services:
  upload:
    build:
      context: .
      dockerfile: Containerfile
    restart: unless-stopped
    ports: ["127.0.0.1:${PHOTO_PORT:-8088}:8000"]
    volumes:
      - photo-data:/data
      - ${PHOTO_TOKEN_FILE:?Set PHOTO_TOKEN_FILE to an absolute path}:/run/secrets/photo_token:ro
      - ${PHOTO_PUBLIC_DIR:?Set PHOTO_PUBLIC_DIR to the deployment directory}:/published:ro
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/healthz')"]
      interval: 30s
      timeout: 5s
      retries: 3
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]

  publisher:
    build:
      context: .
      dockerfile: Containerfile
    command: ["python", "publisher.py"]
    restart: unless-stopped
    environment:
      PHOTO_REPOSITORY: ${PHOTO_REPOSITORY:-git@github.com:mdibaiee/mahdi.blog.git}
      PHOTO_BRANCH: ${PHOTO_BRANCH:-master}
      PHOTO_GIT_NAME: Photo publisher
      PHOTO_GIT_EMAIL: ${PHOTO_GIT_EMAIL:-photos@theread.me}
      GIT_SSH_COMMAND: ssh -i /run/secrets/git_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/run/secrets/known_hosts
    volumes:
      - photo-data:/data
      - photo-work:/work
      - ${PHOTO_GIT_KEY_FILE:?Set PHOTO_GIT_KEY_FILE to an absolute path}:/run/secrets/git_key:ro
      - ${PHOTO_KNOWN_HOSTS_FILE:?Set PHOTO_KNOWN_HOSTS_FILE to an absolute path}:/run/secrets/known_hosts:ro
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]

volumes:
  photo-data:
  photo-work: