x-api-job-secrets: &api-job-secrets
  - api_database_url
  - api_redis_url
  - api_redis_realtime_url
  - message_safety_service_token
  - bitrix_local_app_internal_token
  - bitrix_api_inbox_token
  - keycloak_settings_bridge_token
  - selectel_s3_access_key
  - selectel_s3_secret_key
  - cursor_hmac_secret

x-api-job-environment: &api-job-environment
  HAN_SECRET_VARS: >-
    DATABASE_URL REDIS_URL REDIS_REALTIME_URL MESSAGE_SAFETY_SERVICE_TOKEN
    BITRIX_LOCAL_APP_INTERNAL_TOKEN BITRIX_API_INBOX_TOKEN
    KEYCLOAK_SETTINGS_BRIDGE_TOKEN SELECTEL_S3_ACCESS_KEY SELECTEL_S3_SECRET_KEY
    CURSOR_HMAC_SECRET
  DATABASE_URL_FILE: /run/secrets/api_database_url
  REDIS_URL_FILE: /run/secrets/api_redis_url
  REDIS_REALTIME_URL_FILE: /run/secrets/api_redis_realtime_url
  MESSAGE_SAFETY_SERVICE_TOKEN_FILE: /run/secrets/message_safety_service_token
  BITRIX_LOCAL_APP_INTERNAL_TOKEN_FILE: /run/secrets/bitrix_local_app_internal_token
  BITRIX_API_INBOX_TOKEN_FILE: /run/secrets/bitrix_api_inbox_token
  KEYCLOAK_SETTINGS_BRIDGE_TOKEN_FILE: /run/secrets/keycloak_settings_bridge_token
  SELECTEL_S3_ACCESS_KEY_FILE: /run/secrets/selectel_s3_access_key
  SELECTEL_S3_SECRET_KEY_FILE: /run/secrets/selectel_s3_secret_key
  CURSOR_HMAC_SECRET_FILE: /run/secrets/cursor_hmac_secret
  APP_ENV: ${APP_ENV:-production-like}
  LOG_LEVEL: ${LOG_LEVEL:-INFO}
  KEYCLOAK_PUBLIC_URL: ${KEYCLOAK_PUBLIC_URL}
  KEYCLOAK_INTERNAL_URL: ${KEYCLOAK_INTERNAL_URL:-http://keycloak:8080/auth}
  KEYCLOAK_REALM: ${KEYCLOAK_REALM:-han-chat}
  KEYCLOAK_AUDIENCE: ${KEYCLOAK_AUDIENCE:-han-chat-api}
  MESSAGE_SAFETY_URL: ${MESSAGE_SAFETY_URL:-https://processing.internal:8443}
  MESSAGE_SAFETY_API_PREFIX: ${MESSAGE_SAFETY_API_PREFIX:-/internal/safety/v2}
  MESSAGE_SAFETY_CA_FILE: /run/config/message-safety-internal-ca.pem
  MESSAGE_SAFETY_POST_TIMEOUT_SEC: ${MESSAGE_SAFETY_POST_TIMEOUT_SEC:-5}
  MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC: ${MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC:-2}
  MESSAGE_SAFETY_TASK_POLL_MAX_SEC: ${MESSAGE_SAFETY_TASK_POLL_MAX_SEC:-300}
  BITRIX_LOCAL_APP_BASE_URL: ${BITRIX_LOCAL_APP_BASE_URL:-http://bitrix-local-app:8080}
  BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC: ${BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC:-20}
  SELECTEL_S3_ENDPOINT_URL: ${SELECTEL_S3_ENDPOINT_URL}
  SELECTEL_S3_BUCKET_DOCUMENTS: ${SELECTEL_S3_BUCKET_DOCUMENTS}
  SELECTEL_S3_BUCKET_ATTACHMENTS: ${SELECTEL_S3_BUCKET_ATTACHMENTS}
  SELECTEL_S3_BUCKET_QUARANTINE: ${SELECTEL_S3_BUCKET_QUARANTINE}
  TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-127.0.0.1/32}

x-python-job-runtime: &python-job-runtime
  read_only: true
  tmpfs:
    - /tmp:size=64m,mode=1777
  cap_drop: ["ALL"]
  security_opt: ["no-new-privileges:true"]
  pids_limit: 128
  mem_limit: 512m
  cpus: 0.5
  ulimits:
    core: {soft: 0, hard: 0}

services:
  migrate-api:
    <<: *python-job-runtime
    image: ${API_BACKEND_IMAGE:?API_BACKEND_IMAGE must be pinned by digest}
    profiles: ["ops"]
    environment:
      HAN_SECRET_VARS: DATABASE_URL
      DATABASE_URL_FILE: /run/secrets/api_database_url
    secrets:
      - api_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"

  migrate-bitrix-local:
    <<: *python-job-runtime
    image: ${BITRIX_LOCAL_APP_IMAGE:?BITRIX_LOCAL_APP_IMAGE must be pinned by digest}
    profiles: ["ops"]
    environment:
      HAN_SECRET_VARS: BITRIX_DATABASE_URL
      BITRIX_DATABASE_URL_FILE: /run/secrets/bitrix_database_url
    secrets:
      - bitrix_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"

  migrate-sms:
    <<: *python-job-runtime
    image: ${SMS_SERVICE_IMAGE:?SMS_SERVICE_IMAGE must be pinned by digest}
    profiles: ["ops"]
    environment:
      HAN_SECRET_VARS: SMS_DATABASE_URL
      SMS_DATABASE_URL_FILE: /run/secrets/sms_database_url
    secrets:
      - sms_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"

  seed-settings:
    <<: *python-job-runtime
    image: ${API_BACKEND_IMAGE:?API_BACKEND_IMAGE must be pinned by digest}
    profiles: ["ops"]
    environment: *api-job-environment
    secrets: *api-job-secrets
    command:
      - /bin/sh
      - -ec
      - >-
        python -m app.cli.seed_settings
        --file /deployment/app-settings.production-like.yaml
        && python -m app.cli.validate_settings
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
      - ${MESSAGE_SAFETY_CA_HOST_PATH}:/run/config/message-safety-internal-ca.pem:ro
      - ./app-settings.production-like.yaml:/deployment/app-settings.production-like.yaml:ro
    networks: [backend, egress]
    restart: "no"

  toolbox:
    image: ${TOOLBOX_IMAGE:?TOOLBOX_IMAGE must be pinned by digest}
    profiles: ["ops"]
    entrypoint: ["sleep", "infinity"]
    networks: [backend, observability, egress]
    restart: "no"
    read_only: true
    tmpfs: ["/tmp:size=16m,mode=1777"]
    cap_drop: ["ALL"]
    security_opt: ["no-new-privileges:true"]
    pids_limit: 32
    mem_limit: 64m
    cpus: 0.25