name: wyndham-arr2

services:
  web:
    build:
      context: .
    image: "${ARR_IMAGE_NAME:-wyndham-arr2}:${ARR_IMAGE_TAG:-latest}"
    restart: unless-stopped
    init: true
    command:
      - python
      - -m
      - arr_web.run
      - --host
      - 0.0.0.0
      - --port
      - "8765"
      - --enable-processing
      - --secure-cookies
    environment:
      ARR_WEB_USERNAME: "${ARR_WEB_USERNAME:?set ARR_WEB_USERNAME in deploy/.env.production}"
      ARR_WEB_PASSWORD: "${ARR_WEB_PASSWORD:?set ARR_WEB_PASSWORD in deploy/.env.production}"
      ARR_DATABASE_URL: "${ARR_DATABASE_URL:?set ARR_DATABASE_URL in deploy/.env.production}"
      ARR_OBJECT_PREFIX: "${ARR_OBJECT_PREFIX:-arr}"
      ARR_OSS_REGION: "${ARR_OSS_REGION:?set ARR_OSS_REGION}"
      ARR_OSS_ENDPOINT: "${ARR_OSS_ENDPOINT:-}"
      ARR_OSS_BUCKET: "${ARR_OSS_BUCKET:?set ARR_OSS_BUCKET}"
      OSS_ACCESS_KEY_ID: "${OSS_ACCESS_KEY_ID:?set OSS_ACCESS_KEY_ID or adapt Compose for a RAM role}"
      OSS_ACCESS_KEY_SECRET: "${OSS_ACCESS_KEY_SECRET:?set OSS_ACCESS_KEY_SECRET or adapt Compose for a RAM role}"
      OSS_SESSION_TOKEN: "${OSS_SESSION_TOKEN:-}"
    expose:
      - "8765"
    volumes:
      - arr_outputs:/app/outputs
    tmpfs:
      - /tmp:size=256m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - >-
          import sys,urllib.request;
          urllib.request.urlopen('http://127.0.0.1:8765/healthz',timeout=5).read();
          sys.exit(0)
      interval: 15s
      timeout: 6s
      retries: 12
      start_period: 20s

  caddy:
    image: caddy:2.10-alpine
    restart: unless-stopped
    depends_on:
      web:
        condition: service_healthy
    environment:
      WEB_PUBLIC_HOST: "${WEB_PUBLIC_HOST:?set WEB_PUBLIC_HOST}"
      ACME_EMAIL: "${ACME_EMAIL:?set ACME_EMAIL}"
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./deploy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    security_opt:
      - no-new-privileges:true

volumes:
  arr_outputs:
  caddy_data:
  caddy_config: