services:
  fluxip-init:
    build:
      context: .
      dockerfile: Dockerfile
    image: fluxip:local
    user: "0:0"
    command:
      - /bin/sh
      - /app/deploy/prepare-volumes.sh
    volumes:
      - ./data/fluxip-data:/app/data
      - ./data/fluxip-key:/app/secrets
      - ./data/fluxip-backups:/app/backups
    read_only: true
    network_mode: none
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
    security_opt:
      - no-new-privileges:true
    healthcheck:
      disable: true
    restart: "no"

  fluxip:
    build:
      context: .
      dockerfile: Dockerfile
    image: fluxip:local
    container_name: fluxip
    restart: unless-stopped
    init: true
    depends_on:
      fluxip-init:
        condition: service_completed_successfully
    ports:
      - "${FLUXIP_BIND_ADDRESS:-127.0.0.1}:${FLUXIP_PORT:-8787}:8787"
    environment:
      ROTATOR_ENVIRONMENT: production
      ROTATOR_HOST: 0.0.0.0
      ROTATOR_PORT: 8787
      ROTATOR_DATABASE_PATH: /app/data/fluxip.db
      ROTATOR_MASTER_KEY_FILE: /app/secrets/master.key
      ROTATOR_BOOTSTRAP_TOKEN: "${ROTATOR_BOOTSTRAP_TOKEN:-}"
      ROTATOR_COOKIE_SECURE: "${ROTATOR_COOKIE_SECURE:-false}"
      ROTATOR_SESSION_DAYS: "${ROTATOR_SESSION_DAYS:-7}"
      ROTATOR_ALLOWED_ORIGINS: "${ROTATOR_ALLOWED_ORIGINS:-http://127.0.0.1:8787}"
      ROTATOR_TRUSTED_HOSTS: "${ROTATOR_TRUSTED_HOSTS:-localhost,127.0.0.1}"
      ROTATOR_TRUSTED_PROXIES: "${ROTATOR_TRUSTED_PROXIES:-127.0.0.1,::1}"
      ROTATOR_SCHEDULER_ENABLED: "${ROTATOR_SCHEDULER_ENABLED:-true}"
      ROTATOR_SCHEDULER_TICK_SECONDS: "${ROTATOR_SCHEDULER_TICK_SECONDS:-10}"
      ROTATOR_LOG_LEVEL: "${ROTATOR_LOG_LEVEL:-INFO}"
      ROTATOR_EXTERNAL_TIMEOUT_SECONDS: "${ROTATOR_EXTERNAL_TIMEOUT_SECONDS:-20}"
    volumes:
      - ./data/fluxip-data:/app/data
      - ./data/fluxip-key:/app/secrets
      - ./data/fluxip-backups:/app/backups
    read_only: true
    tmpfs:
      - /tmp:size=32m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 30s
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - import urllib.request; urllib.request.urlopen('http://127.0.0.1:8787/readyz', timeout=3).read()
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"