services:
  redis:
    image: ${REDIS_IMAGE:?REDIS_IMAGE must be pinned by digest}
    labels:
      com.han.service.name: redis
    environment:
      REDIS_MAXMEMORY: ${REDIS_MAXMEMORY:-384mb}
      REDIS_EVICTION_POLICY: ${REDIS_EVICTION_POLICY:-volatile-lru}
    secrets:
      - redis_api_password
      - redis_health_password
    expose: ["6379"]
    volumes:
      - redis-data:/data
    networks: [backend]
    healthcheck:
      test: ["CMD-SHELL", "REDISCLI_AUTH=\"$$(cat /run/secrets/redis_health_password)\" redis-cli --user ops_health PING | grep -qx PONG"]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 10s
    restart: unless-stopped
    stop_grace_period: 30s
    read_only: true
    tmpfs:
      - /tmp:size=8m,mode=1777
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    pids_limit: 128
    mem_limit: 512m
    cpus: 0.5
    ulimits:
      core: {soft: 0, hard: 0}
      nofile: {soft: 65536, hard: 65536}
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
        tag: redis

secrets:
  redis_api_password:
    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_API_PASSWORD
  redis_health_password:
    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_HEALTH_PASSWORD