compose.vps.https.yaml

# Public HTTPS endpoint; signup fails closed until real Turnstile keys are set.
x-public-environment: &public-environment
  APP_ENV: production
  WORKSPACE_LIMIT: "10"
  GOOGLE_OAUTH_CLIENT_ID: ${GOOGLE_OAUTH_CLIENT_ID:-}
  GOOGLE_OAUTH_CLIENT_SECRET: ${GOOGLE_OAUTH_CLIENT_SECRET:-}
  GMAIL_TOKEN_ENCRYPTION_KEY: ${GMAIL_TOKEN_ENCRYPTION_KEY:-}
  LEGAL_BUSINESS_NAME: ${LEGAL_BUSINESS_NAME:-Kseniia Blokhina}
  LEGAL_COUNTRY: ${LEGAL_COUNTRY:-Germany}
  LEGAL_CONTACT_EMAIL: ${LEGAL_CONTACT_EMAIL:-info.xenonimus@gmail.com}
  PUBLIC_BASE_URL: https://${APP_DOMAIN:-app.xenonimus.com}
  REQUIRE_VERIFIED_EMAIL: "true"
  ALLOW_DEMO_SIGNUP: "false"
  REQUIRE_SIGNUP_CAPTCHA: "true"
  TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY:-}
  TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY:-}
  PUBLIC_INTAKE_ENABLED: "false"
  FAULT_INJECTION_ENABLED: "false"
  CODE_VERSION: vps-https

services:
  app:
    environment: *public-environment
    # Caddy is the only public entry point and replaces client proxy headers.
    ports: !reset []
    command:
      - uvicorn
      - supportops.main:app
      - --host
      - "0.0.0.0"
      - --port
      - "8000"
      - --proxy-headers
      - --forwarded-allow-ips=*

  worker:
    environment: *public-environment

  caddy:
    image: caddy:2.11.7-alpine@sha256:eb4d35b7452d1ab6171fbdbe8d9275b2301dad6dad92115d91e19fb9b24d510f
    environment:
      APP_DOMAIN: ${APP_DOMAIN:-app.xenonimus.com}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./deploy/caddy:/etc/caddy:ro
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - access
    depends_on:
      app:
        condition: service_healthy
    read_only: true
    tmpfs:
      - /tmp:size=16m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    mem_limit: 256m
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
      interval: 15s
      timeout: 5s
      start_period: 30s
      retries: 5
    restart: unless-stopped

volumes:
  # ACME account and certificates must survive container recreation.
  caddy_data:
  caddy_config: