han-app/codebase/backend/deployment/docker-compose.jobs.yml

x-api-job-secrets: &api-job-secrets
  - api_database_url
  - api_redis_url
  - api_redis_realtime_url
  - message_safety_service_token
  - bitrix_local_app_internal_token
  - bitrix_api_inbox_token
  - keycloak_settings_bridge_token
  - selectel_s3_access_key
  - selectel_s3_secret_key
  - cursor_hmac_secret

x-api-job-environment: &api-job-environment
  HAN_SECRET_VARS: >-
    DATABASE_URL REDIS_URL REDIS_REALTIME_URL MESSAGE_SAFETY_SERVICE_TOKEN
    BITRIX_LOCAL_APP_INTERNAL_TOKEN BITRIX_API_INBOX_TOKEN
    KEYCLOAK_SETTINGS_BRIDGE_TOKEN SELECTEL_S3_ACCESS_KEY SELECTEL_S3_SECRET_KEY
    CURSOR_HMAC_SECRET
  DATABASE_URL_FILE: /run/secrets/api_database_url
  REDIS_URL_FILE: /run/secrets/api_redis_url
  REDIS_REALTIME_URL_FILE: /run/secrets/api_redis_realtime_url
  MESSAGE_SAFETY_SERVICE_TOKEN_FILE: /run/secrets/message_safety_service_token
  BITRIX_LOCAL_APP_INTERNAL_TOKEN_FILE: /run/secrets/bitrix_local_app_internal_token
  BITRIX_API_INBOX_TOKEN_FILE: /run/secrets/bitrix_api_inbox_token
  KEYCLOAK_SETTINGS_BRIDGE_TOKEN_FILE: /run/secrets/keycloak_settings_bridge_token
  SELECTEL_S3_ACCESS_KEY_FILE: /run/secrets/selectel_s3_access_key
  SELECTEL_S3_SECRET_KEY_FILE: /run/secrets/selectel_s3_secret_key
  CURSOR_HMAC_SECRET_FILE: /run/secrets/cursor_hmac_secret
  APP_ENV: ${APP_ENV:-production-like}
  LOG_LEVEL: ${LOG_LEVEL:-INFO}
  KEYCLOAK_PUBLIC_URL: ${KEYCLOAK_PUBLIC_URL}
  KEYCLOAK_INTERNAL_URL: ${KEYCLOAK_INTERNAL_URL:-http://keycloak:8080/auth}
  KEYCLOAK_REALM: ${KEYCLOAK_REALM:-han-chat}
  KEYCLOAK_AUDIENCE: ${KEYCLOAK_AUDIENCE:-han-chat-api}
  MESSAGE_SAFETY_URL: ${MESSAGE_SAFETY_URL}
  MESSAGE_SAFETY_API_PREFIX: /internal/safety/v2
  MESSAGE_SAFETY_CA_FILE: /run/config/message-safety-internal-ca.pem
  MESSAGE_SAFETY_POST_TIMEOUT_SEC: ${MESSAGE_SAFETY_POST_TIMEOUT_SEC:-5}
  MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC: ${MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC:-2}
  MESSAGE_SAFETY_TASK_POLL_MAX_SEC: ${MESSAGE_SAFETY_TASK_POLL_MAX_SEC:-300}
  BITRIX_LOCAL_APP_BASE_URL: ${BITRIX_LOCAL_APP_BASE_URL:-http://bitrix-local-app:8080}
  BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC: ${BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC:-20}
  SELECTEL_S3_ENDPOINT_URL: ${SELECTEL_S3_ENDPOINT_URL}
  SELECTEL_S3_BUCKET_DOCUMENTS: ${SELECTEL_S3_BUCKET_DOCUMENTS}
  SELECTEL_S3_BUCKET_ATTACHMENTS: ${SELECTEL_S3_BUCKET_ATTACHMENTS}
  SELECTEL_S3_BUCKET_QUARANTINE: ${SELECTEL_S3_BUCKET_QUARANTINE}
  TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-127.0.0.1/32}

services:
  migrate-api:
    image: ${API_BACKEND_IMAGE:-han-chat-api-backend:local}
    profiles: ["ops"]
    environment:
      HAN_SECRET_VARS: DATABASE_URL
      DATABASE_URL_FILE: /run/secrets/api_database_url
    secrets:
      - api_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
    ulimits:
      core: {soft: 0, hard: 0}

  migrate-bitrix-local:
    image: ${BITRIX_LOCAL_APP_IMAGE:-han-chat-bitrix-local-app:local}
    profiles: ["ops"]
    environment:
      HAN_SECRET_VARS: BITRIX_DATABASE_URL
      BITRIX_DATABASE_URL_FILE: /run/secrets/bitrix_database_url
    secrets:
      - bitrix_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
    ulimits:
      core: {soft: 0, hard: 0}

  migrate-bitrix-sync:
    image: ${BITRIX_SYNC_IMAGE:-han-chat-bitrix-sync:local}
    profiles: ["ops"]
    environment:
      HAN_SECRET_VARS: BITRIX_SYNC_DATABASE_URL
      BITRIX_SYNC_DATABASE_URL_FILE: /run/secrets/bitrix_sync_database_url
    secrets:
      - bitrix_sync_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
    ulimits:
      core: {soft: 0, hard: 0}

  migrate-sms:
    image: ${SMS_SERVICE_IMAGE:-han-chat-sms-service:local}
    profiles: ["ops"]
    environment:
      HAN_SECRET_VARS: SMS_DATABASE_URL
      SMS_DATABASE_URL_FILE: /run/secrets/sms_database_url
    secrets:
      - sms_database_url
    command: ["alembic", "upgrade", "head"]
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
    ulimits:
      core: {soft: 0, hard: 0}

  seed-settings:
    image: ${API_BACKEND_IMAGE:-han-chat-api-backend:local}
    profiles: ["ops"]
    environment: *api-job-environment
    secrets: *api-job-secrets
    command:
      - /bin/sh
      - -ec
      - >-
        python -m app.cli.seed_settings
        --file /deployment/app-settings.production-like.yaml
        && python -m app.cli.validate_settings
    volumes:
      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
      - ${MESSAGE_SAFETY_CA_HOST_PATH}:/run/config/message-safety-internal-ca.pem:ro
      - ./app-settings.production-like.yaml:/deployment/app-settings.production-like.yaml:ro
    networks: [backend, egress]
    restart: "no"
    security_opt: ["no-new-privileges:true"]
    ulimits:
      core: {soft: 0, hard: 0}

  toolbox:
    image: curlimages/curl:8.11.1
    profiles: ["ops"]
    entrypoint: ["sleep", "infinity"]
    networks: [backend, observability, egress]
    restart: "no"
    cap_drop: ["ALL"]
    security_opt: ["no-new-privileges:true"]