services:
  nginx:
    build:
      context: .
    image: han-chat-nginx:${RELEASE_VERSION:-local}
    environment:
      APP_ENV: ${APP_ENV:-production-like}
      PUBLIC_HOST: ${PUBLIC_HOST}
      NGINX_TLS_ENABLED: ${NGINX_TLS_ENABLED:-true}
      NGINX_TLS_CERTIFICATE: ${NGINX_TLS_CERTIFICATE}
      NGINX_TLS_CERTIFICATE_KEY: ${NGINX_TLS_CERTIFICATE_KEY}
      NGINX_HSTS_MAX_AGE: ${NGINX_HSTS_MAX_AGE:-0}
      NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-8m}
      NGINX_RATE_LIMIT_API: ${NGINX_RATE_LIMIT_API:-60r/m}
      NGINX_RATE_LIMIT_AUTH: ${NGINX_RATE_LIMIT_AUTH:-60r/m}
      NGINX_RATE_LIMIT_PUBLIC: ${NGINX_RATE_LIMIT_PUBLIC:-60r/m}
      NGINX_RATE_LIMIT_POLLING: ${NGINX_RATE_LIMIT_POLLING:-60r/m}
      NGINX_RATE_LIMIT_DOWNLOADS: ${NGINX_RATE_LIMIT_DOWNLOADS:-30r/m}
      NGINX_RATE_LIMIT_BITRIX: ${NGINX_RATE_LIMIT_BITRIX:-120r/m}
      NGINX_RATE_LIMIT_SMS_CALLBACK: ${NGINX_RATE_LIMIT_SMS_CALLBACK:-120r/m}
      NGINX_RATE_LIMIT_WS: ${NGINX_RATE_LIMIT_WS:-30r/m}
      NGINX_MESSAGE_READ_TIMEOUT_SEC: ${NGINX_MESSAGE_READ_TIMEOUT_SEC:-330}
      FRONTEND_DEV_PROXY_ENABLED: ${FRONTEND_DEV_PROXY_ENABLED:-false}
      EXPO_DEV_SERVER_URL: ${EXPO_DEV_SERVER_URL:-http://host.docker.internal:8081}
      BITRIX_FRAME_ANCESTORS: ${BITRIX_FRAME_ANCESTORS:-https://*.bitrix24.ru}
      S3_CONNECT_SRC: ${S3_CONNECT_SRC:-https://s3.storage.selcloud.ru}
    ports:
      - "${NGINX_HTTP_PORT:-80}:80"
      - "${NGINX_HTTPS_PORT:-443}:443"
    expose: ["8080"]
    volumes:
      - nginx-certs:/etc/letsencrypt:ro
      - nginx-acme-webroot:/var/www/certbot:ro
      - frontend-static:/usr/share/nginx/html:ro
      - nginx-cache:/var/cache/nginx
    networks: [public, backend]
    depends_on:
      frontend-static: {condition: service_completed_successfully}
      api-backend: {condition: service_healthy}
      keycloak: {condition: service_healthy}
      sms-service: {condition: service_healthy}
      bitrix-local-app: {condition: service_healthy}
      bitrix-sync: {condition: service_healthy}
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/nginx-health/live || curl -fsS http://127.0.0.1/nginx-health/live"]
      interval: 10s
      timeout: 3s
      retries: 10
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp:size=128m,mode=1777
      - /etc/nginx/generated:size=4m,mode=0755,uid=0,gid=0
    cap_drop: ["ALL"]
    cap_add: ["CHOWN", "NET_BIND_SERVICE", "SETUID", "SETGID"]
    security_opt: ["no-new-privileges:true"]
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ulimits:
      nofile: {soft: 65536, hard: 65536}
    logging:
      driver: json-file
      options: {max-size: "50m", max-file: "5"}

  certbot:
    image: certbot/certbot:v3.1.0
    profiles: ["certbot"]
    volumes:
      - nginx-certs:/etc/letsencrypt
      - nginx-acme-webroot:/var/www/certbot
    networks: [public]
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]