services:
  postgres:
    image: postgres:17.5-bookworm
    environment:
      POSTGRES_DB: proxmox_simulator
      POSTGRES_USER: proxmox
      POSTGRES_PASSWORD: proxmox
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U proxmox -d proxmox_simulator"]
      interval: 5s
      timeout: 3s
      retries: 10
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"

  simulator:
    build:
      context: .
      target: runtime
    env_file:
      - path: .env
        required: false
    environment:
      DATABASE_URL: postgresql://proxmox:proxmox@postgres:5432/proxmox_simulator
      CONTRACT_SNAPSHOT: /app/contracts/pve-9.2.3.json
      COMPATIBILITY_EVIDENCE: /app/evidence/pve-9.2.3-0.1.0.json
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8006/health/ready', timeout=2)"]
      interval: 10s
      timeout: 3s
      retries: 5
    ports:
      - "8006:8006"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true

  tls-gateway:
    image: nginx:1.28.0-alpine
    depends_on:
      simulator:
        condition: service_healthy
    ports:
      - "8007:8443"
    volumes:
      - ./docker/tls/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./docker/tls/server.crt:/etc/nginx/tls/server.crt:ro
      - ./docker/tls/server.key:/etc/nginx/tls/server.key:ro
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run
      - /tmp
    security_opt:
      - no-new-privileges:true

volumes:
  postgres-data: