x-logging: &default-logging
  driver: json-file
  options:
    max-size: "1m"
    max-file: "1"
    tag: "{{.Name}}"

x-common-env: &common-env
  TZ: "${TZ:-America/Sao_Paulo}"

services:
  api:
    image: ${PDF_TOOLKIT_API_IMAGE}
    environment:
      <<: *common-env
      API_PORT: "${API_PORT:-8555}"
      # Prefixo externo usado pelo Traefik (PathPrefix /v1 + strip).
      API_ROOT_PATH: "${API_ROOT_PATH:-/v1}"
      PDFTOOLKIT_API_KEY: "${PDFTOOLKIT_API_KEY:-}"
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - DAC_OVERRIDE
    volumes:
      - pdf-toolkit_uploads:/tmp/uploads
    networks:
      - network_front
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:${API_PORT:-8555}/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    logging: *default-logging
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.hostname == ${NODE_HOSTNAME}
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 5
        window: 120s
      update_config:
        parallelism: 1
        delay: 10s
        order: stop-first
        failure_action: rollback
        monitor: 90s
      rollback_config:
        parallelism: 1
        order: stop-first
        monitor: 90s
      resources:
        reservations:
          cpus: "0.25"
          memory: 256M
        limits:
          cpus: "1.00"
          memory: 1024M
      labels:
        - loki_enable=true
        - traefik.enable=true
        - traefik.docker.network=network_front
        - traefik.http.routers.${APP_NAME}-api.rule=Host(`${APP_NAME}.${DOMAIN_NAME}`) && PathPrefix(`/v1`)
        - traefik.http.routers.${APP_NAME}-api.priority=100
        - traefik.http.routers.${APP_NAME}-api.entrypoints=web,websecure
        - traefik.http.routers.${APP_NAME}-api.tls=true
        - traefik.http.routers.${APP_NAME}-api.tls.certresolver=${CERT_RESOLVER}
        - traefik.http.routers.${APP_NAME}-api.service=${APP_NAME}-api
        - traefik.http.services.${APP_NAME}-api.loadbalancer.server.port=${API_PORT:-8555}
        - traefik.http.services.${APP_NAME}-api.loadbalancer.passhostheader=true
        - traefik.http.middlewares.${APP_NAME}-api-strip.stripprefix.prefixes=/v1
        - traefik.http.middlewares.${APP_NAME}-api-compress.compress=true
        - traefik.http.middlewares.${APP_NAME}-api-security.headers.contenttypenosniff=true
        - traefik.http.middlewares.${APP_NAME}-api-security.headers.referrerpolicy=strict-origin-when-cross-origin
        - traefik.http.middlewares.${APP_NAME}-api-security.headers.stsseconds=31536000
        - traefik.http.middlewares.${APP_NAME}-api-security.headers.stsincludesubdomains=true
        - traefik.http.middlewares.${APP_NAME}-api-security.headers.stspreload=true
        - traefik.http.middlewares.${APP_NAME}-api-security.headers.customresponseheaders.Server=
        - traefik.http.routers.${APP_NAME}-api.middlewares=${APP_NAME}-api-strip,${APP_NAME}-api-compress,${APP_NAME}-api-security

  web:
    image: ${PDF_TOOLKIT_WEB_IMAGE}
    environment:
      <<: *common-env
      WEB_PORT: "${WEB_PORT:-8550}"
      API_BASE_URL: "http://api:${API_PORT:-8555}"
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - DAC_OVERRIDE
    volumes:
      - pdf-toolkit_uploads:/tmp/uploads
    networks:
      - network_front
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:${WEB_PORT:-8550}/ || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    logging: *default-logging
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.hostname == ${NODE_HOSTNAME}
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 5
        window: 120s
      update_config:
        parallelism: 1
        delay: 10s
        order: stop-first
        failure_action: rollback
        monitor: 90s
      rollback_config:
        parallelism: 1
        order: stop-first
        monitor: 90s
      resources:
        reservations:
          cpus: "0.25"
          memory: 256M
        limits:
          cpus: "1.00"
          memory: 1024M
      labels:
        - loki_enable=true
        - traefik.enable=true
        - traefik.docker.network=network_front
        - traefik.http.routers.${APP_NAME}.rule=Host(`${APP_NAME}.${DOMAIN_NAME}`)
        - traefik.http.routers.${APP_NAME}.entrypoints=web,websecure
        - traefik.http.routers.${APP_NAME}.tls=true
        - traefik.http.routers.${APP_NAME}.tls.certresolver=${CERT_RESOLVER}
        - traefik.http.routers.${APP_NAME}.service=${APP_NAME}
        - traefik.http.services.${APP_NAME}.loadbalancer.server.port=${WEB_PORT:-8550}
        - traefik.http.services.${APP_NAME}.loadbalancer.passhostheader=true
        - traefik.http.middlewares.${APP_NAME}-compress.compress=true
        - traefik.http.middlewares.${APP_NAME}-security.headers.contenttypenosniff=true
        - traefik.http.middlewares.${APP_NAME}-security.headers.referrerpolicy=strict-origin-when-cross-origin
        - traefik.http.middlewares.${APP_NAME}-security.headers.stsseconds=31536000
        - traefik.http.middlewares.${APP_NAME}-security.headers.stsincludesubdomains=true
        - traefik.http.middlewares.${APP_NAME}-security.headers.stspreload=true
        - traefik.http.middlewares.${APP_NAME}-security.headers.customresponseheaders.Server=
        - traefik.http.routers.${APP_NAME}.middlewares=${APP_NAME}-compress,${APP_NAME}-security

networks:
  network_front:
    external: true
    name: network_front

volumes:
  pdf-toolkit_uploads:
    external: true
    name: pdf-toolkit_uploads