services:
  application:
    image: ${APPLICATION_IMAGE:?Set APPLICATION_IMAGE to a release image with digest}
    environment:
      APP_ENV: ${APP_ENV:-local}
      DATABASE_URL_FILE: /run/secrets/database_url
    secrets:
      - database_url
    depends_on:
      database:
        condition: service_healthy
    ports:
      - "127.0.0.1:8080:8080"
    healthcheck:
      test: ["CMD", "/app/healthcheck"]
      interval: 10s
      timeout: 2s
      retries: 5
    restart: unless-stopped
    mem_limit: 256m
    cpus: 0.5
    pids_limit: 128
    read_only: true
    tmpfs:
      - /tmp
    networks:
      - frontend
      - backend
    logging:
      driver: local
      options:
        max-size: "10m"
        max-file: "3"
  database:
    image: ${POSTGRES_IMAGE:?Set POSTGRES_IMAGE to a PostgreSQL image with digest}
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/database_password
    secrets:
      - database_password
    volumes:
      - database-data:/var/lib/postgresql/data
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready --username postgres --dbname postgres"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s
    restart: unless-stopped
    mem_limit: 512m
    cpus: 1.0
    pids_limit: 256
    logging:
      driver: local
      options:
        max-size: "10m"
        max-file: "3"
secrets:
  database_url:
    file: ./.secrets/database_url
  database_password:
    file: ./.secrets/database_password
volumes:
  database-data:
networks:
  frontend:
  backend:
    internal: true
