services:
  bitrix-sync:
    build: .
    image: han-bitrix-sync:${BITRIX_SYNC_IMAGE_TAG:-local}
    command: ["han-bitrix-sync-api"]
    user: "10001:10001"
    read_only: true
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    tmpfs: ["/tmp:rw,noexec,nosuid,nodev,size=16m"]
    expose: ["8080"]
    environment: &sync_environment
      BITRIX_SYNC_ENABLED: ${BITRIX_SYNC_ENABLED:-false}
      BITRIX_SYNC_MODE: ${BITRIX_SYNC_MODE:-disabled}
      BITRIX_SYNC_DATABASE_URL_FILE: /run/secrets/bitrix_sync_database_url
      BITRIX_SYNC_CRM_REST_WEBHOOK_URL_FILE: /run/secrets/bitrix_sync_crm_url
      BITRIX_SYNC_CONTACT_RECEIVER_TOKEN_FILE: /run/secrets/bitrix_sync_contact_token
      BITRIX_SYNC_ALERT_RECEIVER_TOKEN_FILE: /run/secrets/bitrix_sync_alert_token
      BITRIX_SYNC_SERVICE_TOKEN_FILE: /run/secrets/bitrix_sync_service_token
      BITRIX_SYNC_PORTAL_HOST: ${BITRIX_SYNC_PORTAL_HOST:-}
      BITRIX_SYNC_PORTAL_MEMBER_ID: ${BITRIX_SYNC_PORTAL_MEMBER_ID:-}
      BITRIX_SYNC_PUBLIC_BASE_URL: ${BITRIX_SYNC_PUBLIC_BASE_URL:-}
      BITRIX_SYNC_CONTACT_USER_ID_FIELD: ${BITRIX_SYNC_CONTACT_USER_ID_FIELD:-}
      BITRIX_SYNC_CONTACT_REGISTERED_FIELD: ${BITRIX_SYNC_CONTACT_REGISTERED_FIELD:-}
      BITRIX_SYNC_CONTACT_CITIZENSHIP_FIELD: ${BITRIX_SYNC_CONTACT_CITIZENSHIP_FIELD:-}
      BITRIX_SYNC_WEBHOOK_ALLOWED_CIDRS: ${BITRIX_WEBHOOK_ALLOWED_CIDRS:-}
    volumes: &sync_secrets
      - /run/han-chat/secrets/bitrix-sync/database-url:/run/secrets/bitrix_sync_database_url:ro
      - /run/han-chat/secrets/bitrix-sync/crm-rest-webhook-url:/run/secrets/bitrix_sync_crm_url:ro
      - /run/han-chat/secrets/bitrix-sync/contact-receiver-token:/run/secrets/bitrix_sync_contact_token:ro
      - /run/han-chat/secrets/bitrix-sync/alert-receiver-token:/run/secrets/bitrix_sync_alert_token:ro
      - /run/han-chat/secrets/bitrix-sync/service-token:/run/secrets/bitrix_sync_service_token:ro
    networks: [backend, egress, observability]
    pids_limit: 128
    mem_limit: 256m
    cpus: 0.50
    restart: unless-stopped
    healthcheck:
      test:
        ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/live',timeout=2)"]
      interval: 30s
      timeout: 3s
      retries: 3

  bitrix-sync-worker:
    image: han-bitrix-sync:${BITRIX_SYNC_IMAGE_TAG:-local}
    command: ["han-bitrix-sync-worker"]
    user: "10001:10001"
    read_only: true
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    tmpfs: ["/tmp:rw,noexec,nosuid,nodev,size=16m"]
    environment: *sync_environment
    volumes: *sync_secrets
    networks: [egress, observability]
    pids_limit: 128
    mem_limit: 256m
    cpus: 0.75
    restart: unless-stopped

  bitrix-sync-reconciliation:
    image: han-bitrix-sync:${BITRIX_SYNC_IMAGE_TAG:-local}
    command: ["han-bitrix-sync-reconciliation"]
    user: "10001:10001"
    read_only: true
    security_opt: ["no-new-privileges:true"]
    cap_drop: ["ALL"]
    tmpfs: ["/tmp:rw,noexec,nosuid,nodev,size=16m"]
    environment: *sync_environment
    volumes: *sync_secrets
    networks: [egress, observability]
    pids_limit: 128
    mem_limit: 192m
    cpus: 0.50
    restart: "no"

networks:
  backend:
    external: true
  egress:
    external: true
  observability:
    external: true