name: architecture-standards

services:
  site:
    image: ${STANDARDS_IMAGE:?set an immutable registry@sha256 reference}
    platform: linux/amd64
    pull_policy: always
    user: "101:101"
    read_only: true
    tmpfs:
      - /tmp:uid=101,gid=101,mode=0750
      - /var/cache/nginx:uid=101,gid=101,mode=0750
      - /var/run:uid=101,gid=101,mode=0750
    ports:
      - name: http
        target: 8080
        published: "${STANDARDS_HTTP_PORT:-8080}"
        host_ip: "${STANDARDS_BIND_ADDRESS:-127.0.0.1}"
        protocol: tcp
    healthcheck:
      test:
        - CMD
        - wget
        - --quiet
        - --output-document=/dev/null
        - http://127.0.0.1:8080/
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    stop_grace_period: 10s
    mem_limit: 128m
    cpus: 0.50
    pids_limit: 100
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - frontend
    logging:
      driver: local
      options:
        max-size: "10m"
        max-file: "5"

networks:
  frontend:
    driver: bridge
