name: car-traker-app

services:
  app:
    build:
      context: ../..
      dockerfile: Dockerfile
    image: car-traker:local
    # One-shot manual job only. Never restart a blocked scraper automatically.
    restart: "no"
    init: true
    stop_grace_period: 30s
    user: "${APP_UID:-1000}:${APP_GID:-1000}"
    read_only: true
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    cpus: 1.5
    mem_limit: 2g
    pids_limit: 256
    shm_size: 512m
    tmpfs:
      - /tmp:rw,nosuid,nodev,size=512m,mode=1777
      - /tmp/.X11-unix:rw,nosuid,nodev,size=1m,mode=1777
    environment:
      PGHOST: "${PGHOST:?Set the existing PostgreSQL hostname or IP}"
      PGPORT: "${PGPORT:-5432}"
      PGDATABASE: "${PGDATABASE:?Set the application database name}"
      PGUSER: "${PGUSER:?Set the application database role}"
      PGSSLMODE: "${PGSSLMODE:-require}"
      PGPASSFILE: /run/db/pgpass
      PGSSLROOTCERT: /run/db/root.crt
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - type: bind
        source: "${RAW_DATA_DIR:?Set an existing private raw storage directory}"
        target: /data
        bind:
          create_host_path: false
      - type: bind
        source: "${DB_CONFIG_DIR:?Set an existing private directory containing pgpass}"
        target: /run/db
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: ../../searches.toml
        target: /app/searches.toml
        read_only: true
    networks:
      app:

networks:
  app:
    ipam:
      config:
        - subnet: "${APP_SUBNET:-172.30.17.0/28}"