# Pull-only production job: no source checkout, build, or searches.toml host bind.
# Searches and application code come from the same digest-pinned image.
name: car-tracker-app

services:
  app:
    image: "${CAR_TRACKER_IMAGE:?Set a digest-pinned image}"
    restart: "no"
    init: true
    stop_grace_period: 30s
    user: "${APP_UID:-1000}:${APP_GID:-1000}"
    read_only: true
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    cpus: 1.5
    mem_limit: 2g
    pids_limit: 256
    shm_size: 512m
    tmpfs:
      - /tmp:rw,nosuid,nodev,size=512m,mode=1777
      - /tmp/.X11-unix:rw,nosuid,nodev,size=1m,mode=1777
    environment:
      PGHOST: "${PGHOST:?Set the existing PostgreSQL hostname or IP}"
      PGPORT: "${PGPORT:-5432}"
      PGDATABASE: "${PGDATABASE:?Set the application database name}"
      PGUSER: "${PGUSER:?Set the application database role}"
      PGSSLMODE: "${PGSSLMODE:-require}"
      PGPASSFILE: /run/db/pgpass
      PGSSLROOTCERT: /run/db/root.crt
      # Host-owned collection policy. The restricted SSH wrapper validates these
      # and builds a fixed argv; all omits the corresponding CLI limit/filter.
      COLLECT_FAMILY: "${COLLECT_FAMILY:-saab-900}"
      COLLECT_MAX_PAGES: "${COLLECT_MAX_PAGES:-1}"
      COLLECT_MAX_DETAILS: "${COLLECT_MAX_DETAILS:-1}"
      COLLECT_DELAY: "${COLLECT_DELAY:-5}"
      COLLECT_DETAIL_POLICY: "${COLLECT_DETAIL_POLICY:-always}"
      COLLECT_DETAIL_REFRESH_DAYS: "${COLLECT_DETAIL_REFRESH_DAYS:-7}"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - type: bind
        source: "${RAW_DATA_DIR:?Set an existing private raw storage directory}"
        target: /data
        bind:
          create_host_path: false
      - type: bind
        source: "${DB_CONFIG_DIR:?Set an existing private DB configuration directory}"
        target: /run/db
        read_only: true
        bind:
          create_host_path: false
    networks:
      app:

networks:
  app:
    ipam:
      config:
        - subnet: "${APP_SUBNET:-172.30.17.0/28}"