noexec,nosuid,size=1m
      - /etc/nginx/conf.d:rw,noexec,nosuid,size=1m
    environment:
      BACKEND: api
      PORT: ${PORT:-3000}
      NGINX_PORT: ${NGINX_PORT:-8080}   # >1024, damit keine Capability noetig ist
    ports:
      - "${WEB_PORT:-8080}:${NGINX_PORT:-8080}"
    depends_on:
      api:
        condition: service_healthy
    networks:
      - opengym-net
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:${NGINX_PORT:-8080}/ || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped

networks:
  opengym-net:
    driver: bridge