# A self-contained stack for the userservice: its own PostgreSQL (a separate
# database from the coordinator's — different bounded context), a one-shot
# migration step, and the service. The project name and host ports differ from
# the coordinator's so both stacks can run side by side on one machine.
name: scimesh-users

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-scimesh}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-scimesh}
      POSTGRES_DB: ${POSTGRES_DB:-scimesh_users}
    ports:
      # 5433 on the host, so it never clashes with the coordinator's 5432.
      - "${POSTGRES_PORT:-5433}:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      # Everything else waits on this, so the check must prove the server
      # accepts queries — not merely that the port is open.
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-scimesh} -d ${POSTGRES_DB:-scimesh_users}"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s

  # One-shot: applies migrations, then exits. Schema changes stay an explicit
  # deployment step — the service binary never migrates on startup.
  migrate:
    image: migrate/migrate:v4.17.1
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./migrations:/migrations:ro
    command:
      - -path=/migrations
      - -database=postgres://${POSTGRES_USER:-scimesh}:${POSTGRES_PASSWORD:-scimesh}@postgres:5432/${POSTGRES_DB:-scimesh_users}?sslmode=disable
      - up
    restart: on-failure

  userservice:
    build:
      context: .
    depends_on:
      postgres:
        condition: service_healthy
      # Start only once the schema exists, otherwise the first query fails.
      migrate:
        condition: service_completed_successfully
    environment:
      USERSERVICE_ADDR: ":8081"
      # Host is the service name: compose resolves it on the project network.
      DATABASE_URL: postgres://${POSTGRES_USER:-scimesh}:${POSTGRES_PASSWORD:-scimesh}@postgres:5432/${POSTGRES_DB:-scimesh_users}?sslmode=disable
      # MUST match the coordinator's JWT secret so it can verify these tokens.
      JWT_SECRET: ${JWT_SECRET:-dev-secret-change-me-at-least-32-bytes}
      JWT_TTL: ${JWT_TTL:-24h}
      DB_MAX_CONNS: "10"
      REQUEST_TIMEOUT: "15s"
      LOG_LEVEL: ${LOG_LEVEL:-info}
      # Logs are teed to stdout (docker logs) and this rotated file on a named
      # volume, so they survive a rebuild.
      LOG_FILE: /var/log/scimesh/userservice.log
    ports:
      - "${USERSERVICE_PORT:-8081}:8081"
    # A named volume (not a host bind mount): it inherits the image's directory
    # ownership, so the non-root process can write to it.
    volumes:
      - userservice_logs:/var/log/scimesh
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8081/health"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s
    restart: unless-stopped

volumes:
  pgdata:
  userservice_logs: