name: backup-tool

x-app-base: &app-base
  build:
    context: .
    dockerfile: Dockerfile
  image: backup-tool:local
  init: true
  read_only: true
  tmpfs:
    - /tmp:mode=1777,size=64m
  cap_drop:
    - ALL
  security_opt:
    - no-new-privileges:true
  environment:
    BACKUP_TOOL_DATA_DIR: /var/lib/backup-tool
    BACKUP_TOOL_DATABASE_URL: sqlite+aiosqlite:////var/lib/backup-tool/metadata.db
    BACKUP_TOOL_REPOSITORY_ROOTS: '["/var/lib/backup-tool/repositories"]'
    BACKUP_TOOL_LOCAL_SOURCE_ROOTS: '["/mnt/sources"]'
    BACKUP_TOOL_RESTORE_ROOTS: '["/var/lib/backup-tool/restores"]'
    BACKUP_TOOL_MASTER_KEY_FILE: /run/backup-tool-secrets/master.key
    BACKUP_TOOL_WEB_SOCKET_PATH: /run/backup-tool/web.sock
    BACKUP_TOOL_PUBLIC_BASE_URL: ${BACKUP_TOOL_PUBLIC_BASE_URL:-http://localhost:8080}
  volumes:
    - backup-tool-data:/var/lib/backup-tool
    - backup-tool-runtime:/run/backup-tool
    - type: bind
      source: ${BACKUP_TOOL_SOURCES_DIR:-./sources}
      target: /mnt/sources
      read_only: true
    - type: bind
      source: ${BACKUP_TOOL_MASTER_KEY_FILE:-./secrets/master.key}
      target: /run/backup-tool-secrets/master.key
      read_only: true

services:
  migrate:
    <<: *app-base
    command: ["migrate", "upgrade"]
    restart: "no"

  web:
    <<: *app-base
    command: ["web"]
    depends_on:
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "backup-tool", "health", "web"]
      interval: 10s
      timeout: 10s
      retries: 6
      start_period: 0s

  scheduler:
    <<: *app-base
    command: ["scheduler"]
    depends_on:
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "backup-tool", "health", "scheduler"]
      interval: 10s
      timeout: 10s
      retries: 6
      start_period: 0s

  worker:
    <<: *app-base
    command: ["worker"]
    depends_on:
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "backup-tool", "health", "worker"]
      interval: 10s
      timeout: 10s
      retries: 6
      start_period: 0s

  admin:
    <<: *app-base
    profiles: ["admin"]
    command: ["admin", "--help"]
    depends_on:
      migrate:
        condition: service_completed_successfully

  proxy:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    image: backup-tool-proxy:local
    init: true
    read_only: true
    tmpfs:
      - /tmp:mode=1777,size=64m
      - /var/cache/nginx:uid=10001,gid=0,mode=0750,size=32m
      - /var/run:uid=10001,gid=0,mode=0750,size=8m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    ports:
      - "127.0.0.1:${BACKUP_TOOL_PORT:-8080}:8080"
    volumes:
      - backup-tool-runtime:/run/backup-tool:ro
    depends_on:
      web:
        condition: service_healthy

volumes:
  backup-tool-data:
  backup-tool-runtime: